Prepare 2.3.0: fix bugs found in a full source audit, clean up for re…

.fdroid.yml

@@ -10,16 +10,7 @@ Donate: https://openintents.org/contribute
 Bitcoin: 16MJeiftw9LRuvqoSH18v16kYTeNx7wJSZ
 
 AutoName: OI Shopping List
-Description: |-
-    OI Shopping List is a powerful application which makes it easy to create and
-    manage checklists. OI Shopping List makes it easy to add items to a list, check
-    the item off, and remove it from the list.
-
-    The application can track separate prices for each store that you use, and
-    features a high level of customization. Font size, sort order, list columns, and
-    list cleanup behavior are all settings controlled by the user. All of these
-    features are brought together in a crisp layout that is customizable through a
-    variety of themes.
+# Summary, description, changelogs and icon come from fastlane/metadata/android/.
 
 RepoType: git
 Repo: https://github.com/openintents/shoppinglist
@@ -67,7 +58,15 @@ Builds:
       - rm -rf ../ShoppingListWear
       - sed -i '/ShoppingListWear/ d' ../settings.gradle
 
+  # AGP 8 / AndroidX / targetSdk 35. Builds as-is: no prebuild patching needed.
+  - versionName: 2.3.0
+    versionCode: 100230
+    commit: v2.3.0
+    subdir: ShoppingList
+    gradle:
+      - tstore
+
 AutoUpdateMode: Version v%v
 UpdateCheckMode: Tags
-CurrentVersion: 2.2.1
-CurrentVersionCode: 100221
+CurrentVersion: 2.3.0
+CurrentVersionCode: 100230

.github/workflows/build.yml

@@ -0,0 +1,30 @@
+name: Build
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
+      - uses: gradle/actions/setup-gradle@v4
+      - name: Unit tests
+        run: ./gradlew --no-daemon :ShoppingList:testPlayDebugUnitTest
+      - name: Build release APK (F-Droid flavor) and AAB (Play)
+        run: ./gradlew --no-daemon :ShoppingList:assembleTstoreRelease :ShoppingList:bundlePlayRelease
+      - name: Lint
+        run: ./gradlew --no-daemon :ShoppingList:lintPlayRelease
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: outputs
+          path: |
+            ShoppingList/build/outputs/apk/
+            ShoppingList/build/outputs/bundle/
+            ShoppingList/build/reports/

