Ship scrubbed device logs to our self-hosted ingest (logs.sulkta.com) so a
'green in every offline gate, broken on-device' regression (the visionOS
playback outage) can be caught end-to-end. LogShipper POSTs a scrubbed log
ring + crash stacktrace on (a) an uncaught exception (chained to the previous
handler) and (b) a 'Send logs to Kayos' Settings button. Everything runs
through LogDump.scrubLine first (URLs/video-ids/emails/tokens redacted); the
server re-scrubs. device_id = a random per-install UUID (no hardware id).
Compile-DISABLED unless the STRAW_LOGS_INGEST_TOKEN build secret is set, so
contributor forks never phone home. build.yml passes the secret to the debug
build.
Releases were silently no-op'ing on fdroid: versionCode was a hand-maintained
constant, so a commit that didn't bump it rebuilt the same debug_<vc>.apk, the
publish receiver's anti-downgrade guard refused the duplicate (exit 3 =
"nothing to do"), and the CI went green having shipped nothing. build.yml now
patches ProjectConfig's versionCode from `git rev-list --count HEAD` (minus an
offset keeping it continuous with the manual era, last=91) before assembling,
so every main commit auto-produces a new monotonic code. The ProjectConfig
literal is now just the local-dev default.
The OSS public-scrub removed .forgejo/workflows/ wholesale — it only needed
to parameterize the two infra literals in the publish step. Restored both
workflows; the publish target (root@host) and its SSH host-key now come from
Forgejo repo secrets (STRAW_PUBLISH_TARGET / STRAW_LUCY_HOSTKEY) instead of
literals, so the public workflow carries zero infra topology. Everything else
was already clean: signing keystore + deploy key are secrets, the actual
publish is a forced-command on the host (not in this YAML), and the runner
label / build image / signer fingerprint are non-sensitive.
Restores push-triggered CI: build assembleDebug in the straw-build image,
verify signer bb9ca96b, publish to fdroid. This push also builds vc=91.
