A manual dispatch is how we ship a strawcore-only change (strawcore is cloned
fresh at build time) into an APK without a straw code change. The publish step
was gated push-only, so a dispatch built + signer-verified the APK and then
silently skipped publishing — a green run that shipped nothing. Allow the
dispatch event to publish as well (push still requires ref=main).
runs-on: ubuntu-latest + actions/checkout@v4 (a node action) can't run on our
Forgejo runners — it has failed on every push since the crafting-table:local
image was retired. Secret-scanning coverage is unaffected: the strict
enforcement layer is the server-side pre-receive gitleaks hook on the bare repo
(this workflow was only the redundant per-PR status), which still rejects any
push introducing a secret.
Ship scrubbed device logs to our self-hosted ingest (logs.sulkta.com) so a
'green in every offline gate, broken on-device' regression (the visionOS
playback outage) can be caught end-to-end. LogShipper POSTs a scrubbed log
ring + crash stacktrace on (a) an uncaught exception (chained to the previous
handler) and (b) a 'Send logs to Kayos' Settings button. Everything runs
through LogDump.scrubLine first (URLs/video-ids/emails/tokens redacted); the
server re-scrubs. device_id = a random per-install UUID (no hardware id).
Compile-DISABLED unless the STRAW_LOGS_INGEST_TOKEN build secret is set, so
contributor forks never phone home. build.yml passes the secret to the debug
build.
Releases were silently no-op'ing on fdroid: versionCode was a hand-maintained
constant, so a commit that didn't bump it rebuilt the same debug_<vc>.apk, the
publish receiver's anti-downgrade guard refused the duplicate (exit 3 =
"nothing to do"), and the CI went green having shipped nothing. build.yml now
patches ProjectConfig's versionCode from `git rev-list --count HEAD` (minus an
offset keeping it continuous with the manual era, last=91) before assembling,
so every main commit auto-produces a new monotonic code. The ProjectConfig
literal is now just the local-dev default.
The OSS public-scrub removed .forgejo/workflows/ wholesale — it only needed
to parameterize the two infra literals in the publish step. Restored both
workflows; the publish target (root@host) and its SSH host-key now come from
Forgejo repo secrets (STRAW_PUBLISH_TARGET / STRAW_LUCY_HOSTKEY) instead of
literals, so the public workflow carries zero infra topology. Everything else
was already clean: signing keystore + deploy key are secrets, the actual
publish is a forced-command on the host (not in this YAML), and the runner
label / build image / signer fingerprint are non-sensitive.
Restores push-triggered CI: build assembleDebug in the straw-build image,
verify signer bb9ca96b, publish to fdroid. This push also builds vc=91.
