feat: Refactor APK signing and verification process into separate scripts

.github/workflows/product-release.yml

@@ -227,72 +227,10 @@ jobs:
           CLIENT_KEY_PASSWORD_STAGING: ${{ secrets.CLIENT_KEY_PASSWORD_STAGING }}
           CLIENT_KEY_PASSWORD_PROD: ${{ secrets.CLIENT_KEY_PASSWORD_PROD }}
         run: |
-          APP="${{ github.event.inputs.app }}"
-          ENV="${{ github.event.inputs.environment }}"
-          
-          echo "🔐 Setting up Android signing for $APP in $ENV environment..."
-          
-          # Determine which keystore to use
-          if [ "$APP" = "worker-mobile-app" ]; then
-            APP_TYPE="WORKER"
-            APP_NAME="STAFF"  # CodeMagic uses STAFF in env var names
-          else
-            APP_TYPE="CLIENT"
-            APP_NAME="CLIENT"
-          fi
-          
-          # Convert environment to uppercase for env var names
-          ENV_UPPER=$(echo "$ENV" | tr '[:lower:]' '[:upper:]')
-          if [ "$ENV_UPPER" = "STAGE" ]; then
-            ENV_UPPER="STAGING"  # CodeMagic uses STAGING instead of STAGE
-          fi
-          
-          # Get the keystore secret name dynamically
-          KEYSTORE_BASE64_VAR="${APP_TYPE}_KEYSTORE_${ENV_UPPER}_BASE64"
-          KEYSTORE_PASSWORD_VAR="${APP_TYPE}_KEYSTORE_PASSWORD_${ENV_UPPER}"
-          KEY_ALIAS_VAR="${APP_TYPE}_KEY_ALIAS_${ENV_UPPER}"
-          KEY_PASSWORD_VAR="${APP_TYPE}_KEY_PASSWORD_${ENV_UPPER}"
-          
-          # Get values using indirect expansion
-          KEYSTORE_BASE64="${!KEYSTORE_BASE64_VAR}"
-          KEYSTORE_PASSWORD="${!KEYSTORE_PASSWORD_VAR}"
-          KEY_ALIAS="${!KEY_ALIAS_VAR}"
-          KEY_PASSWORD="${!KEY_PASSWORD_VAR}"
-          
-          # Check if secrets are configured
-          if [ -z "$KEYSTORE_BASE64" ]; then
-            echo "⚠️  WARNING: Keystore secret $KEYSTORE_BASE64_VAR is not configured!"
-            echo "⚠️  APK will be built UNSIGNED for $ENV environment."
-            echo "⚠️  Please configure GitHub Secrets as documented in docs/RELEASE/APK_SIGNING_SETUP.md"
-            exit 0
-          fi
-          
-          # Create temporary directory for keystore
-          KEYSTORE_DIR="${{ runner.temp }}/keystores"
-          mkdir -p "$KEYSTORE_DIR"
-          KEYSTORE_PATH="$KEYSTORE_DIR/release.jks"
-          
-          # Decode keystore from base64
-          echo "$KEYSTORE_BASE64" | base64 -d > "$KEYSTORE_PATH"
-          
-          if [ ! -f "$KEYSTORE_PATH" ]; then
-            echo "❌ Failed to decode keystore!"
-            exit 1
-          fi
-          
-          echo "✅ Keystore decoded successfully"
-          echo "📦 Keystore size: $(ls -lh "$KEYSTORE_PATH" | awk '{print $5}')"
-          
-          # Export environment variables for build.gradle.kts
-          # Using CodeMagic-compatible variable names
-          echo "CI=true" >> $GITHUB_ENV
-          echo "CM_KEYSTORE_PATH_${APP_NAME}=$KEYSTORE_PATH" >> $GITHUB_ENV
-          echo "CM_KEYSTORE_PASSWORD_${APP_NAME}=$KEYSTORE_PASSWORD" >> $GITHUB_ENV
-          echo "CM_KEY_ALIAS_${APP_NAME}=$KEY_ALIAS" >> $GITHUB_ENV
-          echo "CM_KEY_PASSWORD_${APP_NAME}=$KEY_PASSWORD" >> $GITHUB_ENV
-          
-          echo "✅ Signing environment configured for $APP_NAME ($ENV environment)"
-          echo "🔑 Using key alias: $KEY_ALIAS"
+          .github/scripts/setup-apk-signing.sh \
+            "${{ github.event.inputs.app }}" \
+            "${{ github.event.inputs.environment }}" \
+            "${{ runner.temp }}"
           
