Release 8.3.18-fork.1 + automated release workflow

[yijuchung]

Summary

Cuts the personal fork's first release as 8.3.18-fork.1, adds an automated GitHub Actions release workflow, and adds a cut-release.sh script that automates future releases.

The fork keeps the Android versionCode monotonic and continuing past upstream so devices update in place, while the versionName clearly marks it as a fork of a specific upstream base. Tags use a v-prefixed namespace that can't collide with upstream's bare tags.

Version changes (build.gradle.kts)

• versionName → 8.3.18-fork.1 — 8.3.18 shows the exact upstream base; -fork.1 marks this fork's build
• versionCode → 8334 — ahead of upstream's 8331; bump +1 per fork release
• MAJOR=8 / MINOR=3 left unchanged — these are the backup on-disk format version (backupVersionCode = MAJOR*1000+MINOR), gated by isOldVersion = backupVersionCode < 8000 in RestoreAppAction. Changing them would make existing backups restore as "old". Added a comment documenting this.

Release content

• CHANGELOG.md: promoted Unreleased → 8.3.18-fork.1 (08.07.2026) (the backup-encryption hardening work).
• fastlane/metadata/android/en-US/changelogs/8334.txt: store changelog keyed by versionCode.

Automated release workflow (.github/workflows/release.yml)

• Triggers on pushing a v* tag (plus workflow_dispatch for build-only runs).
• Sets up JDK 21 + Android SDK (mirrors existing CI), runs the security-critical JVM unit tests as a gate, builds the APK, and publishes a GitHub Release with the APK attached and notes extracted from CHANGELOG.md.
• Only -alpha / -beta / -rc tags are marked prerelease, so -fork tags publish as full releases.
• Signing: builds a signed release APK when signing secrets are present, otherwise falls back to a debug-signed APK. Optional secrets: KEYSTORE_BASE64, KEYSTORE_PASSWORD, KEY_ALIAS, KEY_PASSWORD. Matching optional keystore.properties-driven signing config added to build.gradle.kts (no-op without the file); keystore secrets gitignored.

Release automation (scripts/cut-release.sh)

One command to cut the next fork release. It:

1. Bumps versionName + versionCode in build.gradle.kts (leaves MAJOR/MINOR alone).
2. Promotes the Unreleased CHANGELOG section to a dated version header.
3. Generates the Fastlane en-US changelog for the new versionCode.
4. Commits and tags v<versionName>; --push triggers the release workflow.

Defaults to auto-incrementing the -fork.N suffix and versionCode. Supports --dry-run, explicit VERSION / --code / --date / --fastlane, and guards against non-monotonic codes, existing tags, and a dirty tree.

scripts/cut-release.sh --dry-run          # preview (e.g. 8.3.18-fork.1 -> -fork.2, 8334 -> 8335)
scripts/cut-release.sh                     # cut + tag locally
scripts/cut-release.sh 8.4.0-fork.1 --push # explicit version, push to release

How to cut this release

After merging:

git tag v8.3.18-fork.1 && git push origin v8.3.18-fork.1

That triggers the workflow, which builds the APK and publishes the release. (Subsequent releases can just use scripts/cut-release.sh.)

Validation

• Workflow YAML parses; changelog-extraction step isolates the fork section.
• ./gradlew help configures cleanly with signing on and off.
• cut-release.sh tested: --help, --dry-run, a real --no-commit run (correct version bump, changelog promotion, and generated fastlane notes), and error guards; reverted after testing.
• Full build/tests run in CI (JDK 21 toolchain isn't available in this local env).