Merge branch 'dev' into feature/session-persistence-new

.github/workflows/backend-foundation.yml

@@ -2,6 +2,7 @@ name: Backend Foundation
 
 on:
   workflow_dispatch: # Manual trigger only — auto-triggers disabled (free plan)
+  workflow_dispatch:
 
 jobs:
   backend-foundation-makefile:

.github/workflows/hotfix-branch-creation.yml

@@ -0,0 +1,332 @@
+name: 🚨 Hotfix Branch Creation
+
+on:
+  workflow_dispatch:
+    inputs:
+      app:
+        description: '📦 Product'
+        required: true
+        type: choice
+        options:
+          - worker-mobile-app
+          - client-mobile-app
+      tag:
+        description: '🏷️ Current Tag (e.g., krow-withus-worker-mobile/prod-v0.1.0 or dev/stage)'
+        required: true
+        type: string
+      issue_description:
+        description: '📝 Brief issue description'
+        required: true
+        type: string
+
+jobs:
+  create-hotfix-branch:
+    name: 🚨 Create Hotfix Branch
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      
+    steps:
+      - name: 📥 Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          
+      - name: 🔍 Validate tag exists
+        id: validate_tag
+        run: |
+          TAG="${{ github.event.inputs.tag }}"
+          
+          if ! git rev-parse "$TAG" >/dev/null 2>&1; then
+            echo "❌ Error: Tag '$TAG' does not exist"
+            echo "Available tags:"
+            git tag -l "krow-withus-*-mobile/*" | tail -20
+            exit 1
+          fi
+          
+          echo "✅ Tag exists: $TAG"
+          
+          # Extract version from tag
+          VERSION=$(echo "$TAG" | grep -oP 'v\K[0-9]+\.[0-9]+\.[0-9]+' || echo "")
+          if [ -z "$VERSION" ]; then
+            echo "❌ Error: Could not extract version from tag"
+            exit 1
+          fi
+          
+          echo "current_version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "📌 Current version: $VERSION"
+          
+      - name: 🔢 Calculate hotfix version
+        id: hotfix_version
+        run: |
+          CURRENT="${{ steps.validate_tag.outputs.current_version }}"
+          
+          # Split version into parts
+          IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"
+          
+          # Increment PATCH version
+          NEW_PATCH=$((PATCH + 1))
+          HOTFIX_VERSION="${MAJOR}.${MINOR}.${NEW_PATCH}"
+          
+          echo "hotfix_version=${HOTFIX_VERSION}" >> $GITHUB_OUTPUT
+          echo "🆕 Hotfix version: $HOTFIX_VERSION"
+          
+      - name: 🌿 Generate branch name
+        id: branch
+        run: |
+          APP="${{ github.event.inputs.app }}"
+          VERSION="${{ steps.hotfix_version.outputs.hotfix_version }}"
+          
+          # Strip -mobile-app suffix for cleaner branch names
+          APP_CLEAN=$(echo "$APP" | sed 's/-mobile-app$//')
+          
+          BRANCH_NAME="hotfix/krow-withus-${APP_CLEAN}-mobile-v${VERSION}"
+          echo "branch_name=${BRANCH_NAME}" >> $GITHUB_OUTPUT
+          echo "🌿 Branch to create: $BRANCH_NAME"
+          
+      - name: 🔍 Check if hotfix branch already exists
+        run: |
+          BRANCH="${{ steps.branch.outputs.branch_name }}"
+          
+          if git ls-remote --heads origin "$BRANCH" | grep -q "$BRANCH"; then
+            echo "❌ Error: Branch $BRANCH already exists"
+            exit 1
+          fi
+          
+          echo "✅ Branch does not exist, proceeding..."
+          
+      - name: 🌿 Create hotfix branch from tag
+        run: |
+          TAG="${{ github.event.inputs.tag }}"
+          BRANCH="${{ steps.branch.outputs.branch_name }}"
+          
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          
+          # Checkout the tag
+          git checkout "$TAG"
+          
+          # Create new branch
+          git checkout -b "$BRANCH"
+          
+          echo "✅ Created branch $BRANCH from tag $TAG"
+          
+      - name: 📝 Update version files
+        id: update_versions
+        run: |
+          APP="${{ github.event.inputs.app }}"
+          HOTFIX_VERSION="${{ steps.hotfix_version.outputs.hotfix_version }}"
+          
