Publish a signed Play AAB from Deploy Prod.

Closes #121. Supersedes the separate Deploy Android workflow in #58 by attaching hesychia-<version>-<code>.aab to an android-v* Gitea release after the prod web deploy.

.gitea/workflows/deploy-prod.yml

@@ -36,3 +36,61 @@ jobs:
             --app chat_web_app \
             --env prod \
             --ref "${{ gitea.sha }}"
+
+  # Same commit the workflow was started from (the branch picked in Run workflow).
+  android-release:
+    needs: deploy-prod
+    runs-on: self-hosted
+    permissions:
+      contents: write
+    defaults:
+      run:
+        working-directory: llm-fe
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ gitea.sha }}
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Resolve Play version
+        env:
+          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITEA_SHA: ${{ gitea.sha }}
+        run: node scripts/android-version.mjs
+
+      - name: Build store web bundle
+        run: npm run build:android:store
+
+      - name: Sign with the Play upload key
+        run: |
+          set -euo pipefail
+          test -f /home/westfarn/.android/hesychia-keystore.properties
+          test -f /home/westfarn/.android/hesychia-upload.jks
+          test -d /home/westfarn/Android/Sdk
+          ln -sfn /home/westfarn/.android/hesychia-keystore.properties android/keystore.properties
+          printf 'sdk.dir=%s\n' /home/westfarn/Android/Sdk > android/local.properties
+
+      - name: Package signed app bundle
+        run: |
+          set -euo pipefail
+          cd android
+          chmod +x ./gradlew
+          ./gradlew bundleRelease \
+            -PhesychiaVersionCode="$HESYCHIA_VERSION_CODE" \
+            -PhesychiaVersionName="$HESYCHIA_VERSION_NAME"
+          jarsigner -verify app/build/outputs/bundle/release/app-release.aab >/tmp/jarsigner-aab.txt 2>&1
+          echo "jar verified"
+
+      - name: Publish Gitea release
+        env:
+          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITEA_SHA: ${{ gitea.sha }}
+          GITEA_REF_NAME: ${{ gitea.ref_name }}
+        run: node scripts/publish-android-gitea-release.mjs