[pljones]

Short description of changes

• Externalise Android dependencies (in line with prior cache-keys branch)
• Provide a local Linux-build wrapper for the Github workflow Android build script
• Add support for publishing to Google Play Store (NOT yet proven as it costs money)
• Adds debug and release builds for all four ABIs (two APKs on the release)

Note

The existing com.github.jamulussoftware.jamulus APK is being changed to app.jamulus.jamulus for both Qt5 and Qt6 builds, with only the latter targeting release to Play Store.

CHANGELOG: New Android Packaging workflow, with Play Store-ready build

Context: Fixes an issue?

Very low uptake on Android vs Play Store updates.

Does this change need documentation? What needs to be documented and how?

Yes. We'll need the Release Announcement to highlight that the old build needs removing completely and that the new build can, once we stabilise the Qt6/Android build and put it on Play Store, then be updated through Play Store.

Status of this Pull Request

Very much draft.

What is missing until this pull request can be merged?

Needs to actually be tested on multiple devices.

Checklist

• I've verified that this Pull Request follows the general code principles
• I tested my code and it does what I want
• My code follows the style guide
• I waited some time after this Pull Request was opened and all GitHub checks completed without errors.
• I've filled all the content above

[Copilot]

🟡 Changes recommended

Android startup, credential handling, Qt 6 compatibility, and Play Store authentication contain blocking defects.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Reworks Android builds into legacy APK and Play Store AAB streams, with local tooling and Qt 6 support.

Changes:

• Externalizes Android toolchain configuration and adds local build wrappers.
• Adds multi-mode/ABI packaging, signing, and Play Store publishing.
• Adds Qt 6 microphone permission handling and documentation.

File summaries

File	Description
tools/android-build.sh	Adds local build driver.
tools/android-build_play-store.settings.example	Provides Play Store settings template.
tools/android-build_legacy.settings.example	Provides legacy settings template.
src/main.cpp	Adds Qt 6 microphone permissions.
Jamulus.pro	Updates Android versioning and linking.
COMPILING.md	Documents Android build streams.
android/AndroidManifest.xml	Changes Android application ID and SDK handling.
.gitignore	Ignores Android outputs and credentials.
.github/workflows/bump-dependencies.yml	Extends dependency bump coverage.
.github/workflows/autobuild.yml	Adds Android matrices, signing, and publishing.
.github/autobuild/get_build_vars.py	Adds standalone version output.
.github/autobuild/android.sh	Rewrites Android setup and packaging.
.github/autobuild/android-play-store.sh	Prepares AAB uploads.
.github/autobuild/android-dependencies_play-store.sh	Pins Play Store dependencies.
.github/autobuild/android-dependencies_legacy.sh	Pins legacy dependencies.

Review details

• Files reviewed: 15/16 changed files
• Comments generated: 15
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Play Store setup is currently broken, while packaging and keystore handling contain correctness and security defects.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (4)

.github/autobuild/android.sh:345

• This accepts BUILD_MODES="debug release" for Play Store publication, but get-artifacts then places two AABs in deploy/ and android-play-store.sh rejects that directory because it requires exactly one AAB. The documented defaults therefore make tools/android-build.sh --stream play-store build get-artifacts play-store fail unless a settings file happens to narrow the modes. Require release as the only mode here, or make the preparation step select the release artifact explicitly.

    [[ "$PUBLISH_MODE" == "" || " $BUILD_MODES " == *" release "* ]] || {
        echo "Play Store publication requires a release build" >&2
        exit 1
    }

.github/autobuild/android.sh:479

• validate_signing always initializes ANDROID_KEYSTORE_FILE, including with a generated debug key, so this condition adds --release for every build_mode. Consequently the nominal debug build is packaged as a release package and then renamed as an _debug artifact. Only add release/signing arguments when build_mode is release; let androiddeployqt create its normal debug package otherwise.

    if [[ -n "${ANDROID_KEYSTORE_FILE:-}" ]]; then
        package_args+=(--release)

.github/autobuild/android.sh:427

• The redirected file is created before its permissions are tightened, and the cleanup trap is installed only after decoding succeeds. If decoding an invalid/truncated secret fails under set -e, partially decoded keystore material remains at a predictable path with the process umask's permissions. Set a restrictive umask and install the trap before creating or decoding the file.

        ANDROID_KEYSTORE_FILE=~/.jamulus-android-signing.jks
        printf '%s' "$JAMULUS_ANDROID_KEYSTORE_BASE64" | base64 --decode > $ANDROID_KEYSTORE_FILE
        chmod 600 $ANDROID_KEYSTORE_FILE
        trap 'rm -f $ANDROID_KEYSTORE_FILE' EXIT

android/AndroidManifest.xml:49

• Changing the legacy APK's package name makes Android treat it as a different application, so users of the existing com.github.jamulussoftware.jamulus APK cannot install this as an update and will not retain the old app's data/update path. This is also effective while Jamulus.pro still reports 3.12.5dev, despite the documentation assigning the migration to 4.0.0. Retain the legacy ID or provide an explicit, version-aligned migration/release plan for this breaking identity change.

<manifest package="app.jamulus.jamulus" xmlns:android="http://schemas.android.com/apk/res/android" android:versionName="-- %%INSERT_VERSION_NAME%% --" android:versionCode="-- %%INSERT_VERSION_CODE%% --" android:installLocation="auto">

• Files reviewed: 16/17 changed files
• Comments generated: 2
• Review effort level: Balanced

[pljones]

@copilot

• .github/autobuild/android.sh:345, .github/autobuild/android.sh:479 -- clarified the workflows:
  • "debug" and "release" - refer to compilation
  • "qt5" and "qt6" - used in place of "legacy" and "play-store" for the tool chain identifier
  • deployment: only deployment to Play Store itself gates on the requirement for a "real" signing key and a "release" AAB. These are only met when the workflow is manually triggered with the correct "Upload to Play Store" setting and the repo has the keys. (Yes, it could fail earlier but it just makes the logic more complex.)
• .github/autobuild/android.sh:479 -- done
• android/AndroidManifest.xml:49 -- not done:
  • com.github.jamulussoftware.jamulus users (less than 10 active last time I checked) will have to manually uninstall and then install the new APK with app.jamulus.jamulus. This will be explained in the Release Announcement.

[pljones]

No, I didn't ask for changes. I was telling you I had done the work. When I say I have clarified something, that doesn't mean "undo what has been done". When I say "done" that doesn't mean "do it differently". When I tell you why something isn't being done, that doesn't mean "do it anyway". There was nothing left to do.