gowalk-cicd 1.0.169 → 1.0.171

package/README.md

@@ -23,6 +23,14 @@ Writes three core things into your repo:
 - `.github/actions/android-app/` — Android build/sign action (Flutter or Gradle)
 - `.github/workflows/deploy.yml` — workflow that builds and deploys both platforms
 
+It also writes:
+
+- `.github/workflows/mobile-candidate.yml` — shipping binaries for ready task PRs
+  (dispatch-only while candidate artifacts are off)
+- `.github/workflows/warm-android-cache.yml` — only while Android candidates are enabled: after this
+  app's successful default-branch release that includes Android, compiles the Android bundle once,
+  unsigned, when main has no Gradle cache for it ([Gradle dependency retention](docs/GRADLE_CACHE.md))
+
 The installer no longer adds `.github/workflows/deploy-web.yml`. On re-adoption it
 removes a `deploy-web.yml` that is still byte-for-byte the generated file and has no
 overrides in `.gowalk-cicd.yml`; a customized one keeps upgrading (see

package/android-action/scripts/android_config.py

@@ -264,6 +264,21 @@ def detect_package_name(workspace: Path, build_file: Path | None = None) -> str:
     raise ConfigError(f"cannot detect Android applicationId from {gradle_files[0].parent}")
 
 
+def build_inputs(workspace: Path) -> dict[str, str]:
+    """What the release build compiles, read from the checkout alone.
+
+    The default branch's Gradle cache warm-up (`templates/warm-android-cache.yml`) compiles
+    what a candidate compiles without creds/, a Play read or a version write, so it never runs
+    resolve_android.py (a Play edit). Raises ConfigError when there is no Android project.
+    """
+    if project_kind(workspace) == "flutter":
+        if not _first_existing(workspace / "android", SETTINGS_FILES):
+            raise ConfigError("no Android project: android/settings.gradle(.kts) is missing")
+        return {"project_kind": "flutter", "gradle_root": "", "gradle_module": ""}
+    project = find_gradle_project(workspace)
+    return {"project_kind": "gradle", "gradle_root": str(project.root), "gradle_module": project.module}
+
+
 def detect_bundle(workspace: Path, search_root: Path | None = None) -> Path:
     # Flutter collects every module's outputs under build/app/; a plain Gradle
     # build leaves them in the module's own build/outputs/bundle/.
@@ -304,3 +319,25 @@ def set_gradle_version(
     if patched != original:
         build_file.write_text(patched)
     return {"version_code": bool(code_hits), "version_name": bool(name_hits)}
+
+
+if __name__ == "__main__":
+    import os
+    import sys
+
+    root = Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve()
+    if sys.argv[1:] == ["--flutter-toolchain"]:
+        import gradle_wrapper
+
+        # The same toolchain repair resolve_android.py applies before a Flutter release build.
+        for line in gradle_wrapper.ensure_toolchain(root, Path(os.environ["FLUTTER_ROOT"])):
+            print(line)
+        sys.exit(0)
+    try:
+        values = build_inputs(root)
+    except ConfigError as exc:
+        # Nothing to warm; an empty kind skips the rest without failing anything.
+        print(f"Nothing to compile: {exc}")
+        values = {"project_kind": "", "gradle_root": "", "gradle_module": ""}
+    with open(os.environ["GITHUB_OUTPUT"], "a") as output:
+        output.writelines(f"{name}={value}\n" for name, value in values.items())

package/bin/cli.mjs

@@ -47,6 +47,7 @@ What it writes:
   .github/actions/android-app/ - Flutter Android build/sign action
   .github/workflows/deploy.yml - dual-platform workflow
   .github/workflows/mobile-candidate.yml - candidate binaries for ready task PRs
+  .github/workflows/warm-android-cache.yml - main's Gradle cache after a release (with candidates)
 
 Options:
   release [ios|android|both]  Prepare a mobile release intent on the task branch

package/docs/CANDIDATE_ARTIFACTS.md

@@ -17,8 +17,9 @@ After protected merge, each existing platform job looks for its matching candida
 lookup never waits for a build to finish. A missing, expired, failed or mismatched candidate uses
 the normal release build. Reads have short timeouts and downloading gets the remainder of a
 two-minute lookup budget. Dependency caches are optional: candidate runs restore Gradle, CocoaPods and
-Flutter caches but never save them, and only default-branch runs save (see
-[Gradle dependency retention](GRADLE_CACHE.md)).
+Flutter caches but never save them, and only default-branch runs save. After a successful
+default-branch release that includes Android, `warm-android-cache.yml` fills main's Android Gradle
+key when it is missing (see [Gradle dependency retention](GRADLE_CACHE.md)).
 