+          if [ "$APP" = "worker-mobile-app" ]; then
+            PUBSPEC_PATH="apps/mobile/apps/staff/pubspec.yaml"
+            CHANGELOG_PATH="apps/mobile/apps/staff/CHANGELOG.md"
+            APP_NAME="Staff Product"
+          else
+            PUBSPEC_PATH="apps/mobile/apps/client/pubspec.yaml"
+            CHANGELOG_PATH="apps/mobile/apps/client/CHANGELOG.md"
+            APP_NAME="Client Product"
+          fi
+          
+          # Update pubspec.yaml version
+          if [ -f "$PUBSPEC_PATH" ]; then
+            # Extract current version and build number
+            CURRENT_VERSION_LINE=$(grep "^version:" "$PUBSPEC_PATH")
+            CURRENT_BUILD=$(echo "$CURRENT_VERSION_LINE" | grep -oP '\+\K[0-9]+' || echo "1")
+            NEW_BUILD=$((CURRENT_BUILD + 1))
+            
+            # Update version line
+            sed -i "s/^version:.*/version: ${HOTFIX_VERSION}+${NEW_BUILD}/" "$PUBSPEC_PATH"
+            
+            echo "✅ Updated $PUBSPEC_PATH to ${HOTFIX_VERSION}+${NEW_BUILD}"
+            echo "updated_files=true" >> $GITHUB_OUTPUT
+          else
+            echo "⚠️ Warning: $PUBSPEC_PATH not found"
+            echo "updated_files=false" >> $GITHUB_OUTPUT
+          fi
+          
+      - name: 📋 Add CHANGELOG entry
+        run: |
+          APP="${{ github.event.inputs.app }}"
+          HOTFIX_VERSION="${{ steps.hotfix_version.outputs.hotfix_version }}"
+          ISSUE="${{ github.event.inputs.issue_description }}"
+          
+          if [ "$APP" = "worker-mobile-app" ]; then
+            CHANGELOG_PATH="apps/mobile/apps/staff/CHANGELOG.md"
+            APP_NAME="Staff Product"
+          else
+            CHANGELOG_PATH="apps/mobile/apps/client/CHANGELOG.md"
+            APP_NAME="Client Product"
+          fi
+          
+          if [ -f "$CHANGELOG_PATH" ]; then
+            DATE=$(date +%Y-%m-%d)
+            
+            # Extract title and body
+            TITLE=$(head -n 1 "$CHANGELOG_PATH")
+            BODY=$(tail -n +2 "$CHANGELOG_PATH")
+            
+            # Rebuild CHANGELOG with hotfix entry
+            echo "$TITLE" > "$CHANGELOG_PATH"
+            echo "" >> "$CHANGELOG_PATH"
+            echo "## [${HOTFIX_VERSION}] - ${DATE} - HOTFIX" >> "$CHANGELOG_PATH"
+            echo "" >> "$CHANGELOG_PATH"
+            echo "### Fixed" >> "$CHANGELOG_PATH"
+            echo "- ${ISSUE}" >> "$CHANGELOG_PATH"
+            echo "" >> "$CHANGELOG_PATH"
+            echo "---" >> "$CHANGELOG_PATH"
+            echo "" >> "$CHANGELOG_PATH"
+            echo "$BODY" >> "$CHANGELOG_PATH"
+            
+            echo "✅ Added CHANGELOG entry for hotfix $HOTFIX_VERSION"
+          else
+            echo "⚠️ Warning: $CHANGELOG_PATH not found"
+          fi
+          
+      - name: 💾 Commit version changes
+        run: |
+          HOTFIX_VERSION="${{ steps.hotfix_version.outputs.hotfix_version }}"
+          ISSUE="${{ github.event.inputs.issue_description }}"
+          
+          git add -A
+          git commit -m "chore: prepare hotfix v${HOTFIX_VERSION}
+
+HOTFIX: ${ISSUE}
+
+- Bump version to ${HOTFIX_VERSION}
+- Add CHANGELOG entry
+- Ready for bug fix commits
+
+From tag: ${{ github.event.inputs.tag }}"
+          
+          echo "✅ Committed version changes"
+          
+      - name: 🚀 Push hotfix branch
+        run: |
+          BRANCH="${{ steps.branch.outputs.branch_name }}"
+          
+          git push origin "$BRANCH"
+          
+          echo "✅ Pushed branch: $BRANCH"
+          
+      - name: 📄 Create Pull Request
+        id: create_pr
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          BRANCH="${{ steps.branch.outputs.branch_name }}"
+          HOTFIX_VERSION="${{ steps.hotfix_version.outputs.hotfix_version }}"
+          ISSUE="${{ github.event.inputs.issue_description }}"
+          APP="${{ github.event.inputs.app }}"
+          
+          # Strip -mobile-app suffix for cleaner tag names
+          APP_CLEAN=$(echo "$APP" | sed 's/-mobile-app$//')
+          
+          if [ "$APP" = "worker-mobile-app" ]; then
+            APP_DISPLAY="Worker Product"
+          else
+            APP_DISPLAY="Client Product"
