feat: add Flutter getter rewrite spine

.github/workflows/android.yml

@@ -2,19 +2,9 @@ name: Android CI
 
 on:
   push:
-    branches: 
+    branches:
       - master
-    paths-ignore:
-      - 'source/**'
-      - '**.md'
-      - '.**'
-      - 'fastlane/**'
   pull_request:
-      paths-ignore:
-      - 'source/**'
-      - '**.md'
-      - '.**'
-      - 'fastlane/**'
   workflow_dispatch:
 
 jobs:
@@ -37,97 +27,166 @@ jobs:
           distribution: 'temurin'
           java-version: 21
 
+      - name: Install Linux host build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-multilib g++-multilib
+
       - name: Setup Android SDK
         uses: android-actions/setup-android@v3
 
-      - name: Install NDK
-        run: echo "y" | sdkmanager --install "ndk;${{ env.NDK_VERSION }}"
+      - name: Install Android SDK packages
+        run: yes | sdkmanager --install "platforms;android-36" "build-tools;36.0.0" "platform-tools" "ndk;${{ env.NDK_VERSION }}"
 
-      - name: Install Cargo with aarch64-linux-android
+      - name: Add Android tools to environment
+        shell: bash
+        run: |
+          BUILD_TOOL_VERSION=$(ls "$ANDROID_HOME/build-tools" | sort -V | tail -n 1)
+          echo "BUILD_TOOL_VERSION=$BUILD_TOOL_VERSION" >> "$GITHUB_ENV"
+          echo "$ANDROID_HOME/build-tools/$BUILD_TOOL_VERSION" >> "$GITHUB_PATH"
+          NDK_HOME="$ANDROID_HOME/ndk/$NDK_VERSION"
+          echo "ANDROID_NDK_HOME=$NDK_HOME" >> "$GITHUB_ENV"
+          echo "ANDROID_NDK_ROOT=$NDK_HOME" >> "$GITHUB_ENV"
+          echo "CC_aarch64_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android23-clang" >> "$GITHUB_ENV"
+          echo "AR_aarch64_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ar" >> "$GITHUB_ENV"
+          echo "Android build tools: $BUILD_TOOL_VERSION"
+          echo "Android NDK: $NDK_HOME"
+
+      - name: Install Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+          cache: true
+
+      - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
-          targets: aarch64-linux-android
+          components: clippy, rustfmt
+
+      - name: Install Android Rust targets
+        run: rustup target add aarch64-linux-android armv7-linux-androideabi x86_64-linux-android
 
-      - name: Add Rust targe tarchitectures
+      - name: Install just
         run: |
-          rustup target add x86_64-linux-android
-          rustup target add armv7-linux-androideabi
+          if ! command -v just >/dev/null 2>&1; then
+            cargo install just --locked
+          fi
 
