Fix CI: uv sync --extra dev; sdkmanager licenses without SIGPIPE

- pytest lives in hermes-agent's dev extra; plain uv sync left the CI venv
  without it and run_tests.sh refused to run (gateway job)
- 'yes | sdkmanager --licenses' dies with SIGPIPE (exit 141) under Gitea's
  bash -e -o pipefail; feed a finite number of y's from a file instead
  (kotlin + android jobs)

.gitea/workflows/ci.yml

@@ -29,7 +29,9 @@ jobs:
         run: |
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
           cd hermes-agent
-          uv sync
+          # pytest lives in the `dev` extra — a plain `uv sync` leaves the
+          # venv without it and run_tests.sh refuses to run.
+          uv sync --extra dev
 
       - name: Run android gateway tests
         run: |
@@ -62,7 +64,11 @@ jobs:
             https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip
           unzip -q /tmp/ct.zip -d "$ANDROID_HOME/cmdline-tools"
           mv "$ANDROID_HOME/cmdline-tools/cmdline-tools" "$ANDROID_HOME/cmdline-tools/latest"
-          yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses > /dev/null
+          # Finite input from a file: `yes | sdkmanager` dies with SIGPIPE
+          # (exit 141) under Gitea's `bash -e -o pipefail` once sdkmanager
+          # exits before `yes` is done writing.
+          for i in $(seq 100); do echo y; done > /tmp/sdk_licenses_yes.txt
+          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses < /tmp/sdk_licenses_yes.txt > /dev/null
           echo "ANDROID_HOME=$ANDROID_HOME" >> "$GITHUB_ENV"
           echo "sdk.dir=$ANDROID_HOME" > app/local.properties
 
@@ -70,4 +76,4 @@ jobs:
       # missing SDK platforms (licenses accepted above).
       - name: Run host tests
         working-directory: app
-        run: ./gradlew :shared:testAndroidHostTest :shared:desktopTest
+        run: ./gradlew :shared:testAndroidHostTest :shared:desktopTest

.gitea/workflows/release.yml

@@ -32,7 +32,9 @@ jobs:
         run: |
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
           cd hermes-agent
-          uv sync
+          # pytest lives in the `dev` extra — a plain `uv sync` leaves the
+          # venv without it and run_tests.sh refuses to run.
+          uv sync --extra dev
 
       - name: Run android gateway tests
         run: |
@@ -63,7 +65,11 @@ jobs:
             https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip
           unzip -q /tmp/ct.zip -d "$ANDROID_HOME/cmdline-tools"
           mv "$ANDROID_HOME/cmdline-tools/cmdline-tools" "$ANDROID_HOME/cmdline-tools/latest"
-          yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses > /dev/null
+          # Finite input from a file: `yes | sdkmanager` dies with SIGPIPE
+          # (exit 141) under Gitea's `bash -e -o pipefail` once sdkmanager
+          # exits before `yes` is done writing.
+          for i in $(seq 100); do echo y; done > /tmp/sdk_licenses_yes.txt
+          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses < /tmp/sdk_licenses_yes.txt > /dev/null
           echo "ANDROID_HOME=$ANDROID_HOME" >> "$GITHUB_ENV"
           echo "sdk.dir=$ANDROID_HOME" > app/local.properties
 
@@ -94,7 +100,11 @@ jobs:
             https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip
           unzip -q /tmp/ct.zip -d "$ANDROID_HOME/cmdline-tools"
           mv "$ANDROID_HOME/cmdline-tools/cmdline-tools" "$ANDROID_HOME/cmdline-tools/latest"
-          yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses > /dev/null
+          # Finite input from a file: `yes | sdkmanager` dies with SIGPIPE
+          # (exit 141) under Gitea's `bash -e -o pipefail` once sdkmanager
+          # exits before `yes` is done writing.
+          for i in $(seq 100); do echo y; done > /tmp/sdk_licenses_yes.txt
+          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses < /tmp/sdk_licenses_yes.txt > /dev/null
           echo "ANDROID_HOME=$ANDROID_HOME" >> "$GITHUB_ENV"
           echo "sdk.dir=$ANDROID_HOME" > app/local.properties
 
@@ -113,24 +123,31 @@ jobs:
             echo "::warning::ANDROID_KEYSTORE_BASE64 secret not set — falling back to a DEBUG apk (see CI-SETUP.md §5)"
           fi
 
