build(client/android): add a release build for the Capacitor app

[ohnorobo]

What

Adds a production release path for the Capacitor Android app, step 2 of the Capacitor migration plan. Until now the Capacitor build was debug-only.

npm run action client/capacitor/build android -- --buildMode=release --versionName=<version>

takes the same environment variables as the Cordova release build (SENTRY_DSN, ANDROID_KEY_STORE_CONTENTS, ANDROID_KEY_STORE_PASSWORD, JAVA_HOME) and leaves the signed app-release.aab and universal.apk in client/capacitor/android/app/build/outputs/bundle/release/.

iOS and macOS release builds are not part of this PR. Nothing in outline-release changes yet, so releases keep using Cordova.

Commits

1. Shared helper. Moves the bundletool download, universal APK generation and 16 KB alignment check out of the Cordova build action into client/build/android_universal_apk.mjs, unchanged, so both build actions use the same code.
2. Web bundle. web_build.action.mjs accepts release mode: webpack in production mode, a version and a Sentry DSN are required, and the DSN is written to environment.json. These are the same checks the Cordova web build does.
3. Release build. app/build.gradle takes the version and the signing keystore as Gradle project properties, and build.action.mjs runs bundleRelease and then the shared helper.
4. Parity with the Cordova release configuration. Pins the NDK so that AGP strips the native libraries, and enables R8 and resource shrinking.
5. Universal APK as an output. The helper already extracted universal.apk to check its alignment; it now keeps it next to the AAB, so the release scripts copy artifacts instead of unpacking the bundletool archive. Outline.zip stays for the Cordova release path.

Differences from the Cordova release build

• The keystore password reaches Gradle through the environment rather than a command-line argument, and the decoded keystore is written to a temporary directory that is removed after the build, rather than into the source tree.
• The version is passed to Gradle as properties instead of being substituted into generated files.
• The build needs JDK 21, where Cordova needs JDK 17.
• The version code is the same "hours since the epoch" build number as Cordova, so a Capacitor release is always newer than any Cordova one.

Verified

Locally, with a throwaway keystore:

• The release build succeeds. The universal APK and the AAB are signed with the test key, carry the requested version name and the build number as version code, contain the DSN in environment.json, and pass the 16 KB alignment check.
• The keystore password does not appear in the build log.
• With commit 4, the universal APK goes from 60 MB to 43 MB, and libgojni.so from 12.7 MB to 8.9 MB per ABI.
• The Cordova release build still succeeds through the moved helper.

On an API 35 emulator, with release builds of both apps signed with the same test key:

• Upgrade. A server added in the Cordova release is still there after an in-place upgrade to the Capacitor release, the privacy screen does not show again, and the server survives a relaunch.
• VPN. The R8 Capacitor release connects through a local Shadowsocks server (tun0 comes up, and the server sees the TCP and UDP connectivity checks) and disconnects cleanly.

Full release build (1.21.6)

Built as a real release through the outline-release scripts (OutlineFoundation/outline-release#17, build client android) from #2869's head 4dde5a4, which includes this PR. 1.21.6 is a dummy version not intended for publishing, and the publish step has not been tested.

• The release keystore signed the AAB and universal APK. Version name 1.21.6, version code 497604.
• Play accepted the AAB on the internal testing track: App bundle explorer.
• The universal APK and AAB are in s3://outline-release-candidates/client/android/1.21.6/1/, the native debug symbols went to Sentry, and the build is tagged client_android/v1.21.6-rc.1.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds Android release build infrastructure and signing.

The PR appears safe to merge; no actionable defect was established.

What we checked:

• Build numbers stay together: The parent computes the number once and passes it to both the web build and Gradle.

Summary

Adds signed Android release builds for the Capacitor client.

• Capacitor Android builds signed releases with an installable APK.
• Capacitor release builds include production web assets and Sentry settings.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Capacitor Android release action] --> B[Production web bundle]
  B --> C[Capacitor sync and native library build]
  C --> D[Gradle bundleRelease with version and signing inputs]
  D --> E[Signed app-release.aab]
  E --> F[Shared bundletool helper]
  F --> G[Signed universal.apk]
  G --> H[16 KB alignment check]
  H --> I[Release artifacts]
  J[Cordova Android release action] --> F

Loading

_{Reviews (4) · Last reviewed commit: "build(client): strip the space-separated..." · Reviewed by Greptile}