       - name: Retrieve version
+        shell: bash
         run: |
-          echo VERSION=$(git rev-parse --short HEAD) >> $GITHUB_ENV
-
-      # Split due https://github.com/mozilla/rust-android-gradle/issues/38
-      - name: Build with Gradle (debug)
-        run: ./gradlew -PappVerName=${{ env.VERSION }} assembleDebug
-        env:
-          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
-
-      - name: Build with Gradle (release)
-        if: ${{ !github.event.pull_request }}
-        run: ./gradlew -PappVerName=${{ env.VERSION }} assembleRelease
+          VERSION=$(git rev-parse --short HEAD)
+          APP_VERSION=$(awk '/^version:/ {print $2}' app_flutter/pubspec.yaml)
+          FLUTTER_BASE_VERSION="${APP_VERSION%%+*}"
+          FLUTTER_BUILD_NUMBER="${APP_VERSION##*+}"
+          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
+          echo "FLUTTER_BUILD_NAME=${FLUTTER_BASE_VERSION}_${VERSION}" >> "$GITHUB_ENV"
+          echo "FLUTTER_BUILD_NUMBER=$FLUTTER_BUILD_NUMBER" >> "$GITHUB_ENV"
+
+      - name: Run rewrite validation
+        run: just verify
+
+      - name: Build Android Rust bridge libraries
+        run: ./gradlew --no-daemon ':core-getter:buildDebugApi_proxyRust[arm64-v8a]' ':core-getter:buildDebugApi_proxyRust[armeabi-v7a]' ':core-getter:buildDebugApi_proxyRust[x86_64]'
+
+      - name: Configure Flutter release signing
+        if: ${{ github.event_name != 'pull_request' }}
+        shell: bash
         env:
-          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
+          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+          KEY_STORE_PASSWORD: ${{ secrets.KEY_STORE_PASSWORD }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.ALIAS }}
+        run: |
+          set -euo pipefail
+          : "${SIGNING_KEY:?SIGNING_KEY secret is required}"
+          : "${KEY_STORE_PASSWORD:?KEY_STORE_PASSWORD secret is required}"
+          : "${KEY_PASSWORD:?KEY_PASSWORD secret is required}"
+          : "${KEY_ALIAS:?ALIAS secret is required}"
+          printf '%s' "$SIGNING_KEY" | base64 --decode > app_flutter/android/upload-keystore.jks
+          {
+            printf 'storePassword=%s\n' "$KEY_STORE_PASSWORD"
+            printf 'keyPassword=%s\n' "$KEY_PASSWORD"
+            printf 'keyAlias=%s\n' "$KEY_ALIAS"
+            printf 'storeFile=../upload-keystore.jks\n'
+          } > app_flutter/android/key.properties
+
+      - name: Build Flutter APK artifacts
+        shell: bash
+        run: |
+          cd app_flutter
+          flutter build apk --debug --build-name "$FLUTTER_BUILD_NAME" --build-number "$FLUTTER_BUILD_NUMBER"
+          flutter build apk --release --build-name "$FLUTTER_BUILD_NAME" --build-number "$FLUTTER_BUILD_NUMBER"
 
