Ship desktop-only releases; ad-hoc sign macOS

v3.0.0 is desktop-only (Linux/Windows/macOS). Mobile already ships through
the App Store and Google Play, and the GitHub APK needs its own release
keystore, so the Android job moves out of the release path for now.

macOS is ad-hoc signed rather than notarized: the AC_CERTIFICATE secret
imports 0 valid codesigning identities, so there is nothing to notarize
with. Notarization needs a fresh "Developer ID Application" .p12.

Also fix the Android heap failure found while validating (JetifyTransform
OOM'd at -Xmx1536M) and bump actions/checkout to v5 (v4 is on deprecated
Node 20).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: awhitchurch

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Flutter
         uses: subosito/flutter-action@v2

.github/workflows/release.yml

@@ -7,16 +7,12 @@
 # Artifacts:
 #   OpenView-linux-x64.zip
 #   OpenView-windows-x64.zip
-#   OpenView-macos-arm64.zip    (Developer ID signed + notarized when the
-#                                AC_CERTIFICATE / APPLE_* secrets are present)
-#   OpenView-android.apk        (release-signed when the KEYSTORE_* secrets are
-#                                present; tag builds FAIL without them)
+#   OpenView-macos-arm64.zip    (ad-hoc signed — see the macOS job)
 #   SHA256SUMS.txt
 #
-# Required secrets for a fully signed release:
-#   macOS   AC_CERTIFICATE, AC_CERTIFICATE_PASSWORD, KEYCHAIN_PASSWORD,
-#           APPLE_ID, APPLE_PASSWORD (app-specific pw), APPLE_TEAM_ID
-#   Android KEYSTORE_BASE64, KEY_ALIAS, KEY_PASSWORD, STORE_PASSWORD
+# Desktop only. Mobile ships through the App Store and Google Play, and the
+# Android APK / iOS pipeline is tracked separately — do not add a mobile job
+# here without also sorting out release signing (see docs/mobile-deployment.md).
 name: Release builds
 
 on:
@@ -46,7 +42,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Tag matches pubspec version
         if: startsWith(github.ref, 'refs/tags/')
@@ -68,7 +64,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Flutter
         uses: subosito/flutter-action@v2
@@ -113,7 +109,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Flutter
         uses: subosito/flutter-action@v2
@@ -149,14 +145,20 @@ jobs:
   # Development' found"). We therefore configure with Flutter and build with
   # xcodebuild, overriding the signing settings on the command line (command-line
   # settings outrank the ones baked into project.pbxproj).
+  #
+  # The app is ad-hoc signed: it runs, but it is not notarized, so Gatekeeper
+  # shows "Apple cannot check it for malicious software" on first launch and the
+  # user must right-click → Open (or clear the quarantine bit). Developer ID
+  # signing + notarization is a follow-up — the AC_CERTIFICATE / APPLE_* secrets
+  # for it already exist in this repo.
   macos:
     name: macOS arm64
     needs: version
     runs-on: macos-latest
     timeout-minutes: 90
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Flutter
         uses: subosito/flutter-action@v2
@@ -168,92 +170,25 @@ jobs:
       - name: Install build tools (libserialport)
         run: brew install automake libtool
 
