[pasichDev]

✅ Ready: merge once CI is green.

Before tagging v2.2.1: the one-time Google Cloud / Play Console / google-play environment setup for CI publishing. Without it the tag still makes the GitHub Release and the Play upload is skipped (kill switch).

What

Hotfix 2.2.1 for the two crashes reported on 2.2.0, plus publishing to Google Play from CI.

• Crash on text selection. Double-tapping a word (any text selection) crashed the app. SensitiveClipboard now implements AndroidClipboard. The Compose 1.12 text toolbar reads the system clipboard through Clipboard.nativeClipboardManager, and that call throws for any other Clipboard. Copies are still marked sensitive and still cleared after a minute.
• Crash when the vault locks. The drawer counts (StatisticViewModel) and the Tasks list (TasksViewModel) collected database flows without error handling. Once the vault session closed, a re-query threw Database session expired. The failure is now logged and the last values stay on screen until the lock screen takes over.
• Play publishing. A vX.Y.Z tag builds the play bundle, signs it and publishes it to production at 100%. The upload includes mapping.txt and the store release notes.
• Release 2.2.1. version.properties, CHANGELOG.md and the release notes in all nine store languages.

Why

On 2.2.0 every crash in Play Console comes from these two causes:

• IllegalArgumentException in AndroidClipboard_androidKt.getNativeClipboardManager, from the text toolbar.
• IllegalStateException in SecureDatabaseManager.getDatabase, from the tags and tasks flows. Its 2.1.0 groups are the same two collectors.

Releases reached Play by hand and without a mapping file, so 2.2.0 crash reports were obfuscated.

Behaviour changes

• Pushing a v* tag now publishes to Google Play production for 100% of users. There is no approval step. PLAY_PUBLISH_ENABLED is the only switch.
• publish-play.yml no longer takes a ref or status input. To re-run it, start it by hand from the tag.

Deploy

How CI talks to Google: no Google key is stored in GitHub.

• The upload job exchanges the run's OIDC token for a short-lived service-account token through Workload Identity Federation.
• The provider accepts only this repository (by its numeric id), the google-play environment and refs/tags/v*.
• The service account has no Google Cloud roles, only release rights for Encly in Play Console.
• The build job holds the signing key and has no OIDC token. The upload job has the OIDC token and only gets the signed bundle.

Repository variables needed: PLAY_WIF_PROVIDER, PLAY_SERVICE_ACCOUNT, PLAY_PUBLISH_ENABLED=true, plus the environment google-play with a deployment rule for v* tags. The old PLAY_SERVICE_ACCOUNT_JSON secret is no longer used.

Testing

• New regression tests:
  • SensitiveClipTest (the system clipboard is still reachable under the boundary).
  • StatisticViewModelTest and TasksViewModelTest (a read failing after the vault closed).
  • All three fail without the fixes and pass with them.
• StoreMetadataTest now checks:
  • the publish workflow's triggers (v* tags and manual only);
  • the kill switch on every job;
  • that no job has both the signing secrets and id-token: write.
• testPlayDebugUnitTest and testFdroidDebugUnitTest: 1704 tests each, 0 failures. lintPlayRelease and lintFdroidRelease pass. bundlePlayRelease builds and writes mapping.txt.
• The crash stack traces were retraced with the 2.2.0 playRelease mapping.

Not verified:

• On a device: text selection and locking with the Tasks screen open.
• detekt locally (only JDK 25 installed; CI runs it).
• The first end-to-end Play upload through Workload Identity Federation. r0adkll/upload-google-play reads the credentials file through GOOGLE_APPLICATION_CREDENTIALS with google-auth-library 9, which supports external_account, but only the first tag run proves it.

[github-actions]

Coverage

Overall Project	89.76%	🍏
Files changed	100%	🍏

File	Coverage
StatisticViewModel.kt	100%	🍏
TasksViewModel.kt	94.58%	🍏
SensitiveClip.kt	88.76%	🍏