.github/workflows/release.yml

@@ -0,0 +1,137 @@
+name: Release
+
+# Push a tag like v2.3.0 to build a signed APK, publish it as a GitHub release
+# (the source for Obtainium), to Zapstore and as a beta on Google Play.
+# F-Droid builds the same tag itself.
+#
+# Repository secrets:
+#   KEYSTORE_BASE64    base64 of the release keystore (base64 -w0 release.jks)
+#   KEYSTORE_PASSWORD  keystore password
+#   KEY_ALIAS          key alias
+#   KEY_PASSWORD       key password
+#   ZAPSTORE_SIGN_WITH optional: nsec or NIP-46 bunker URL of the Zapstore publisher
+#   PLAY_SERVICE_ACCOUNT_JSON  optional: JSON key of a Google Cloud service account
+#                      with "Release to testing tracks" in the Play Console. Without it
+#                      the Play step is skipped.
+#   PLAY_KEYSTORE_BASE64, PLAY_KEYSTORE_PASSWORD, PLAY_KEY_ALIAS, PLAY_KEY_PASSWORD
+#                      optional: the Play upload key, if it differs from the key above.
+#
+# The Play release goes to the open testing track ("beta"). Promote it to
+# production in the Play Console (Test and release > Open testing > Promote release).
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
+      - uses: gradle/actions/setup-gradle@v4
+
+      - name: Signing config
+        env:
+          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
+          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+        run: |
+          if [ -z "$KEYSTORE_BASE64" ]; then
+            echo "::error::Add the KEYSTORE_BASE64/KEYSTORE_PASSWORD/KEY_ALIAS/KEY_PASSWORD secrets to sign releases."
+            exit 1
+          fi
+          echo "$KEYSTORE_BASE64" | base64 -d > ShoppingList/release.jks
+          {
+            echo "key.store=release.jks"
+            echo "key.store.password=$KEYSTORE_PASSWORD"
+            echo "key.alias=$KEY_ALIAS"
+            echo "key.alias.password=$KEY_PASSWORD"
+          } > ShoppingList/build-private.properties
+
+      - name: Unit tests
+        run: ./gradlew --no-daemon :ShoppingList:testPlayDebugUnitTest
+
+      - name: Build signed APK
+        run: ./gradlew --no-daemon :ShoppingList:assembleTstoreRelease
+
+      - name: Release notes
+        id: notes
+        run: |
+          CODE=$(grep -oP 'versionCode \K[0-9]+' ShoppingList/build.gradle)
+          cp "fastlane/metadata/android/en-US/changelogs/$CODE.txt" release-notes.txt
+
+      - name: GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          body_path: release-notes.txt
+          files: ShoppingList/build/outputs/apk/tstore/release/*.apk
+
+      - name: Publish to Zapstore
+        env:
+          SIGN_WITH: ${{ secrets.ZAPSTORE_SIGN_WITH }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        if: env.SIGN_WITH != ''
+        run: |
+          git clone --depth 1 https://github.com/zapstore/zsp /tmp/zsp
+          (cd /tmp/zsp && go build -o /tmp/zsp-bin .)
+          /tmp/zsp-bin publish -q zapstore.yaml
+
+      - name: Play upload key
+        env:
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+          PLAY_KEYSTORE_BASE64: ${{ secrets.PLAY_KEYSTORE_BASE64 }}
+          PLAY_KEYSTORE_PASSWORD: ${{ secrets.PLAY_KEYSTORE_PASSWORD }}
+          PLAY_KEY_ALIAS: ${{ secrets.PLAY_KEY_ALIAS }}
+          PLAY_KEY_PASSWORD: ${{ secrets.PLAY_KEY_PASSWORD }}
+        if: env.PLAY_SERVICE_ACCOUNT_JSON != '' && env.PLAY_KEYSTORE_BASE64 != ''
+        run: |
+          echo "$PLAY_KEYSTORE_BASE64" | base64 -d > ShoppingList/play-upload.jks
+          {
+            echo "key.store=play-upload.jks"
+            echo "key.store.password=$PLAY_KEYSTORE_PASSWORD"
+            echo "key.alias=$PLAY_KEY_ALIAS"
+            echo "key.alias.password=$PLAY_KEY_PASSWORD"
+          } > ShoppingList/build-private.properties
+
+      - name: Build Play bundle
+        env:
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+        if: env.PLAY_SERVICE_ACCOUNT_JSON != ''
+        run: |
+          ./gradlew --no-daemon :ShoppingList:bundlePlayRelease
+          # Release notes: fastlane changelogs -> whatsnew-<Play language code>
+          CODE=$(grep -oP 'versionCode \K[0-9]+' ShoppingList/build.gradle)
+          mkdir -p whatsnew
+          for f in fastlane/metadata/android/*/changelogs/$CODE.txt; do
+            dir=${f#fastlane/metadata/android/}; dir=${dir%%/*}
+            case "$dir" in
+              *-*) lang=$dir ;;
+              de|fr|es|it|nl|pl|pt|cs|sk|fi|sv|ru|tr) lang="$dir-${dir^^}" ;;
+              ja) lang=ja-JP ;;
+              *) echo "::warning::No Play language code for $dir, skipping its release notes"; continue ;;
+            esac
+            cp "$f" "whatsnew/whatsnew-$lang"
+          done
+          ls whatsnew
+
+      - name: Publish beta on Google Play
+        env:
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+        if: env.PLAY_SERVICE_ACCOUNT_JSON != ''
+        uses: r0adkll/upload-google-play@v1
+        with:
+          serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+          packageName: org.openintents.shopping
+          releaseFiles: ShoppingList/build/outputs/bundle/playRelease/*.aab
+          mappingFile: ShoppingList/build/outputs/mapping/playRelease/mapping.txt
+          whatsNewDirectory: whatsnew
+          track: beta
+          status: completed

.gitignore

@@ -12,3 +12,6 @@ build
 .DS_Store
 *.p12
 .claude/
+*.jks
+*.keystore
+.kotlin/

DistributionLibrary/src/main/res/values-fa/strings.xml

@@ -24,7 +24,7 @@
 
 	<!-- EULA welcome message. %s is an application name, e.g. "... (EULA) for OI Notepad".
 		Translation can be as long as required. -->
-	<string name="oi_distribution_eula_message">لطفا برای خواندن و پذیرفتن توافقنامه مجوز کاربر نهایی زیر (EULA) برای s% با</string>
+	<string name="oi_distribution_eula_message">لطفا برای خواندن و پذیرفتن توافقنامه مجوز کاربر نهایی زیر (EULA) برای %s با</string>
 
 	<!-- Button: Accept terms of EULA. -->
 	<string name="oi_distribution_eula_accept">پذیرش</string>
@@ -38,7 +38,7 @@
 	<string name="oi_distribution_name_and_version">%1$s %2$s</string>
 
 	<!-- Welcome message. %s is an application name. -->
-	<string name="oi_distribution_newversion_message">به این ورژن جدید از خوش آمدید s% با</string>
+	<string name="oi_distribution_newversion_message">به این ورژن جدید از خوش آمدید %s با</string>
 
 	<string name="oi_distribution_newversion_recent_changes">تغییرات اخیر :</string>
 
@@ -101,12 +101,12 @@
     <!-- Dialog button: download the suggested application from the developer web site. -->
     <string name="oi_distribution_download_web">وب سایت دانلود</string>
 	<!-- Dialog title: %s is the name of an application (e.g. "OI Notepad"). -->
-    <string name="oi_distribution_download_title">دانلود s%</string>
+    <string name="oi_distribution_download_title">دانلود %s</string>
 