-      - name: Build APK
+      - name: Build APK + AAB
         run: |
           VERSION=$(jq -r '.inputs.version' "$GITHUB_EVENT_PATH")
           cd app
           if [ -n "$ANDROID_KEYSTORE_FILE" ]; then
-            ./gradlew :androidApp:assembleRelease -PappVersion="$VERSION"
+            # APK for direct sideloading, AAB for Play Store uploads.
+            ./gradlew :androidApp:assembleRelease :androidApp:bundleRelease -PappVersion="$VERSION"
             cp androidApp/build/outputs/apk/release/androidApp-release.apk \
               "$GITHUB_WORKSPACE/iris-android-v$VERSION.apk"
+            cp androidApp/build/outputs/bundle/release/androidApp-release.aab \
+              "$GITHUB_WORKSPACE/iris-android-v$VERSION.aab"
           else
-            ./gradlew :androidApp:assembleDebug -PappVersion="$VERSION"
+            ./gradlew :androidApp:assembleDebug :androidApp:bundleDebug -PappVersion="$VERSION"
             cp androidApp/build/outputs/apk/debug/androidApp-debug.apk \
               "$GITHUB_WORKSPACE/iris-android-v$VERSION-debug.apk"
+            cp androidApp/build/outputs/bundle/debug/androidApp-debug.aab \
+              "$GITHUB_WORKSPACE/iris-android-v$VERSION-debug.aab"
           fi
 
       - uses: actions/upload-artifact@v4
         with:
           name: android
-          path: iris-android-*.apk
+          path: |
+            iris-android-*.apk
+            iris-android-*.aab
 
   desktop:
     name: Build desktop (Linux, jpackage)
@@ -217,4 +234,4 @@ jobs:
             curl -sf -X POST -H "$AUTH" -F "attachment=@$f" \
               "$API/releases/$RELEASE_ID/attachments" > /dev/null
           done
-          echo "Done: $SERVER/$REPO/releases/tag/$TAG"
+          echo "Done: $SERVER/$REPO/releases/tag/$TAG"

app/androidApp/build.gradle.kts

@@ -13,7 +13,9 @@ android {
         applicationId = "dev.iris.app"
         minSdk = 29
         targetSdk = 34
-        versionCode = 1
+        // Play Store requires an incrementing versionCode per upload; CI can
+        // pass -PappVersionCode=<n>. Local builds keep the default.
+        versionCode = (project.findProperty("appVersionCode")?.toString()?.toIntOrNull()) ?: 1
         // CI passes -PappVersion=<version> (release workflow); local builds
         // keep the default.
         versionName = (project.findProperty("appVersion") as? String) ?: "0.1.0"
@@ -80,4 +82,4 @@ dependencies {
 // inert and the ntfy listener is the push path.
 if (file("google-services.json").exists()) {
     apply(plugin = "com.google.gms.google-services")
-}
+}

scripts/make_release_keystore.sh

@@ -16,13 +16,14 @@ if [ -e "$OUT" ]; then
   exit 1
 fi
 
+# PKCS12 keystores do not support a separate key password (keytool ignores
+# -keypass), so one password covers both the store and the key.
 STORE_PASS="$(openssl rand -base64 18 | tr -d '/+=')"
-KEY_PASS="$(openssl rand -base64 18 | tr -d '/+=')"
 
 keytool -genkeypair -v \
   -keystore "$OUT" -storetype PKCS12 \
   -alias iris -keyalg RSA -keysize 2048 -validity 10000 \
-  -storepass "$STORE_PASS" -keypass "$KEY_PASS" \
+  -storepass "$STORE_PASS" \
   -dname "CN=Iris Release, OU=Mobile, O=Iris, C=DE"
 
 echo
@@ -35,4 +36,4 @@ echo "  ANDROID_KEYSTORE_BASE64   = $(base64 -w0 "$OUT")"
 echo
 echo "  ANDROID_KEYSTORE_PASSWORD = $STORE_PASS"
 echo "  ANDROID_KEY_ALIAS         = iris"
-echo "  ANDROID_KEY_PASSWORD      = $KEY_PASS"
+echo "  ANDROID_KEY_PASSWORD      = $STORE_PASS   # same: PKCS12 has no separate key password"