fix(android): pass app_root and the release tag to scripts through env

[tehw0lf]

Problem

release-android-apk.yml interpolated inputs.app_root directly into the run: scripts of build apk, sign apk and align apk, and env.RELEASE_TAG into the script of check if release already exists. An expression is expanded before the shell sees the script, so the value becomes part of the script text (#179).

Change

The four steps receive the values through env: (APP_ROOT, and the existing RELEASE_TAG environment variable) and use them as quoted shell variables. No run: script in this workflow contains an expression any more. Paths and behaviour are unchanged for a normal app_root.

Closes #179

Verification

• actionlint .github/workflows/*.yml passes.

Not covered

• The job only runs on a push to the default branch of a calling repository, so the changed steps were not executed.
• Other workflows in this repository also interpolate inputs into run: scripts; this PR only changes the Android workflow.

Summary by CodeRabbit

• Chores
  • Updated Android APK release processing to handle application paths consistently during building, signing, and alignment. Release checks now use the configured release tag from the shell environment when determining whether a release already exists. These changes affect release packaging and do not change app features or behavior.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (1)

CLAUDE.md — auto-discovered

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: e2cb3207-3b53-4dea-b5b5-af8fae2677ac

📥 Commits

Reviewing files that changed from the base of the PR and between 72542b6 and 747b9fe.

📒 Files selected for processing (1)

• .github/workflows/release-android-apk.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

---

📝 Walkthrough

Walkthrough

The Android APK release workflow now passes app_root through APP_ROOT for build, signing, and alignment commands. The release-existence check reads RELEASE_TAG from the shell environment.

Changes

Android APK release workflow

Layer / File(s)	Summary
Use environment variables in workflow scripts .github/workflows/release-android-apk.yml	Build, signing, and alignment commands use quoted paths based on APP_ROOT. The release-existence check reads RELEASE_TAG from the shell environment.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 747b9

No actionable merge-blocking risk is established in the workflow changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main workflow changes: passing app_root and the release tag to scripts through environment variables.
Linked Issues check	✅ Passed	Issue #179 requires app_root through env: in the build, sign, and align steps. The workflow sets APP_ROOT in all three steps and quotes its uses in their shell scripts. The PR reports that `acti…
Out of Scope Changes check	✅ Passed	The release-existence check also reads RELEASE_TAG as a shell environment variable instead of interpolating it into the script. This change applies the same safe-input handling in the same workflow.…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[tehw0lf]

Independent local review

Reviewed head: 747b9fe9219edff3f44d3959bde8c5b356013ed0

Verdict: safe to merge. No blocking findings and nothing to fix in this PR.

What was checked

• Scope. One commit, one file (.github/workflows/release-android-apk.yml, +13/-8). The diff matches the description. One detail the description does not spell out: ${ANDROID_SDK_ROOT} in the align apk step is now quoted as well; this does not change the command for a normal SDK path.
• Equivalence. For app_root: apps/numveil the old and new scripts produce the same argument lists: cd target, -keystore path, the unsigned APK followed by the alias my-key for jarsigner, and -v 4 <unsigned> <aligned> for zipalign. Line continuations and argument order are unchanged. A trailing slash and an empty value behave as before. A value containing spaces used to be split into several words and is now passed as one path.
• Variables. APP_ROOT is set in env: of each of the three steps that use it (build apk, sign apk, align apk). RELEASE_TAG is written to $GITHUB_ENV by extract version from package.json, the step immediately before check if release already exists; both steps have the same if: condition, and no workflow-, job- or step-level env: redefines the name.
• "No run: script contains an expression any more". True: all seven run: blocks of the file were extracted from the parsed YAML and none contains ${{. The remaining inputs.* / env.* expressions in the file are in runs-on:, if:, with: and env:, none of which is script text.
• Injection path. Removed for the four steps: the values now reach the shell as environment variables and are only expanded inside double quotes.
• Lint. actionlint over all workflow files at this head reports nothing. shellcheck was not available for this review, so the scripts were not checked with it here.
• Orchestrator gate. build-test-publish.yml calls this workflow only when inputs.app_root != ''.
• Interaction with feat(android): let callers choose the JDK of the APK release job #178. The diff of feat(android): let callers choose the JDK of the APK release job #178 applies cleanly on top of this head; the hunks of the two PRs in release-android-apk.yml do not overlap (input block and set up jdk there, build apk and later steps here), so either merge order works.
• Existing review and checks. The automated review left no actionable comments and there are no inline review comments. The required checks have passed on this head.
• Closing release-android-apk.yml interpolates app_root directly into run scripts #179. Justified: release-android-apk.yml interpolates app_root directly into run scripts #179 asks for app_root to be passed through env: in build apk, sign apk and align apk, and this PR does exactly that (plus the release tag).

Blocking

none

Fix in PR

none

Follow-up

• RELEASE_TAG is written to $GITHUB_ENV without validation (extract version from package.json, a line this PR does not change): echo "RELEASE_TAG=v${VERSION}" >> $GITHUB_ENV, with VERSION taken from jq -r .version package.json. A version value containing a newline would add further lines, and therefore further environment variables, for all later steps of the job. The value comes from the caller's own package.json on a push, so the risk is on the same low level as the one release-android-apk.yml interpolates app_root directly into run scripts #179 describes. Rejecting versions that are not a single line of expected characters would close it. No issue. Tracked in release-android-apk.yml writes an unvalidated version to GITHUB_ENV #181.
• Other workflows still expand expressions inside run: scripts, as the description says. At this head: 116 expressions in 39 run: steps across 14 other workflow files, 83 of them inputs.* (most in test-and-build.yml, publish-docker-image.yml, summarize-workflow.yml, set-git-tag.yml, release-github.yml). Some of these inputs are commands by design (for example install, lint, test, docker_pre, release_pre), others are plain values such as artifact_path, tool, registry or trivy_severity. release-android-apk.yml interpolates app_root directly into run scripts #179 only covers release-android-apk.yml. No issue. Tracked in Expressions are interpolated into run scripts across the workflows #182.

Not covered

• The changed steps were not executed: the job only runs in a calling repository on a push with app_root set. Equivalence was established by reading the scripts and comparing the resulting argument lists, not by building, signing and aligning an APK.
• Whether softprops/action-gh-release and actions/download-artifact handle unusual app_root values (they still receive the input through with:) was not examined.
• release-android-apk.yml interpolates app_root directly into run scripts #179 refers to an input-handling convention documented in CLAUDE.md; no such rule about env: versus run: was found in that file at this head, so the change was judged on its own merits, not against that convention.