Yuvomi-App/docs/build-android.md

Android development

Requirements: JDK 17, Android SDK platform 37.0, build-tools 36.0.0, current platform-tools, and accepted Android SDK licenses. Minimum Android 8 (API 26). The application surface is Jetpack Compose, not Android System WebView. Target API 37. On Android 17, choose "Zugriff auf private Netzwerke erlauben" for a LAN instance; public HTTPS servers do not need this optional runtime permission. No discovery/scanning is performed.

export ANDROID_HOME=/path/to/android-sdk
bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease
bash android/gradlew -p android connectedDebugAndroidTest

Gradle 9.6.0 is checksum-verified by the wrapper. AGP 9.4.1 uses built-in Kotlin with KGP and Compose compiler plugin 2.4.21. Maven versions are locked. No dynamic application dependencies or private Maven repository is required.

Ordinary outputs:

• android/app/build/outputs/apk/debug/app-debug.apk (development-signed)
• android/app/build/outputs/apk/release/app-release-unsigned.apk
• android/app/build/outputs/bundle/release/app-release.aab (unsigned unless signed later)
• android/app/build/reports/ (lint, JVM and emulator results)

The Gitea build job uploads android-native-debug-apk, containing an installable development-signed app-debug.apk. It is a native preview, not a signed stable release or a claim of full PWA parity. See native-parity.md before testing it.

Native UI tests live in src/androidTestNative/java and the real-server native scenario in src/androidTestNativeIntegration/java. The old browser tests and renderer are archived under legacy/ and are not compiled into the app/suites.

Immediately after building, collect and inspect the outputs:

python3 scripts/collect-android-artifacts.py

This writes ignored artifacts/android/ copies, SHA256SUMS, source identity and manifest/network-policy/signature evidence. It requires ANDROID_HOME and respects YUVOMI_BUILD_DIR. Source identity records the checkout at collection time; always rebuild immediately beforehand and use a clean worktree for a release candidate.

The unsigned release cannot be installed/published as-is. See release signing instructions. gradle-wrapper.jar is the standard generated Gradle bootstrap binary; it is intentionally versioned, unlike generated APKs or caches.

On WSL/Windows mounts that reject POSIX metadata operations, put outputs on the Linux filesystem:

export YUVOMI_BUILD_DIR="$HOME/yuvomi-build"
bash android/gradlew -p android testDebugUnitTest assembleDebug

The application never permits HTTP, including debug builds. Use real HTTPS for manual development. For a temporary local HTTPS integration environment:

git clone --filter=blob:none https://github.com/ulsklyc/yuvomi.git /path/to/upstream
git -C /path/to/upstream checkout 10bfef7686ed7303b4c74c7fcc55a5eb16356c9d
npm ci --omit=dev --prefix /path/to/upstream
python3 scripts/test-integration.py /path/to/upstream --android
python3 scripts/test-integration.py /path/to/upstream --android --cookie-without-secure

Requires Node 22.14+ and a running emulator. The harness creates and removes its own CA/key/database, uses adb reverse, and builds .integration with explicit test trust. It does not weaken production TLS. Test credentials are ephemeral. Keep test reports private if you customize the harness with real data (not advised). The native test calls the real API through native controls and saves a synthetic dashboard screenshot under app/build/outputs/native-screenshots/. It does not demonstrate native SSO merely because the protocol fixture also tests OIDC. Both commands retain HTTPS and system/test-CA validation; the second reproduces upstream's default SESSION_SECURE=false cookie attributes behind an HTTPS proxy. The native jar must retain that session while continuing to forbid HTTP and cross-origin replay. The scenario also rejects a wrong password, then retries successfully without retaining the old error. The test writes through PlatformTestStorageRegistry; AGP collects the file in outputs/connected_android_test_additional_output/integrationAndroidTest/ before uninstalling the fixture. The harness rejects missing/ambiguous output and removes only its known screenshot from previous runs. Do not extract app-private files after Gradle returns: UTP has already uninstalled the .integration package. Capture uses the native window and asserts nonuniform pixels; a valid PNG header alone is not sufficient screenshot evidence.

For dependency updates run :app:dependencies --write-locks, the full pipeline, and python3 scripts/check-dependencies.py. Review lockfile changes. The version update lint recommendations are informational, not suppressed correctness errors; OSV checks independently fail on known advisories.