ci: verify Android bundles ship native git

.gitea/workflows/android-build.yml

@@ -1,7 +1,7 @@
 name: Android build
 
 permissions:
-  contents: read
+  contents: write
   releases: write
 
 on:
@@ -96,6 +96,15 @@ jobs:
           set -euxo pipefail
           printf 'sdk.dir=%s/.android/sdk\n' "$HOME" > local.properties
 
+      - name: Compile bundled native Git binaries
+        shell: bash
+        run: |
+          set -euxo pipefail
+          export ANDROID_SDK_ROOT="$HOME/.android/sdk"
+          export ANDROID_HOME="$ANDROID_SDK_ROOT"
+          chmod +x ./AndroidProjectTooling.sh
+          bash ./AndroidProjectTooling.sh --compile-git
+
       - name: Prepare CI build metadata
         id: build_meta
         shell: bash
@@ -128,6 +137,28 @@ jobs:
           export ANDROID_HOME="$ANDROID_SDK_ROOT"
           ./gradlew --no-daemon clean assembleDebug
 
+      - name: Verify debug APK bundles native Git
+        if: github.event_name != 'release'
+        shell: bash
+        run: |
+          set -euxo pipefail
+          python3 - <<'PY'
+          from pathlib import Path
+          import zipfile
+          apk = next(Path('app/build/outputs/apk/debug').glob('*.apk'))
+          with zipfile.ZipFile(apk) as zf:
+              names = zf.namelist()
+          required = {
+              'lib/arm64-v8a/libgit.so',
+              'lib/armeabi-v7a/libgit.so',
+          }
+          found = {name for name in names if name in required}
+          print('APK_NATIVE_GIT', sorted(found))
+          missing = sorted(required - found)
+          if missing:
+              raise SystemExit(f'Missing native Git libraries in {apk}: {missing}')
+          PY
+
       - name: Build release AAB
         if: github.event_name == 'release'
         shell: bash
@@ -137,6 +168,28 @@ jobs:
           export ANDROID_HOME="$ANDROID_SDK_ROOT"
           ./gradlew --no-daemon bundleRelease
 
+      - name: Verify release AAB bundles native Git
+        if: github.event_name == 'release'
+        shell: bash
+        run: |
+          set -euxo pipefail
+          python3 - <<'PY'
+          from pathlib import Path
+          import zipfile
+          aab = next(Path('app/build/outputs/bundle/release').glob('*.aab'))
+          with zipfile.ZipFile(aab) as zf:
+              names = zf.namelist()
+          required = {
+              'base/lib/arm64-v8a/libgit.so',
+              'base/lib/armeabi-v7a/libgit.so',
+          }
+          found = {name for name in names if name in required}
+          print('AAB_NATIVE_GIT', sorted(found))
+          missing = sorted(required - found)
+          if missing:
+              raise SystemExit(f'Missing native Git libraries in {aab}: {missing}')
+          PY
+
       - name: Rename release AAB for upload
         if: github.event_name == 'release'
         id: release_aab
@@ -161,13 +214,19 @@ jobs:
         if: github.event_name == 'release'
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
         shell: bash
         run: |
           set -euxo pipefail
+          token="${GITHUB_TOKEN:-${GITEA_TOKEN:-}}"
+          if [ -z "$token" ]; then
+            echo "::error::No release upload token is available from secrets.GITEA_TOKEN or github.token"
+            exit 1
+          fi
           release_id="$(python3 -c 'import json, os; print(json.load(open(os.environ["GITHUB_EVENT_PATH"], encoding="utf-8"))["release"]["id"])')"
           aab="${{ steps.release_aab.outputs.path }}"
           curl --fail-with-body \
             --request POST \
-            --header "Authorization: token ***" \
+            --header "Authorization: token ${token}" \
             --form "attachment=@${aab}" \
             "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets?name=$(basename "$aab")"