Fix APK signing: use apksigner directly instead of broken r0adkll action

The r0adkll/sign-android-release@v1 hardcodes build-tools 29.0.3 which
isn't available. Now uses apksigner from the latest installed build-tools
directly with zipalign + sign + verify steps.

.github/workflows/build-apk.yml

@@ -46,31 +46,43 @@ jobs:
           ./gradlew assembleRelease -PTWA_HOST="${TWA_HOST}"
 
       - name: Sign APK
-        if: success()
+        if: success() && env.HAS_SIGNING_KEY == 'true'
-        uses: r0adkll/sign-android-release@v1
+        env:
-        id: sign
+          HAS_SIGNING_KEY: ${{ secrets.ANDROID_SIGNING_KEY != '' }}
-        with:
-          releaseDirectory: android/app/build/outputs/apk/release
-          signingKeyBase64: ${{ secrets.ANDROID_SIGNING_KEY }}
-          alias: ${{ secrets.ANDROID_KEY_ALIAS }}
-          keyStorePassword: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
-          keyPassword: ${{ secrets.ANDROID_KEY_PASSWORD }}
-
-      - name: Rename signed APK
-        if: steps.sign.outcome == 'success'
         run: |
-          SIGNED=$(find android/app/build/outputs/apk/release -name "*-signed.apk" | head -1)
+          # Decode signing key
-          if [ -n "$SIGNED" ]; then
+          echo "${{ secrets.ANDROID_SIGNING_KEY }}" | base64 -d > /tmp/release.jks
-            cp "$SIGNED" android/app/build/outputs/apk/release/PedScribe-v${{ github.ref_name }}-signed.apk
+
-          fi
+          # Find the latest build-tools version
+          BUILD_TOOLS=$(ls -d $ANDROID_HOME/build-tools/*/ | sort -V | tail -1)
+          echo "Using build-tools: $BUILD_TOOLS"
+
+          UNSIGNED=$(find android/app/build/outputs/apk/release -name "*.apk" | head -1)
+          echo "Signing: $UNSIGNED"
+
+          # Zipalign
+          ${BUILD_TOOLS}zipalign -v -p 4 "$UNSIGNED" /tmp/aligned.apk
+
+          # Sign with apksigner
+          ${BUILD_TOOLS}apksigner sign \
+            --ks /tmp/release.jks \
+            --ks-key-alias "${{ secrets.ANDROID_KEY_ALIAS }}" \
+            --ks-pass "pass:${{ secrets.ANDROID_KEYSTORE_PASSWORD }}" \
+            --key-pass "pass:${{ secrets.ANDROID_KEY_PASSWORD }}" \
+            --out android/app/build/outputs/apk/release/PedScribe-v9-signed.apk \
+            /tmp/aligned.apk
+
+          # Verify
+          ${BUILD_TOOLS}apksigner verify --print-certs android/app/build/outputs/apk/release/PedScribe-v9-signed.apk
+
+          # Cleanup
+          rm -f /tmp/release.jks /tmp/aligned.apk
 
       - name: Upload APK to Release
         if: startsWith(github.ref, 'refs/tags/')
         uses: softprops/action-gh-release@v2
         with:
-          files: |
+          files: android/app/build/outputs/apk/release/*.apk
-            android/app/build/outputs/apk/release/*-signed.apk
-            android/app/build/outputs/apk/release/app-release-unsigned.apk
           generate_release_notes: true
 
       - name: Upload artifact