 	<!-- %s is an application name (e.g. "OI About can be used with the following applications:") -->
 	<string name="oi_distribution_info_activity_text">%s can be used with the following applications:</string>
 	<!-- %s is an application name (e.g. "Launch OI Notepad") -->
-    <string name="oi_distribution_info_launch">پرت‌ كردن‌ s%</string>
+    <string name="oi_distribution_info_launch">پرت‌ كردن‌ %s</string>
     <!-- %1$s is the current application name. %2$s is another application name, and %3$s is the other application\'s version name
     (e.g. "OI About requires OI Notepad 1.2.0 or higher.") -->
 	<string name="oi_distribution_info_not_available">%1$s requires %2$s %3$s or higher.</string>

DistributionLibrary/src/main/res/values-sd/strings.xml

@@ -22,7 +22,7 @@
 
 	<!-- EULA welcome message. %s is an application name, e.g. "... (EULA) for OI Notepad".
 		Translation can be as long as required. -->
-	<string name="oi_distribution_eula_message">|s जे लाये हेठ लिख्यल एंड यूज़र लायसेंस एग्रीमेंट (EULA) पढ़यो अऊँ स्वीकार क्यो%</string>
+	<string name="oi_distribution_eula_message">%s जे लाये हेठ लिख्यल एंड यूज़र लायसेंस एग्रीमेंट (EULA) पढ़यो अऊँ स्वीकार क्यो</string>
 
 	<!-- Button: Accept terms of EULA. -->
 	<string name="oi_distribution_eula_accept">|स्वीकार क्यो</string>
@@ -36,7 +36,7 @@
 	<string name="oi_distribution_name_and_version">%1$s %2$s</string>
 
 	<!-- Welcome message. %s is an application name. -->
-	<string name="oi_distribution_newversion_message">|s जे हिन्न नए संस्करण में तहन्जो स्वागत तव%</string>
+	<string name="oi_distribution_newversion_message">%s जे हिन्न नए संस्करण में तहन्जो स्वागत तव</string>
 
 	<string name="oi_distribution_newversion_recent_changes">|हालिय में थ्यल बदलाव</string>
 

README.md

@@ -16,3 +16,23 @@ All of these features are brought together in a crisp layout that is customizabl
 * **[F-Droid](https://f-droid.org/en/packages/org.openintents.shopping/)** [F-Droid meta data](https://gitlab.com/fdroid/fdroiddata/-/blob/master/metadata/org.openintents.shopping.yml)
 
 * **[Google Play](https://play.google.com/store/apps/details?id=org.openintents.shopping)**
+
+* **[Obtainium](https://github.com/ImranR98/Obtainium)**: add the app with the URL
+  `https://github.com/openintents/shoppinglist` (APKs from the GitHub releases)
+
+* **[Zapstore](https://zapstore.dev)**: search for "OI Shopping List"
+
+## Releasing
+
+1. Bump `versionName`/`versionCode` in `ShoppingList/build.gradle`, add
+   `fastlane/metadata/android/*/changelogs/<versionCode>.txt` (max. 500 characters)
+   and point `release_notes` in `zapstore.yaml` at it.
+2. Push a tag `v<versionName>`. The *Release* workflow builds and signs the APK,
+   creates the GitHub release (Obtainium), publishes to Zapstore and uploads an
+   app bundle to the open testing (beta) track on Google Play.
+   F-Droid picks up the tag by itself (see `.fdroid.yml`).
+3. When the beta is fine, promote it in the Play Console
+   (Test and release → Open testing → Promote release → Production).
+
+The secrets the workflow needs are listed at the top of
+`.github/workflows/release.yml`.

ShoppingList/build.gradle

@@ -8,11 +8,19 @@ android {
 
     defaultConfig {
         applicationId "org.openintents.shopping"
-        versionName "2.2.1"
-        versionCode 100221
+        versionName "2.3.0"
+        versionCode 100230
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
 
+        // Only the languages the app is translated into: drops the unused
+        // translations of the libraries (about 80 more locales) from the APK.
+        resourceConfigurations += ["en", "ar", "be", "bg", "ca", "cs", "da", "de", "el",
+                                   "en-rGB", "es", "fa", "fi", "fr", "hi", "hr", "hu", "it",
+                                   "iw", "ja", "ko", "mk", "nb", "nl", "oc", "pa", "pl", "pt",
+                                   "pt-rBR", "ro", "ru", "sd", "sk", "sr", "sv", "tl", "tr",
+                                   "ug", "uk", "zh-rCN", "zh-rTW"]
+
         testApplicationId "org.openintents.shopping.test"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         setProperty("archivesBaseName", "$applicationId-$versionName")
@@ -31,6 +39,10 @@ android {
         unitTests {
             includeAndroidResources = true
             returnDefaultValues = true
+            all {
+                // ScreenshotTest renders the UIs to build/screenshots only when asked to.
+                if (project.hasProperty('screenshots')) systemProperty 'screenshots', 'true'
+            }
         }
     }