Commit keystore to repo for consistent APK signing across all CI builds

Simplifies signing: the keystore is stored in the repo so every release
workflow run uses the same certificate. This fixes "App not installed"
when updating via GitHub releases.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -30,19 +30,7 @@ jobs:
           key: gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
           restore-keys: gradle-
 
-      - name: Decode signing keystore
+      - name: Build signed APK
-        env:
-          KEYSTORE_B64: ${{ secrets.KEYSTORE_BASE64 }}
-        run: |
-          printf '%s' "$KEYSTORE_B64" | base64 --ignore-garbage -d > "$RUNNER_TEMP/pixel10.keystore"
-          echo "Keystore decoded: $(wc -c < $RUNNER_TEMP/pixel10.keystore) bytes"
-
-      - name: Build signed debug APK
-        env:
-          KEYSTORE_PATH: ${{ runner.temp }}/pixel10.keystore
-          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
-          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
-          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
         run: ./gradlew assembleDebug --no-daemon
 
       - name: Rename APK with version tag

.gitignore

@@ -15,4 +15,3 @@ local.properties
 *.bin
 *.task
 *.tflite
-pixel10.keystore

app/build.gradle.kts

@@ -16,16 +16,10 @@ android {
     }
 
     val keystoreFile = rootProject.file("pixel10.keystore")
-    val keystoreEnv = System.getenv("KEYSTORE_PATH")
 
     signingConfigs {
         create("release") {
-            if (keystoreEnv != null) {
+            if (keystoreFile.exists()) {
-                storeFile = file(keystoreEnv)
-                storePassword = System.getenv("KEYSTORE_PASSWORD")
-                keyAlias = System.getenv("KEY_ALIAS")
-                keyPassword = System.getenv("KEY_PASSWORD")
-            } else if (keystoreFile.exists()) {
                 storeFile = keystoreFile
                 storePassword = "pixel10ai"
                 keyAlias = "pixel10"