-      - name: Import Developer ID certificate
-        id: cert
-        env:
-          AC_CERTIFICATE: ${{ secrets.AC_CERTIFICATE }}
-          AC_CERTIFICATE_PASSWORD: ${{ secrets.AC_CERTIFICATE_PASSWORD }}
-          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
-        run: |
-          if [ -z "$AC_CERTIFICATE" ]; then
-            echo "::warning::AC_CERTIFICATE not set — building ad-hoc signed (Gatekeeper will warn users)."
-            echo "identity=-" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          keychain="$RUNNER_TEMP/build.keychain-db"
-          security create-keychain -p "$KEYCHAIN_PASSWORD" "$keychain"
-          security set-keychain-settings -lut 21600 "$keychain"
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$keychain"
-
-          echo "$AC_CERTIFICATE" | base64 --decode > "$RUNNER_TEMP/cert.p12"
-          security import "$RUNNER_TEMP/cert.p12" -k "$keychain" \
-            -P "$AC_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
-          security set-key-partition-list -S apple-tool:,apple:,codesign: \
-            -s -k "$KEYCHAIN_PASSWORD" "$keychain" >/dev/null
-          # Put our keychain first in the search list so xcodebuild finds the key.
-          security list-keychains -d user -s "$keychain" $(security list-keychains -d user | tr -d '"')
-          rm -f "$RUNNER_TEMP/cert.p12"
-
-          security find-identity -v -p codesigning "$keychain"
-          identity=$(security find-identity -v -p codesigning "$keychain" \
-            | grep 'Developer ID Application' | head -1 | sed -E 's/.*"(.*)"/\1/')
-          if [ -z "$identity" ]; then
-            echo "::warning::No 'Developer ID Application' identity in AC_CERTIFICATE —" \
-                 "falling back to ad-hoc signing (no notarization)."
-            identity='-'
-          fi
-          echo "identity=$identity" >> "$GITHUB_OUTPUT"
-
       - name: Flutter config & deps
         run: |
           flutter config --enable-macos-desktop
           flutter pub get
 
       - name: Build macOS release
-        env:
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          IDENTITY: ${{ steps.cert.outputs.identity }}
         run: |
           # Generate the ephemeral xcconfig / plugin registrant without building.
           flutter build macos --release --config-only
 
-          args=(
-            -workspace macos/Runner.xcworkspace
-            -scheme Runner
-            -configuration Release
-            -derivedDataPath "$RUNNER_TEMP/dd"
-            CODE_SIGN_STYLE=Manual
-            PROVISIONING_PROFILE_SPECIFIER=
-          )
-          if [ "$IDENTITY" = "-" ]; then
-            args+=(CODE_SIGN_IDENTITY=-)     # ad-hoc: runs locally, Gatekeeper warns
-          else
-            args+=(
-              CODE_SIGN_IDENTITY="$IDENTITY"
-              DEVELOPMENT_TEAM="$APPLE_TEAM_ID"
-              ENABLE_HARDENED_RUNTIME=YES     # required for notarization
-              OTHER_CODE_SIGN_FLAGS=--timestamp
-            )
-          fi
-          xcodebuild "${args[@]}" build
-
-      - name: Notarize & staple
-        if: steps.cert.outputs.identity != '-'
-        env:
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: |
-          app="$RUNNER_TEMP/dd/Build/Products/Release/OpenView.app"
-          ditto -c -k --sequesterRsrc --keepParent "$app" "$RUNNER_TEMP/notarize.zip"
-          xcrun notarytool submit "$RUNNER_TEMP/notarize.zip" \
-            --apple-id "$APPLE_ID" \
-            --password "$APPLE_PASSWORD" \
-            --team-id "$APPLE_TEAM_ID" \
-            --wait
-          xcrun stapler staple "$app"
-          spctl --assess --type execute --verbose "$app"
+          xcodebuild \
+            -workspace macos/Runner.xcworkspace \
+            -scheme Runner \
+            -configuration Release \
+            -derivedDataPath "$RUNNER_TEMP/dd" \
+            CODE_SIGN_STYLE=Manual \
+            CODE_SIGN_IDENTITY=- \
+            PROVISIONING_PROFILE_SPECIFIER= \
+            build
 