+          fi
+          
+          PR_TITLE="🚨 HOTFIX: ${APP_DISPLAY} v${HOTFIX_VERSION} - ${ISSUE}"
+          
+          PR_BODY="## 🚨 HOTFIX - URGENT FIX
+
+**App:** ${APP_DISPLAY}
+**Version:** ${HOTFIX_VERSION}
+**From:** \`${{ github.event.inputs.tag }}\`
+
+### Issue
+${ISSUE}
+
+### Impact
+<!-- Describe how many users are affected and severity -->
+
+### Solution
+<!-- Describe the fix (will be added as you commit fixes) -->
+
+### Testing
+<!-- Describe local verification -->
+
+---
+
+## ⚠️ Hotfix Process
+
+1. ✅ Hotfix branch created
+2. ⏳ **NEXT:** Make your bug fix commits to this branch
+3. ⏳ Test the fix locally
+4. ⏳ Request expedited review (< 15 minutes)
+5. ⏳ Merge to main and create production tag
+
+### To add your fix:
+\`\`\`bash
+git checkout $BRANCH
+# Make your changes
+git commit -m \"fix: [description]\"
+git push origin $BRANCH
+\`\`\`
+
+### After merging:
+\`\`\`bash
+# Tag and release
+git checkout main
+git pull origin main
+git tag -a krow-withus-${APP_CLEAN}-mobile/prod-v${HOTFIX_VERSION} -m \"HOTFIX: ${ISSUE}\"
+git push origin krow-withus-${APP_CLEAN}-mobile/prod-v${HOTFIX_VERSION}
+\`\`\`
+
+---
+
+**Ref:** [Hotfix Process Documentation](../docs/release/HOTFIX_PROCESS.md)"
+          
+          # Create PR
+          PR_URL=$(gh pr create \
+            --base main \
+            --head "$BRANCH" \
+            --title "$PR_TITLE" \
+            --body "$PR_BODY" \
+            --label "hotfix,urgent,production")
+          
+          echo "pr_url=${PR_URL}" >> $GITHUB_OUTPUT
+          echo "✅ Pull Request created: $PR_URL"
+          
+      - name: 📊 Hotfix Summary
+        run: |
+          # Strip -mobile-app suffix for cleaner tag names
+          APP_CLEAN=$(echo "${{ github.event.inputs.app }}" | sed 's/-mobile-app$//')
+          
+          echo "## 🚨 Hotfix Branch Created" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**App:** ${{ github.event.inputs.app }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Issue:** ${{ github.event.inputs.issue_description }}" >> $GITHUB_STEP_SUMMARY
+          echo "**From Tag:** \`${{ github.event.inputs.tag }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Current Version:** ${{ steps.validate_tag.outputs.current_version }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Hotfix Version:** ${{ steps.hotfix_version.outputs.hotfix_version }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Branch:** \`${{ steps.branch.outputs.branch_name }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### 🔧 Next Steps" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "1. **Checkout the hotfix branch:**" >> $GITHUB_STEP_SUMMARY
+          echo "   \`\`\`bash" >> $GITHUB_STEP_SUMMARY
+          echo "   git fetch origin" >> $GITHUB_STEP_SUMMARY
+          echo "   git checkout ${{ steps.branch.outputs.branch_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "   \`\`\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "2. **Make your bug fix(es)** - Keep changes minimal!" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "3. **Test locally** - Verify the fix works" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "4. **Request expedited review** - Target < 15 minutes" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "5. **Merge PR and create production tag:**" >> $GITHUB_STEP_SUMMARY
+          echo "   \`\`\`bash" >> $GITHUB_STEP_SUMMARY
+          echo "   git checkout main" >> $GITHUB_STEP_SUMMARY
+          echo "   git pull origin main" >> $GITHUB_STEP_SUMMARY
+          echo "   git tag -a krow-withus-${APP_CLEAN}-mobile/prod-v${{ steps.hotfix_version.outputs.hotfix_version }} -m \"HOTFIX: ${{ github.event.inputs.issue_description }}\"" >> $GITHUB_STEP_SUMMARY
+          echo "   git push origin krow-withus-${APP_CLEAN}-mobile/prod-v${{ steps.hotfix_version.outputs.hotfix_version }}" >> $GITHUB_STEP_SUMMARY
+          echo "   \`\`\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          
+          if [ -n "${{ steps.create_pr.outputs.pr_url }}" ]; then
+            echo "**Pull Request:** ${{ steps.create_pr.outputs.pr_url }}" >> $GITHUB_STEP_SUMMARY
+          fi

