.gitea/workflows/build.yaml

@@ -15,5 +15,6 @@ jobs:
       tasks: |
         testDebugUnitTest :scanner-host:lintDebug :scanner-host:assembleDebug
         -PscannerTestBuildType=qa :scanner-host:assembleQa :scanner-host:assembleQaAndroidTest
+        :scanner-host:lintRelease :scanner-host:assembleRelease -PscannerVersionName=0.0.0-ci -PscannerVersionCode=1
       emulator-tasks: connectedDebugAndroidTest
       publish-tasks: :qqq:android:core:publishAllPublicationsToGiteaRepository :qqq:android:mobileapp:publishAllPublicationsToGiteaRepository

docs/RELEASING.md

@@ -23,6 +23,8 @@ Build only after PRs 17 and 18 are merged to `main` and this branch has been reb
 ./gradlew --no-daemon --console=plain :scanner-host:lintRelease :scanner-host:assembleRelease -PscannerVersionName=1.0.2 -PscannerVersionCode=4
 ```
 
+CI (`.gitea/workflows/build.yaml`) already runs `:scanner-host:lintRelease :scanner-host:assembleRelease` with throwaway version values on every push, so a release-variant lint or build break fails the pull request. It builds the unsigned release variant only, holds no signing material, and its APK is not a release candidate: the signed APK is still produced by the manual isolated `apksigner` step below.
+
 Then sign `scanner-host/build/outputs/apk/release/scanner-host-release-unsigned.apk` in isolation with `apksigner` using the existing permanent key (certificate SHA-256 `BDDB2D2F...5B17A9FF`), verify v2+v3 with exactly one signer, 16 KiB alignment, `versionCode='4' versionName='1.0.2'` and non-debuggable, and write `QQQ-Mobile-1.0.2.apk`, `SHA256SUMS`, `signature-verification.txt`, `apk-metadata.txt` and `release-receipt.json` next to each other as for 1.0.1. Record the resulting hashes here, in [INSTALLATION](INSTALLATION.md) and in [SESSION-STATE](SESSION-STATE.md) before any tag or release.
 
 ## Historical status (November 4, 2026, superseded where noted)