Release: single build+release job (Gitea has no artifacts API); fakeroot for deb

- upload-artifact@v4+ fails on Gitea/act_runner (GHESNotSupportedError —
  the GitHub artifacts API is not implemented), so merge the android,
  desktop and release jobs into one: build APK+AAB + desktop zip/deb,
  then create the release and upload attachments from the workspace
- jpackage --type deb needs fakeroot, which the runner image lacks —
  install it via apt
- sync CI-SETUP.md §3 with the restructured workflow

.gitea/workflows/release.yml

@@ -77,8 +77,11 @@ jobs:
         working-directory: app
         run: ./gradlew :shared:testAndroidHostTest :shared:desktopTest
 
-  android:
+  # Gitea/act_runner does not implement the GitHub artifacts API
-    name: Build Android APK
+  # (upload-artifact@v4+ fails with GHESNotSupportedError), so the builds and
+  # the release creation happen in ONE job — no artifact handoff between jobs.
+  release:
+    name: Build + create Gitea release
     runs-on: ubuntu-latest
     needs: [gateway, kotlin]
     steps:
@@ -108,6 +111,11 @@ jobs:
           echo "ANDROID_HOME=$ANDROID_HOME" >> "$GITHUB_ENV"
           echo "sdk.dir=$ANDROID_HOME" > app/local.properties
 
+      # jpackage --type deb shells out to fakeroot, which the runner image
+      # does not ship.
+      - name: Install fakeroot (for jpackage --type deb)
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq fakeroot
+
       - name: Restore release keystore (from Gitea secrets)
         env:
           KS_B64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
@@ -142,33 +150,10 @@ jobs:
               "$GITHUB_WORKSPACE/iris-android-v$VERSION-debug.aab"
           fi
 
-      - uses: actions/upload-artifact@v4
+      # jpackage cannot cross-compile: this only produces Linux packages.
-        with:
+      # When a Windows / macOS runner exists later, add a second build job
-          name: android
+      # for it (jpackage picks the native type: msi on Windows, dmg on macOS).
-          path: |
+      - name: Build desktop app-image + deb
-            iris-android-*.apk
-            iris-android-*.aab
-
-  desktop:
-    name: Build desktop (Linux, jpackage)
-    runs-on: ubuntu-latest
-    needs: [gateway, kotlin]
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: "21"
-
-      - name: Strip local JDK pin
-        run: sed -i '/^org\.gradle\.java\.home/d' app/gradle.properties
-
-      # jpackage cannot cross-compile: this job only produces Linux packages.
-      # When a Windows / macOS runner exists later, copy this job, change
-      # runs-on, and drop the -x64-linux suffix (jpackage picks the native
-      # type: msi on Windows, dmg on macOS).
-      - name: Build app-image + deb
         run: |
           VERSION=$(jq -r '.inputs.version' "$GITHUB_EVENT_PATH")
           cd app
@@ -176,27 +161,11 @@ jobs:
           ./gradlew :desktopApp:jpackage -PappVersion="$VERSION"
           (cd desktopApp/build/jpackage && zip -qr \
             "$GITHUB_WORKSPACE/iris-desktop-linux-x64-v$VERSION.zip" iris)
-          # .deb package (dpkg-deb ships with Ubuntu).
+          # .deb package (dpkg-deb ships with Ubuntu; fakeroot installed above).
           ./gradlew :desktopApp:jpackage -PjpackageType=deb -PappVersion="$VERSION"
           cp desktopApp/build/jpackage/*.deb \
             "$GITHUB_WORKSPACE/iris-desktop-linux-x64-v$VERSION.deb"
 
-      - uses: actions/upload-artifact@v4
-        with:
-          name: desktop
-          path: |
-            iris-desktop-linux-x64-*.zip
-            iris-desktop-linux-x64-*.deb
-
-  release:
-    name: Create Gitea release
-    runs-on: ubuntu-latest
-    needs: [android, desktop]
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-
       - name: Create release + upload artifacts
         env:
           # Optional: create a personal access token (scope: Releases: write)
@@ -228,10 +197,10 @@ jobs:
             | jq -r .id)
           echo "Created release $TAG (id $RELEASE_ID)"
 