.github/workflows/mobile-ci.yml

@@ -2,6 +2,7 @@ name: Mobile CI
 
 on:
   workflow_dispatch: # Manual trigger only — auto-triggers disabled (free plan)
+  workflow_dispatch:
 
 jobs:
   detect-changes:

.github/workflows/product-release.yml

@@ -0,0 +1,289 @@
+name: 📦 Product Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      app:
+        description: '📦 Product'
+        required: true
+        type: choice
+        options:
+          - worker-mobile-app
+          - client-mobile-app
+      environment:
+        description: '🌍 Environment'
+        required: true
+        type: choice
+        options:
+          - dev
+          - stage
+          - prod
+      create_github_release:
+        description: '📦 Create GitHub Release'
+        required: true
+        type: boolean
+        default: true
+      prerelease:
+        description: '🔖 Mark as Pre-release'
+        required: false
+        type: boolean
+        default: false
+
+jobs:
+  validate-and-create-release:
+    name: 🚀 Create Product Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      tag_name: ${{ steps.tag.outputs.tag_name }}
+      
+    steps:
+      - name: 📥 Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          
+      - name: 🏃🏾‍♂️ Make scripts executable
+        run: |
+          chmod +x .github/scripts/*.sh
+          echo "✅ Scripts are now executable"
+          
+      - name: 📖 Extract version from version file
+        id: version
+        run: |
+          VERSION=$(.github/scripts/extract-version.sh "${{ github.event.inputs.app }}")
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "📌 Extracted version: ${VERSION}"
+          
+      - name: 🏷️ Generate tag name
+        id: tag
+        run: |
+          TAG_NAME=$(.github/scripts/generate-tag-name.sh \
+            "${{ github.event.inputs.app }}" \
+            "${{ github.event.inputs.environment }}" \
+            "${{ steps.version.outputs.version }}")
+          echo "tag_name=${TAG_NAME}" >> $GITHUB_OUTPUT
+          echo "🎯 Tag to create: ${TAG_NAME}"
+          
+      - name: 🔍 Check if tag already exists
+        run: |
+          TAG_NAME="${{ steps.tag.outputs.tag_name }}"
+          if git rev-parse "$TAG_NAME" >/dev/null 2>&1; then
+            echo "❌ Error: Tag $TAG_NAME already exists"
+            echo "💡 Tip: Update the version in the version file before creating a new release"
+            exit 1
+          fi
+          echo "✅ Tag does not exist, proceeding..."
+          
+      - name: 📋 Extract release notes from CHANGELOG
+        id: release_notes
+        run: |
+          .github/scripts/extract-release-notes.sh \
+            "${{ github.event.inputs.app }}" \
+            "${{ steps.version.outputs.version }}" \
+            "${{ github.event.inputs.environment }}" \
+            "${{ steps.tag.outputs.tag_name }}" \
+            "/tmp/release_notes.md"
+          echo "notes_file=/tmp/release_notes.md" >> $GITHUB_OUTPUT
+          
+      - name: 🏷️ Create Git Tag
+        run: |
+          TAG_NAME="${{ steps.tag.outputs.tag_name }}"
+          APP="${{ github.event.inputs.app }}"
+          ENV="${{ github.event.inputs.environment }}"
+          VERSION="${{ steps.version.outputs.version }}"
+          
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          
+          git tag -a "$TAG_NAME" -m "🚀 Release ${APP} product ${VERSION} to ${ENV}"
+          git push origin "$TAG_NAME"
+          
+          echo "✅ Tag created and pushed: $TAG_NAME"
+          
+      - name: 📦 Create GitHub Release
+        if: ${{ github.event.inputs.create_github_release == 'true' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG_NAME="${{ steps.tag.outputs.tag_name }}"
+          APP="${{ github.event.inputs.app }}"
+          ENV="${{ github.event.inputs.environment }}"
