Adding support for Obtainium with fixed Signing Keys and apk Release publishing

ac_web/android/app/build.gradle.kts

@@ -1,9 +1,31 @@
+import java.util.Properties
+
 plugins {
     id("com.android.application")
     // The Flutter Gradle Plugin must be applied after the Android and Kotlin Gradle plugins.
     id("dev.flutter.flutter-gradle-plugin")
 }
 
+// Android identifies an app by its application id *and* the certificate it was
+// signed with, so an update is only accepted when it carries the same
+// signature as the installed app. Obtainium therefore needs every release to
+// be signed with one key that never changes - the debug key does not work, it
+// is generated per machine and a fresh one appears on every ci run.
+//
+// The key itself is described by `android/key.properties` (storeFile,
+// storePassword, keyAlias, keyPassword). That file and the keystore are
+// gitignored and never committed: a developer creates them once locally, the
+// workflow writes them from the repository secrets. Without the file the
+// release build falls back to the debug key so that `flutter run --release`
+// keeps working on a machine that has no keystore.
+val keystorePropertiesFile = rootProject.file("key.properties")
+val hasReleaseKeystore = keystorePropertiesFile.exists()
+val keystoreProperties = Properties()
+
+if (hasReleaseKeystore) {
+    keystorePropertiesFile.inputStream().use { keystoreProperties.load(it) }
+}
+
 android {
     namespace = "com.fscheffers.ac_web"
     compileSdk = flutter.compileSdkVersion
@@ -15,21 +37,37 @@ android {
     }
 
     defaultConfig {
-        // TODO: Specify your own unique Application ID (https://developer.android.com/studio/build/application-id.html).
         applicationId = "com.fscheffers.ac_web"
         // You can update the following values to match your application needs.
         // For more information, see: https://flutter.dev/to/review-gradle-config.
         minSdk = flutter.minSdkVersion
         targetSdk = flutter.targetSdkVersion
+        // Both come from the pubspec (`version: <name>+<code>`); the workflow
+        // overrides them with the release tag and the run number.
         versionCode = flutter.versionCode
         versionName = flutter.versionName
     }
 
+    signingConfigs {
+        if (hasReleaseKeystore) {
+            create("release") {
+                // A relative storeFile is resolved against `android/app`, an
+                // absolute one is taken as it is.
+                storeFile = file(keystoreProperties.getProperty("storeFile"))
+                storePassword = keystoreProperties.getProperty("storePassword")
+                keyAlias = keystoreProperties.getProperty("keyAlias")
+                keyPassword = keystoreProperties.getProperty("keyPassword")
+            }
+        }
+    }
+
     buildTypes {
         release {
-            // TODO: Add your own signing config for the release build.
-            // Signing with the debug keys for now, so `flutter run --release` works.
-            signingConfig = signingConfigs.getByName("debug")
+            signingConfig = if (hasReleaseKeystore) {
+                signingConfigs.getByName("release")
+            } else {
+                signingConfigs.getByName("debug")
+            }
         }
     }
 }