       - name: 🏗️ Build APK
         id: build_apk
@@ -330,42 +268,7 @@ jobs:
           
       - name: ✅ Verify APK Signature
         run: |
-          APK_PATH="${{ steps.build_apk.outputs.apk_path }}"
-          
-          if [ ! -f "$APK_PATH" ]; then
-            echo "❌ APK not found at: $APK_PATH"
-            exit 1
-          fi
-          
-          echo "🔍 Verifying APK signature..."
-          
-          # Check if APK is signed
-          if jarsigner -verify -verbose "$APK_PATH" 2>&1 | grep -q "jar verified"; then
-            echo "✅ APK is properly signed!"
-            
-            # Extract certificate details
-            echo ""
-            echo "📜 Certificate Details:"
-            jarsigner -verify -verbose -certs "$APK_PATH" 2>&1 | grep -A 3 "X.509" || true
-            
-            # Get signer info
-            echo ""
-            echo "🔑 Signer Information:"
-            keytool -printcert -jarfile "$APK_PATH" | head -n 15
-            
-          else
-            echo "⚠️  WARNING: APK signature verification failed or APK is unsigned!"
-            echo ""
-            echo "This may happen if:"
-            echo "  1. GitHub Secrets are not configured for this environment"
-            echo "  2. Keystore credentials are incorrect"
-            echo "  3. Build configuration didn't apply signing"
-            echo ""
-            echo "See: docs/RELEASE/APK_SIGNING_SETUP.md for setup instructions"
-            
-            # Don't fail the build, just warn
-            # exit 1
-          fi
+          .github/scripts/verify-apk-signature.sh "${{ steps.build_apk.outputs.apk_path }}"
           
       - name: 📤 Upload APK as Artifact
         uses: actions/upload-artifact@v4
@@ -380,34 +283,9 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          TAG_NAME="${{ needs.validate-and-create-release.outputs.tag_name }}"
-          APP="${{ github.event.inputs.app }}"
-          APP_NAME="${{ steps.build_apk.outputs.app_name }}"
-          VERSION="${{ needs.validate-and-create-release.outputs.version }}"
-          ENV="${{ github.event.inputs.environment }}"
-          
-          # Find APK in build output
-          APK_PATH="apps/mobile/apps/${APP_NAME}/build/app/outputs/flutter-apk/app-release.apk"
-          
-          if [ ! -f "$APK_PATH" ]; then
-            echo "❌ Error: APK not found at $APK_PATH"
-            echo "Searching for APK files..."
-            find apps/mobile/apps/${APP_NAME} -name "*.apk"
-            exit 1
-          fi
-          
-          # Create proper APK name based on app type
-          if [ "$APP" = "worker-mobile-app" ]; then
-            APK_NAME="krow-withus-worker-mobile-${ENV}-v${VERSION}.apk"
-          else
-            APK_NAME="krow-withus-client-mobile-${ENV}-v${VERSION}.apk"
-          fi
-          
-          # Copy APK with proper name
-          cp "$APK_PATH" "/tmp/$APK_NAME"
-          
-          # Upload to GitHub Release
-          echo "📤 Uploading $APK_NAME to release $TAG_NAME..."
-          gh release upload "$TAG_NAME" "/tmp/$APK_NAME" --clobber
-          
-          echo "✅ APK attached to release: $APK_NAME"
+          .github/scripts/attach-apk-to-release.sh \
+            "${{ needs.validate-and-create-release.outputs.tag_name }}" \
+            "${{ github.event.inputs.app }}" \
+            "${{ steps.build_apk.outputs.app_name }}" \
+            "${{ needs.validate-and-create-release.outputs.version }}" \
+            "${{ github.event.inputs.environment }}"