+          VERSION="${{ steps.version.outputs.version }}"
+          
+          # Generate release title
+          if [ "$APP" = "worker-mobile-app" ]; then
+            APP_DISPLAY="Worker Mobile Application"
+          else
+            APP_DISPLAY="Client Mobile Application"
+          fi
+          
+          ENV_UPPER=$(echo "$ENV" | tr '[:lower:]' '[:upper:]')
+          RELEASE_NAME="Krow With Us - ${APP_DISPLAY} - ${ENV_UPPER} - v${VERSION}"
+          
+          echo "📦 Creating GitHub Release: $RELEASE_NAME"
+          
+          # Create release
+          if [ "${{ github.event.inputs.prerelease }}" = "true" ]; then
+            gh release create "$TAG_NAME" \
+              --title "$RELEASE_NAME" \
+              --notes-file "${{ steps.release_notes.outputs.notes_file }}" \
+              --prerelease
+            echo "🔖 Pre-release created successfully"
+          else
+            gh release create "$TAG_NAME" \
+              --title "$RELEASE_NAME" \
+              --notes-file "${{ steps.release_notes.outputs.notes_file }}"
+            echo "✅ Release created successfully"
+          fi
+          
+      - name: 📊 Generate Release Summary
+        run: |
+          .github/scripts/create-release-summary.sh \
+            "${{ github.event.inputs.app }}" \
+            "${{ github.event.inputs.environment }}" \
+            "${{ steps.version.outputs.version }}" \
+            "${{ steps.tag.outputs.tag_name }}"
+  
+  build-mobile-artifacts:
+    name: 📱 Build Mobile APK
+    runs-on: ubuntu-latest
+    needs: validate-and-create-release
+    if: ${{ github.event.inputs.app == 'worker-mobile-app' || github.event.inputs.app == 'client-mobile-app' }}
+    permissions:
+      contents: write
+    
+    steps:
+      - name: 📥 Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          
+      - name: 🟢 Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          
+      - name: 🔥 Install Firebase CLI
+        run: |
+          npm install -g firebase-tools
+          firebase --version
+          echo "ℹ️ Note: Firebase CLI installed for Data Connect SDK generation"
+          echo "ℹ️ If SDK generation fails, ensure Data Connect SDK files are committed to repo"
+          
+      - name: ☕ Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'zulu'
+          java-version: '17'
+          
+      - name: 🐦 Setup Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          flutter-version: '3.38.x'
+          channel: 'stable'
+          cache: true
+          
+      - name: 🔧 Install Melos
+        run: |
+          dart pub global activate melos
+          echo "$HOME/.pub-cache/bin" >> $GITHUB_PATH
+          
+      - name: 📦 Install Dependencies
+        run: |
+          make mobile-install
+          
+      - name: 🔐 Setup APK Signing
+        env:
+          # Worker Mobile (Staff App) Secrets
+          WORKER_KEYSTORE_DEV_BASE64: ${{ secrets.WORKER_KEYSTORE_DEV_BASE64 }}
+          WORKER_KEYSTORE_STAGING_BASE64: ${{ secrets.WORKER_KEYSTORE_STAGING_BASE64 }}
+          WORKER_KEYSTORE_PROD_BASE64: ${{ secrets.WORKER_KEYSTORE_PROD_BASE64 }}
+          WORKER_KEYSTORE_PASSWORD_DEV: ${{ secrets.WORKER_KEYSTORE_PASSWORD_DEV }}
+          WORKER_KEYSTORE_PASSWORD_STAGING: ${{ secrets.WORKER_KEYSTORE_PASSWORD_STAGING }}
+          WORKER_KEYSTORE_PASSWORD_PROD: ${{ secrets.WORKER_KEYSTORE_PASSWORD_PROD }}
+          WORKER_KEY_ALIAS_DEV: ${{ secrets.WORKER_KEY_ALIAS_DEV }}
+          WORKER_KEY_ALIAS_STAGING: ${{ secrets.WORKER_KEY_ALIAS_STAGING }}
+          WORKER_KEY_ALIAS_PROD: ${{ secrets.WORKER_KEY_ALIAS_PROD }}
+          WORKER_KEY_PASSWORD_DEV: ${{ secrets.WORKER_KEY_PASSWORD_DEV }}
+          WORKER_KEY_PASSWORD_STAGING: ${{ secrets.WORKER_KEY_PASSWORD_STAGING }}