-          for f in artifacts/*/*; do
+          for f in "$GITHUB_WORKSPACE"/iris-android-v* "$GITHUB_WORKSPACE"/iris-desktop-*; do
             [ -f "$f" ] || continue
             echo "Uploading $(basename "$f")"
             curl -sf -X POST -H "$AUTH" -F "attachment=@$f" \
               "$API/releases/$RELEASE_ID/attachments" > /dev/null
           done
-          echo "Done: $SERVER/$REPO/releases/tag/$TAG"
+          echo "Done: $SERVER/$REPO/releases/tag/$TAG"

CI-SETUP.md

@@ -102,9 +102,13 @@ jobs:
 
 Manual trigger: **repo → Actions → Release → Run workflow**, enter a
 `version` (e.g. `0.2.0`) and a `changelog`. It runs the same tests as CI,
-builds a signed Android APK + the Linux desktop packages (jpackage, JRE
+builds a signed Android APK + AAB and the Linux desktop packages (jpackage,
-bundled), then creates the Gitea release `v<version>` with all artifacts as
+JRE bundled), then creates the Gitea release `v<version>` with all artifacts
-download attachments.
+as download attachments.
+
+Note: builds + release creation happen in ONE job because Gitea/act_runner
+does not implement the GitHub artifacts API (`upload-artifact@v4+` fails
+with `GHESNotSupportedError`).
 
 ```yaml
 name: Release
@@ -141,7 +145,9 @@ jobs:
         run: |
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
           cd hermes-agent
-          uv sync
+          # pytest lives in the `dev` extra — a plain `uv sync` leaves the
+          # venv without it and run_tests.sh refuses to run.
+          uv sync --extra dev
 
       - name: Run android gateway tests
         run: |
@@ -172,7 +178,11 @@ jobs:
             https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip
           unzip -q /tmp/ct.zip -d "$ANDROID_HOME/cmdline-tools"
           mv "$ANDROID_HOME/cmdline-tools/cmdline-tools" "$ANDROID_HOME/cmdline-tools/latest"
-          yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses > /dev/null
+          # Finite input from a file: `yes | sdkmanager` dies with SIGPIPE
+          # (exit 141) under Gitea's `bash -e -o pipefail` once sdkmanager
+          # exits before `yes` is done writing.
+          for i in $(seq 100); do echo y; done > /tmp/sdk_licenses_yes.txt
+          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses < /tmp/sdk_licenses_yes.txt > /dev/null
           echo "ANDROID_HOME=$ANDROID_HOME" >> "$GITHUB_ENV"
           echo "sdk.dir=$ANDROID_HOME" > app/local.properties
 
@@ -180,8 +190,11 @@ jobs:
         working-directory: app
         run: ./gradlew :shared:testAndroidHostTest :shared:desktopTest
 
-  android:
+  # Gitea/act_runner does not implement the GitHub artifacts API
-    name: Build Android APK
+  # (upload-artifact@v4+ fails with GHESNotSupportedError), so the builds and
+  # the release creation happen in ONE job — no artifact handoff between jobs.
+  release:
+    name: Build + create Gitea release
     runs-on: ubuntu-latest
     needs: [gateway, kotlin]
     steps:
@@ -203,10 +216,19 @@ jobs:
             https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip
           unzip -q /tmp/ct.zip -d "$ANDROID_HOME/cmdline-tools"
           mv "$ANDROID_HOME/cmdline-tools/cmdline-tools" "$ANDROID_HOME/cmdline-tools/latest"
-          yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses > /dev/null
+          # Finite input from a file: `yes | sdkmanager` dies with SIGPIPE
+          # (exit 141) under Gitea's `bash -e -o pipefail` once sdkmanager
+          # exits before `yes` is done writing.
+          for i in $(seq 100); do echo y; done > /tmp/sdk_licenses_yes.txt
+          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses < /tmp/sdk_licenses_yes.txt > /dev/null
           echo "ANDROID_HOME=$ANDROID_HOME" >> "$GITHUB_ENV"
           echo "sdk.dir=$ANDROID_HOME" > app/local.properties
 
+      # jpackage --type deb shells out to fakeroot, which the runner image
+      # does not ship.
+      - name: Install fakeroot (for jpackage --type deb)
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq fakeroot
+
       - name: Restore release keystore (from Gitea secrets)
         env:
