Brings the release workflow in line with the status check. It matters more
here, not less: these jobs publish the artifacts people install, so running
whatever a mutable tag points at on the day is a worse bargain than it is on
a pull request.
Every action is pinned to a commit with its release in a trailing comment,
and each hash was checked to resolve to the tag it claims. gradle/actions is
dropped for the same reason as before -- its v6 caching component is closed
source and carries separate terms -- with Gradle running through the
committed wrapper, which verifies its own distribution against
distributionSha256Sum.
The release job now checks what it is about to publish. A release that
shipped a single ABI, or that lost 16 KB alignment in a rebuild, installs
fine on a test device and then fails for users or at Play submission. Both
are cheap to assert and expensive to discover afterwards. It deliberately
does not pass -PabiFilters: that override exists so emulator jobs skip
libraries they cannot execute, and a released artifact must carry every ABI.
The contents permission is declared explicitly rather than inherited from the
repository default, so the token's reach is visible in the file that uses it.
The corresponding-source tarball now includes bin/README.md as PREBUILT.md,
so the GPL source drop carries the shipped binary's SHA-256 and configure
line rather than only the recipe that produces it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
JMR-devandClaude Opus 5
97cddea973