+          WORKER_KEY_PASSWORD_PROD: ${{ secrets.WORKER_KEY_PASSWORD_PROD }}
+          
+          # Client Mobile Secrets
+          CLIENT_KEYSTORE_DEV_BASE64: ${{ secrets.CLIENT_KEYSTORE_DEV_BASE64 }}
+          CLIENT_KEYSTORE_STAGING_BASE64: ${{ secrets.CLIENT_KEYSTORE_STAGING_BASE64 }}
+          CLIENT_KEYSTORE_PROD_BASE64: ${{ secrets.CLIENT_KEYSTORE_PROD_BASE64 }}
+          CLIENT_KEYSTORE_PASSWORD_DEV: ${{ secrets.CLIENT_KEYSTORE_PASSWORD_DEV }}
+          CLIENT_KEYSTORE_PASSWORD_STAGING: ${{ secrets.CLIENT_KEYSTORE_PASSWORD_STAGING }}
+          CLIENT_KEYSTORE_PASSWORD_PROD: ${{ secrets.CLIENT_KEYSTORE_PASSWORD_PROD }}
+          CLIENT_KEY_ALIAS_DEV: ${{ secrets.CLIENT_KEY_ALIAS_DEV }}
+          CLIENT_KEY_ALIAS_STAGING: ${{ secrets.CLIENT_KEY_ALIAS_STAGING }}
+          CLIENT_KEY_ALIAS_PROD: ${{ secrets.CLIENT_KEY_ALIAS_PROD }}
+          CLIENT_KEY_PASSWORD_DEV: ${{ secrets.CLIENT_KEY_PASSWORD_DEV }}
+          CLIENT_KEY_PASSWORD_STAGING: ${{ secrets.CLIENT_KEY_PASSWORD_STAGING }}
+          CLIENT_KEY_PASSWORD_PROD: ${{ secrets.CLIENT_KEY_PASSWORD_PROD }}
+        run: |
+          .github/scripts/setup-apk-signing.sh \
+            "${{ github.event.inputs.app }}" \
+            "${{ github.event.inputs.environment }}" \
+            "${{ runner.temp }}"
+          
+      - name: 🏗️ Build APK
+        id: build_apk
+        run: |
+          APP="${{ github.event.inputs.app }}"
+          
+          if [ "$APP" = "worker-mobile-app" ]; then
+            echo "📱 Building Staff (Worker) APK..."
+            make mobile-staff-build PLATFORM=apk MODE=release
+            APP_NAME="staff"
+          else
+            echo "📱 Building Client APK..."
+            make mobile-client-build PLATFORM=apk MODE=release
+            APP_NAME="client"
+          fi
+          
+          # Find the generated APK (Flutter places it in build/app/outputs/flutter-apk/)
+          APK_PATH=$(find apps/mobile/apps/${APP_NAME}/build/app/outputs/flutter-apk -name "app-release.apk" 2>/dev/null | head -n 1)
+          
+          # Fallback to searching entire apps directory if not found
+          if [ -z "$APK_PATH" ]; then
+            APK_PATH=$(find apps/mobile/apps/${APP_NAME} -name "app-release.apk" | head -n 1)
+          fi
+          
+          if [ -z "$APK_PATH" ]; then
+            echo "❌ Error: APK not found!"
+            echo "Searched in apps/mobile/apps/${APP_NAME}/"
+            find apps/mobile/apps/${APP_NAME} -name "*.apk" || echo "No APK files found"
+            exit 1
+          fi
+          
+          echo "✅ APK built successfully: $APK_PATH"
+          echo "app_name=${APP_NAME}" >> $GITHUB_OUTPUT
+          echo "apk_path=${APK_PATH}" >> $GITHUB_OUTPUT
+          
+      - name: ✅ Verify APK Signature
+        run: |
+          .github/scripts/verify-apk-signature.sh "${{ steps.build_apk.outputs.apk_path }}"
+          
+      - name: 📤 Upload APK as Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ github.event.inputs.app }}-${{ needs.validate-and-create-release.outputs.version }}-${{ github.event.inputs.environment }}
+          path: apps/mobile/apps/${{ steps.build_apk.outputs.app_name }}/build/app/outputs/flutter-apk/app-release.apk
+          if-no-files-found: error
+          retention-days: 30
+          
+      - name: 📦 Attach APK to GitHub Release
+        if: ${{ github.event.inputs.create_github_release == 'true' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          .github/scripts/attach-apk-to-release.sh \
+            "${{ needs.validate-and-create-release.outputs.tag_name }}" \
+            "${{ github.event.inputs.app }}" \
+            "${{ steps.build_apk.outputs.app_name }}" \
+            "${{ needs.validate-and-create-release.outputs.version }}" \
+            "${{ github.event.inputs.environment }}"