Problem
release-android-apk.yml interpolates inputs.app_root directly into the run: scripts of the build apk, sign apk and align apk steps instead of passing it through env:. The value comes from the caller's own workflow file, so the risk is low, but it does not match the input-handling convention documented in CLAUDE.md.
Raised as a follow-up in the review of #178, which does not touch those lines.
What to do
Pass app_root to those steps through env: and reference the environment variable in the scripts, as the other workflows do for comparable inputs.
Problem
release-android-apk.ymlinterpolatesinputs.app_rootdirectly into therun:scripts of thebuild apk,sign apkandalign apksteps instead of passing it throughenv:. The value comes from the caller's own workflow file, so the risk is low, but it does not match the input-handling convention documented inCLAUDE.md.Raised as a follow-up in the review of #178, which does not touch those lines.
What to do
Pass
app_rootto those steps throughenv:and reference the environment variable in the scripts, as the other workflows do for comparable inputs.