       - name: Package
         run: |
@@ -263,9 +198,9 @@ jobs:
             find "$RUNNER_TEMP/dd/Build/Products" -maxdepth 3 -name '*.app' || true
             exit 1
           fi
-          # ditto (not zip) preserves app-bundle metadata and the stapled ticket.
+          codesign --verify --strict --verbose=2 "$app"
+          # ditto (not zip) preserves app-bundle metadata and symlinks.
           ditto -c -k --sequesterRsrc --keepParent "$app" OpenView-macos-arm64.zip
-          codesign --verify --deep --strict --verbose=2 "$app" || true
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4
@@ -274,83 +209,10 @@ jobs:
           path: OpenView-macos-arm64.zip
           if-no-files-found: error
 
-  # ── Android APK ────────────────────────────────────────────────────────
-  android:
-    name: Android APK
-    needs: version
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: '17'
-          cache: gradle
-
-      - name: Setup Flutter
-        uses: subosito/flutter-action@v2
-        with:
-          flutter-version: ${{ env.FLUTTER_VERSION }}
-          channel: stable
-          cache: true
-
-      - name: Flutter deps
-        run: flutter pub get
-
-      # Writes android/key.properties, which build.gradle.kts picks up. A tag
-      # build without a keystore is a hard error — shipping a debug-signed APK on
-      # a public release is worse than shipping no APK (it can never be upgraded
-      # in place by a properly signed build).
-      - name: Prepare release signing
-        env:
-          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
-          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
-          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
-          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-        run: |
-          if [ -z "$KEYSTORE_BASE64" ]; then
-            if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
-              echo "::error::KEYSTORE_BASE64 is not set. A tagged release must ship a" \
-                   "release-signed APK. Add KEYSTORE_BASE64, KEY_ALIAS, KEY_PASSWORD and" \
-                   "STORE_PASSWORD as repository secrets, then re-run."
-              exit 1
-            fi
-            echo "::warning::No keystore secrets — this APK will be debug-signed (dev build only)."
-            exit 0
-          fi
-          echo "$KEYSTORE_BASE64" | base64 --decode > android/release-keystore.jks
-          cat > android/key.properties <<EOF
-          storeFile=release-keystore.jks
-          storePassword=$STORE_PASSWORD
-          keyAlias=$KEY_ALIAS
-          keyPassword=$KEY_PASSWORD
-          EOF
-
-      - name: Build APK
-        run: flutter build apk --release
-
-      - name: Verify APK signature
-        run: |
-          cp build/app/outputs/flutter-apk/app-release.apk OpenView-android.apk
-          apksigner=$(find "$ANDROID_HOME/build-tools" -name apksigner | sort -r | head -1)
-          "$apksigner" verify --print-certs OpenView-android.apk
-          ls -la OpenView-android.apk
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: OpenView-android
-          path: OpenView-android.apk
-          if-no-files-found: error
-
   # ── Publish GitHub Release (tags only) ─────────────────────────────────
   publish:
     name: Publish GitHub Release
-    needs: [linux, windows, macos, android]
+    needs: [linux, windows, macos]
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -364,7 +226,7 @@ jobs:
       - name: Checksums
         working-directory: release
         run: |
-          sha256sum ./*.zip ./*.apk | sed 's|\./||' | tee SHA256SUMS.txt
+          sha256sum ./*.zip | sed 's|\./||' | tee SHA256SUMS.txt
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
@@ -375,7 +237,6 @@ jobs:
             release/OpenView-linux-x64.zip
             release/OpenView-windows-x64.zip
             release/OpenView-macos-arm64.zip
-            release/OpenView-android.apk
             release/SHA256SUMS.txt
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

android/gradle.properties

@@ -1,4 +1,8 @@
-org.gradle.jvmargs=-Xmx1536M
+# 1536M is not enough to jetify/merge the Flutter release native libs — the CI
+# APK build died with "Java heap space" in JetifyTransform.
+org.gradle.jvmargs=-Xmx4g
 android.enableR8=true
 android.useAndroidX=true
-android.enableJetifier=true
+# Jetifier rewrites legacy android.support.* deps to AndroidX. Every plugin here
+# is already AndroidX, so this only cost build time and heap.
+android.enableJetifier=false