-      - name: Setup build tool version variable
+      - name: Locate Flutter APK artifacts
         shell: bash
         run: |
-          BUILD_TOOL_VERSION=$(ls /usr/local/lib/android/sdk/build-tools/ | tail -n 1)
-          echo "BUILD_TOOL_VERSION=$BUILD_TOOL_VERSION" >> $GITHUB_ENV
-          echo Last build tool version is: $BUILD_TOOL_VERSION
-
-      - name: Sign Android release
-        if: ${{ !github.event.pull_request }}
-        id: sign
-        uses: r0adkll/sign-android-release@v1.0.4
+          DEBUG_APK="app_flutter/build/app/outputs/flutter-apk/app-debug.apk"
+          RELEASE_APK="app_flutter/build/app/outputs/flutter-apk/app-release.apk"
+          test -f "$DEBUG_APK"
+          test -f "$RELEASE_APK"
+          echo "DEBUG_APK=$DEBUG_APK" >> "$GITHUB_ENV"
+          echo "RELEASE_APK=$RELEASE_APK" >> "$GITHUB_ENV"
+
+      - name: Verify Flutter APK identity and signature
+        shell: bash
         env:
-          BUILD_TOOLS_VERSION: ${{ env.BUILD_TOOL_VERSION }}
-        with:
-          releaseDirectory: app/build/outputs/apk/release
-          signingKeyBase64: ${{ secrets.SIGNING_KEY }}
-          alias: ${{ secrets.ALIAS }}
-          keyStorePassword: ${{ secrets.KEY_STORE_PASSWORD }}
-          keyPassword: ${{ secrets.KEY_PASSWORD }}
+          EXPECTED_SIGNING_CERT_SHA256: ${{ secrets.EXPECTED_SIGNING_CERT_SHA256 }}
+        run: |
+          set -euo pipefail
+          aapt dump badging "$DEBUG_APK" | tee /tmp/upgradeall-debug-badging.txt
+          aapt dump badging "$RELEASE_APK" | tee /tmp/upgradeall-release-badging.txt
+          grep -F "package: name='net.xzos.upgradeall.debug'" /tmp/upgradeall-debug-badging.txt
+          grep -F "versionCode='$FLUTTER_BUILD_NUMBER'" /tmp/upgradeall-debug-badging.txt
+          grep -F "versionName='$FLUTTER_BUILD_NAME'" /tmp/upgradeall-debug-badging.txt
+          grep -F "package: name='net.xzos.upgradeall'" /tmp/upgradeall-release-badging.txt
+          grep -F "versionCode='$FLUTTER_BUILD_NUMBER'" /tmp/upgradeall-release-badging.txt
+          grep -F "versionName='$FLUTTER_BUILD_NAME'" /tmp/upgradeall-release-badging.txt
+          apksigner verify --print-certs "$RELEASE_APK" | tee /tmp/upgradeall-release-certs.txt
+          if [[ "${{ github.event_name }}" != "pull_request" ]] && grep -q "CN=Android Debug" /tmp/upgradeall-release-certs.txt; then
+            echo "::error::Flutter release APK is debug-signed; CI release signing did not take effect"
+            exit 1
+          fi
+          actual_sha256=$(awk -F': ' '/Signer #1 certificate SHA-256 digest/ { gsub(":", "", $2); print toupper($2); exit }' /tmp/upgradeall-release-certs.txt)
+          expected_sha256=$(printf '%s' "$EXPECTED_SIGNING_CERT_SHA256" | tr -d ':[:space:]' | tr '[:lower:]' '[:upper:]')
+          if [[ -n "$expected_sha256" && "$actual_sha256" != "$expected_sha256" ]]; then
+            echo "::error::Flutter release APK signer SHA-256 does not match EXPECTED_SIGNING_CERT_SHA256"
+            exit 1
+          fi
+          if [[ "${{ github.event_name }}" != "pull_request" && -z "$expected_sha256" ]]; then
+            echo "::warning::EXPECTED_SIGNING_CERT_SHA256 is not set; release signer identity was not pinned"
+          fi
 
-      - name: Upload debug apk
+      - name: Upload Flutter debug apk
         uses: actions/upload-artifact@v6
-        if: ${{ !github.event.pull_request }}
+        if: ${{ github.event_name != 'pull_request' }}
         with:
-          path: './app/build/outputs/apk/debug/*.apk'
-          name: build_debug_${{ env.VERSION }}
+          path: ${{ env.DEBUG_APK }}
+          name: build_flutter_debug_${{ env.VERSION }}
 
-      - name: Upload release apk
+      - name: Upload Flutter release apk
         uses: actions/upload-artifact@v6
-        if: ${{ !github.event.pull_request }}
+        if: ${{ github.event_name != 'pull_request' }}
         with:
-          path: ${{ steps.sign.outputs.signedReleaseFile }}
-          name: build_release_${{ env.VERSION }}
+          path: ${{ env.RELEASE_APK }}
+          name: build_flutter_release_${{ env.VERSION }}
 
       - name: Get apk info
-        if: ${{ !github.event.pull_request }}
+        if: ${{ github.event_name != 'pull_request' }}
         id: apk-info
         uses: hkusu/apk-info-action@v1
         with:
-          apk-path: ${{ steps.sign.outputs.signedReleaseFile }}
+          apk-path: ${{ env.RELEASE_APK }}
 
 #      - name: Upload mappings with App Center CLI
-#        if: ${{ !github.event.pull_request }}
+#        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
 #        uses: zhaobozhen/AppCenter-Github-Action@1.0.1
 #        with:
-#          command: appcenter crashes upload-mappings --mapping app/build/outputs/mapping/release/mapping.txt --version-name ${{ steps.apk-info.outputs.version-name }} --version-code ${{ steps.apk-info.outputs.version-code }} --app DUpdateSystem/UpgradeAll
+#          command: appcenter crashes upload-mappings --mapping app_flutter/build/app/outputs/mapping/release/mapping.txt --version-name ${{ steps.apk-info.outputs.version-name }} --version-code ${{ steps.apk-info.outputs.version-code }} --app DUpdateSystem/UpgradeAll
 #          token: ${{secrets.APP_CENTER_TOKEN}}
 