           KS_B64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
@@ -222,45 +244,29 @@ jobs:
             echo "::warning::ANDROID_KEYSTORE_BASE64 secret not set — falling back to a DEBUG apk (see CI-SETUP.md §5)"
           fi
 
-      - name: Build APK
+      - name: Build APK + AAB
         run: |
           VERSION=$(jq -r '.inputs.version' "$GITHUB_EVENT_PATH")
           cd app
           if [ -n "$ANDROID_KEYSTORE_FILE" ]; then
-            ./gradlew :androidApp:assembleRelease -PappVersion="$VERSION"
+            # APK for direct sideloading, AAB for Play Store uploads.
+            ./gradlew :androidApp:assembleRelease :androidApp:bundleRelease -PappVersion="$VERSION"
             cp androidApp/build/outputs/apk/release/androidApp-release.apk \
               "$GITHUB_WORKSPACE/iris-android-v$VERSION.apk"
+            cp androidApp/build/outputs/bundle/release/androidApp-release.aab \
+              "$GITHUB_WORKSPACE/iris-android-v$VERSION.aab"
           else
-            ./gradlew :androidApp:assembleDebug -PappVersion="$VERSION"
+            ./gradlew :androidApp:assembleDebug :androidApp:bundleDebug -PappVersion="$VERSION"
             cp androidApp/build/outputs/apk/debug/androidApp-debug.apk \
               "$GITHUB_WORKSPACE/iris-android-v$VERSION-debug.apk"
+            cp androidApp/build/outputs/bundle/debug/androidApp-debug.aab \
+              "$GITHUB_WORKSPACE/iris-android-v$VERSION-debug.aab"
           fi
 
-      - uses: actions/upload-artifact@v4
+      # jpackage cannot cross-compile: this only produces Linux packages.
-        with:
+      # When a Windows / macOS runner exists later, add a second build job
-          name: android
+      # for it (jpackage picks the native type: msi on Windows, dmg on macOS).
-          path: iris-android-*.apk
+      - name: Build desktop app-image + deb
-
-  desktop:
-    name: Build desktop (Linux, jpackage)
-    runs-on: ubuntu-latest
-    needs: [gateway, kotlin]
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: "21"
-
-      - name: Strip local JDK pin
-        run: sed -i '/^org\.gradle\.java\.home/d' app/gradle.properties
-
-      # jpackage cannot cross-compile: this job only produces Linux packages.
-      # When a Windows / macOS runner exists later, copy this job, change
-      # runs-on, and drop the -x64-linux suffix (jpackage picks the native
-      # type: msi on Windows, dmg on macOS).
-      - name: Build app-image + deb
         run: |
           VERSION=$(jq -r '.inputs.version' "$GITHUB_EVENT_PATH")
           cd app
@@ -268,27 +274,11 @@ jobs:
           ./gradlew :desktopApp:jpackage -PappVersion="$VERSION"
           (cd desktopApp/build/jpackage && zip -qr \
             "$GITHUB_WORKSPACE/iris-desktop-linux-x64-v$VERSION.zip" iris)
-          # .deb package (dpkg-deb ships with Ubuntu).
+          # .deb package (dpkg-deb ships with Ubuntu; fakeroot installed above).
           ./gradlew :desktopApp:jpackage -PjpackageType=deb -PappVersion="$VERSION"
           cp desktopApp/build/jpackage/*.deb \
             "$GITHUB_WORKSPACE/iris-desktop-linux-x64-v$VERSION.deb"
 
-      - uses: actions/upload-artifact@v4
-        with:
-          name: desktop
-          path: |
-            iris-desktop-linux-x64-*.zip
-            iris-desktop-linux-x64-*.deb
-
-  release:
-    name: Create Gitea release
-    runs-on: ubuntu-latest
-    needs: [android, desktop]
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-
       - name: Create release + upload artifacts
         env:
           # Optional: create a personal access token (scope: Releases: write)
@@ -320,14 +310,13 @@ jobs:
             | jq -r .id)
           echo "Created release $TAG (id $RELEASE_ID)"
 
-          for f in artifacts/*/*; do
+          for f in "$GITHUB_WORKSPACE"/iris-android-v* "$GITHUB_WORKSPACE"/iris-desktop-*; do
             [ -f "$f" ] || continue
             echo "Uploading $(basename "$f")"
             curl -sf -X POST -H "$AUTH" -F "attachment=@$f" \
               "$API/releases/$RELEASE_ID/attachments" > /dev/null
           done
           echo "Done: $SERVER/$REPO/releases/tag/$TAG"
-```
 
 ---