ci(release): expose checksummed validation artifacts

[hawkff]

Summary

• generate SHA256SUMS for every release APK
• include the checksum manifest in release artifacts and verify it before publication
• copy the signed arm64 APK and checksum manifest to the Namespace workspace store for local validation

Validation

• CodeRabbit CLI review completed with no remaining findings
• Namespace CI run 29277363734 passed all jobs
• Release Build run 29277365429 passed with publish=false; the publication job stayed skipped
• the downloaded arm64 APK matched SHA256SUMS
• the APK reported the expected package, version, SDK levels, and signing certificate
• verified on Android with a side-by-side install and launch; ECH remained disabled by default, no temporary profiles remained, and rotation stayed disabled

Greptile Summary

This PR adds checksum handling to the release workflow. The main changes are:

• Generate SHA256SUMS for release APKs.
• Upload the checksum manifest with the APK artifact.
• Verify the checksum manifest before publishing.
• Copy the signed arm64 APK and checksum manifest to the Namespace workspace store.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Adds checksum generation, checksum verification, and Namespace workspace artifact upload for release APK validation.

_{Reviews (2): Last reviewed commit: "ci(release): tighten artifact set valida..." | Re-trigger Greptile}

[coderabbitai]

📝 Walkthrough

Walkthrough

The release workflow now generates SHA256 checksums, validates the expected arm64-v8a APK, publishes release files to Namespace, and verifies checksums before packaging APKs and checksum files.

Changes

Release artifact integrity

Layer / File(s)	Summary
Build checksums and Namespace publishing .github/workflows/release.yml	The build job generates SHA256SUMS, uploads the APK directory, requires exactly one arm64-v8a APK, and publishes it with the checksums.
Publish artifact verification .github/workflows/release.yml	The publish job validates the downloaded checksums and packages both APKs and SHA256SUMS files.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

I’m a rabbit with checksums to spare,
Hopping through artifacts with care.
APKs neatly aligned,
Each hash is assigned,
Safe releases now travel the hare!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly reflects the release CI changes around checksum validation artifacts.
Description check	✅ Passed	The description matches the changeset and accurately summarizes checksum generation, verification, and artifact handling.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 166-173: Update the release flow around the APK_FILES manifest and
Namespace upload so SHA256SUMS references exactly the APK files uploaded there.
Either upload every APK included by the manifest, or generate a separate
arm64-only manifest for the Namespace artifact; preserve checksum validation for
the selected upload set.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1a29a286-6bf1-4e4d-9cfd-38f5923ee628

📥 Commits

Reviewing files that changed from the base of the PR and between dea3468 and 7b840f7.

📒 Files selected for processing (1)

• .github/workflows/release.yml

[hawkff]

Follow-up validation for c47eb0ca:

• Release Build run 29278552684 passed with publish=false; the publication job stayed skipped.
• The Namespace checksum manifest contains only the uploaded arm64 APK, and the downloaded APK matched it.
• The exact APK passed signature and manifest inspection, then installed as an update to the side-by-side release package and launched without a fatal exception. Its package identity remained stable, the separate debug package remained installed, and rotation stayed disabled.