-      - name: Find debug APK
-        if: ${{ !github.event.pull_request }}
-        run: |
-          if [ ! -z "${{ secrets.BOT_TOKEN }}" ]; then
-            OUTPUT="app/build/outputs/apk/debug/"
-            DEBUG_APK=$(find $OUTPUT -name "*.apk")
-            echo "DEBUG_APK=$DEBUG_APK" >> $GITHUB_ENV
-          fi
-
       - name: Generate Commit Message
-        if: ${{ !github.event.pull_request }}
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
         run: |
           COMMIT_MESSAGE=$(git log -1 --pretty=format:%s)
           AUTHOR_NAME=$(git log -1 --pretty=format:%an)
@@ -139,14 +198,14 @@ jobs:
           \`\`\`$COMMIT_MESSAGE\`\`\`
           by \`$AUTHOR_NAME\`
           See commit detail [Here]($COMMIT_URL)
-          Snapshot apk is attached"
+          Flutter snapshot apk is attached"
 
           echo "TELEGRAM_MESSAGE<<EOF" >> $GITHUB_ENV
           echo "$TELEGRAM_MESSAGE" >> $GITHUB_ENV
           echo "EOF" >> $GITHUB_ENV
 
       - name: Send commit to Telegram
-        if: ${{ !github.event.pull_request }}
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
         uses: xz-dev/TelegramFileUploader@v1
         env:
           BOT_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
@@ -156,7 +215,7 @@ jobs:
           to-who: ${{ secrets.TELEGRAM_TO }}
           message: ${{ env.TELEGRAM_MESSAGE }}
           files: |
-            /github/workspace/${{ steps.sign.outputs.signedReleaseFile }}
+            /github/workspace/${{ env.RELEASE_APK }}
             /github/workspace/${{ env.DEBUG_APK }}
 
       - name: Delete workflow runs

.github/workflows/upgradeall-rewrite-validation.yml

@@ -0,0 +1,69 @@
+name: UpgradeAll Rewrite Validation
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  rewrite-validation:
+    name: Rewrite validation
+    runs-on: ubuntu-latest
+    env:
+      NDK_VERSION: 29.0.14206865
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          submodules: true
+          fetch-depth: 0
+
+      - name: Set up Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 21
+
+      - name: Install Linux host build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-multilib g++-multilib
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Install Android SDK packages
+        run: sdkmanager --install "platforms;android-36" "build-tools;36.0.0" "platform-tools" "ndk;${{ env.NDK_VERSION }}"
+
+      - name: Add Android NDK to environment
+        run: |
+          NDK_HOME="$ANDROID_HOME/ndk/$NDK_VERSION"
+          echo "ANDROID_NDK_HOME=$NDK_HOME" >> "$GITHUB_ENV"
+          echo "ANDROID_NDK_ROOT=$NDK_HOME" >> "$GITHUB_ENV"
+          echo "CC_aarch64_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android23-clang" >> "$GITHUB_ENV"
+          echo "AR_aarch64_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ar" >> "$GITHUB_ENV"
+
+      - name: Install Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+          cache: true
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+
+      - name: Install Android Rust targets
+        run: rustup target add aarch64-linux-android armv7-linux-androideabi x86_64-linux-android
+
+      - name: Install just
+        run: |
+          if ! command -v just >/dev/null 2>&1; then
+            cargo install just --locked
+          fi
+
+      - name: Run rewrite validation
+        run: just verify

.gitignore

@@ -34,6 +34,7 @@
 /android-studio/sdk
 out/
 /tmp
+/.pi/
 /intellij
 workspace.xml
 *.versionsBackup