# Release process

No release is authorized by the existence of these scripts. No workflow publishes
to either store. A debug APK or unsigned archive is not a production release.

1. Complete every outstanding gate in `validation.md` and `security-review.md`.
   Obtain independent human review of authentication, navigation, file handlers,
   local erasure and privacy disclosures. Run actual supported device/OS tests.
2. Resolve bundle/application identifier ownership. `community.yuvomi.mobile` is
   a provisional community identifier, not proof of registry/store ownership.
   Confirm use of the Yuvomi name, required attribution and independent status.
3. Bump version/name/code in Android and the iOS project spec; update CHANGELOG.
4. Run JVM/emulator/real-upstream HTTPS tests, portable Swift and Xcode simulator
   tests, static checks, OSV scan, release builds and artifact inspection. Record
   upstream revision, app SHA, OS/WebView/Xcode versions, results and checksums.
5. Produce signed artifacts only using an authorized maintainer's credentials.
6. Review store privacy/Data Safety answers for the app AND selected-server model,
   permission rationale, encryption/export compliance, screenshots, support URL,
   vulnerability contact, and device demonstrations. A functional web companion
   is not guaranteed to pass Apple's minimum-functionality review.
7. Create a release/tag and publish artifacts/store submissions manually only
   after explicit maintainer authorization. Never force-push or rewrite history.

## Android

The manual `release.yml` workflow uses a protected GitHub environment named
`release`. Configure branch restrictions and required reviewers before adding
secrets. With `sign_android=false` it emits unsigned artifacts. Signing requires:

- `ANDROID_KEYSTORE_BASE64`
- `ANDROID_STORE_PASSWORD`
- `ANDROID_KEY_PASSWORD`
- `ANDROID_KEY_ALIAS`

The workflow uses `zipalign`, `apksigner`, and `jarsigner`; private material exists
only in a restrictive runner-temporary file removed on exit. Securely back up the
real upload key and use Play App Signing according to the owner's policy. No
production key is generated here. Manually verify APK/AAB signatures and inspect
the final manifest: no debuggable flag, HTTP/test CA or unintended exported component.
Never distribute an `.integration` package or include its generated test resources.
Run `python3 scripts/collect-android-artifacts.py` immediately after the clean-source
build to inspect unsigned outputs and record local hashes/source identity. This
collector intentionally rejects signed release outputs; collect before signing.

## iOS

The CI archive is unsigned and cannot be uploaded to App Store Connect. An owner
needs Apple Developer Program membership, a registered app ID, distribution
certificate/private key, provisioning profile and App Store Connect permissions.

Generate/open the project, choose the authorized team, set the owned bundle ID,
select a physical/generic iOS destination, and use Product -> Archive. Validate
the archive in Organizer and export using the owner's distribution method. For
CLI export use a **locally supplied** ExportOptions.plist with the correct team,
method and provisioning mappings:

```sh
xcodebuild -exportArchive -archivePath artifacts/Yuvomi.xcarchive \
  -exportPath artifacts/ios -exportOptionsPlist /secure/path/ExportOptions.plist
```

Do not add distribution certificates, profiles, App Store keys or passwords to the
repository. Device camera, Files, VoiceOver, memory pressure and app-switcher
privacy need physical-device validation beyond simulator tests.

## CI hosting

GitHub Actions files are provided, but the configured community remote is hosted
on a different forge. GitHub workflows will not automatically run there. Enable
an authorized GitHub mirror/repository (or port the jobs to the forge's runner)
and inspect real runs before claiming CI is operational. No destination is
created automatically. CI service availability is not an application dependency.