 Reuse requires the same repository, platform, source/build inputs, current signing/account material,
 successful producer job and retained file hashes. A successful platform's earlier artifact survives
@@ -50,4 +51,5 @@ When adopting, review the installer’s replaced-binding receipt and retain app-
 configuration and validation. Native Xcode validation can use the same `native_cache.py` helper
 and pinned cache programs as release builds. Cache Pods and `.factory/toolchain/gems` with the
 helper's lockfile/Ruby/Xcode/architecture identity; `pod install --deployment` and committed locks
-remain required. No warm-up job, machine affinity, reservation or factory wait protocol is added.
+remain required. Beyond that Android Gradle warm-up, no warm-up job, machine affinity, reservation
+or factory wait protocol is added.

package/docs/CONFIGURATION.md

@@ -62,8 +62,10 @@ Compose service must pass `BACKEND_PUBLIC_BASE_URL` into its container and use i
 The same named repository inputs reach the feature-branch backend preview in `deploy.yml`.
 
 The supported managed files are `deploy.yml`, `mobile-candidate.yml`,
-`deploy-web.yml` and `deploy-backend.yml`. The installer no longer adds `deploy-web.yml`;
-it removes an existing one that is still the unmodified generated file with no overrides,
+`warm-android-cache.yml`, `deploy-web.yml` and `deploy-backend.yml`. The installer no longer adds
+`deploy-web.yml`, and adds `warm-android-cache.yml` only while candidate artifacts are enabled
+and `mobile.platforms` is not `ios`;
+it removes such a file that is still the unmodified generated one with no overrides,
 and keeps upgrading one this configuration customizes. App-specific values outside the named
 mobile/backend inputs, and custom jobs or steps embedded in those workflows,
 are retained as sparse `workflows.<file>.overrides` entries. An override identifies
@@ -97,3 +99,12 @@ An unknown layout or overlapping custom code edit returns a JSON
 `gowalk-cicd/migration-repair.v1` receipt with its code, file and YAML path. The
 receipt never includes the conflicting value. Resolve that specific customization
 in the same repository; unrelated repositories can continue upgrading.
+
+1.0.168 deleted the Android `mode` step (Bitrise delivery). No app enabled Bitrise, so it
+always answered `local`; a deleted step answers null. An upgrade therefore drops a
+`steps.mode.outputs.mode == 'local'` (or `!= 'bitrise'`) conjunct from an app's
+`jobs.android` step `if`, and an `if` left empty goes. Any other use of `steps.mode` in a
+`jobs.android` step `if` returns `android_mode_condition_requires_edit`: a Bitrise-only step
+never ran (delete it), and beside `always()`, `failure()` or `cancelled()` the conjunct also
+meant that the steps before `mode` succeeded (restate that). `env`, `run` and job outputs are
+not checked; there `steps.mode` renders empty.

package/docs/GRADLE_CACHE.md

@@ -20,7 +20,20 @@ The pinned cache preloader remains confined to the official cache processes.
 GitHub caches are branch-scoped: task branches cannot restore sibling branches' caches, while
 default-branch caches can serve subsequent task branches. The normal default-branch release
 therefore retains useful downloads after failure as well as after successful delivery. It
-adds no warming workflow, extra main validation, upload retry or release dispatch.
+adds no extra main validation, upload retry or release dispatch.
+
+A release that promotes its candidate compiles nothing, so it saves nothing. While Android
+candidates are enabled, the installer adds `warm-android-cache.yml`: after this app's own successful
+`Mobile Deploy` push run on the default branch whose release intent names Android, it looks up the
+android job's exact Gradle key on the android job's runner (Linux only). GitHub also matches the key
+as a prefix, so earlier `-warm-`/`-partial-` saves count. A lookup that times out stops; one the
+cache service rejects reads as a miss. Only on a miss does it compile the unsigned bundle once, with
+no credentials other than `GIT_PRIVATE_TOKEN`, no store call and no upload task. A finished build,
+or one stopped at 30 minutes, saves `<key>-warm-<run_id>-<attempt>`; an earlier failure saves nothing
+and the next release retries. A later real main build still saves the exact key. It never fails or
+delays a release; a queued warm-up that a newer one replaces shows as cancelled. It declares
+`cache-mode: write` because a `workflow_run` job otherwise gets a read-only cache token. No dispatch,
+schedule or pre-warm; android job overrides do not reach it.
 
 On adoption, preserve app-specific dependency inputs, platforms and existing restore identities.
 Candidate and release workflows need compatible keys, paths and compression versions to share

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.169",
+  "version": "1.0.171",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/config/merge.mjs

@@ -86,9 +86,53 @@ function iosChange(file, before, after, change) {
   return change;
 }
 
+// 1.0.168 deleted the Android step `mode`, which answered 'local' on every app (none enabled
+// Bitrise). A missing step answers null, so an app step still guarded by
+// `steps.mode.outputs.mode == 'local'` silently stopped running. That always-true conjunct is
+// dropped (&& binds tighter than ||, so any isolated conjunct can go); any other use refuses.
+// Beside always(), failure() or cancelled() it also meant "nothing before mode failed", so it refuses.
+const MODE = /^steps\.mode\.outputs\.mode\s*(?:==\s*'local'|!=\s*'bitrise')$/;
+const USES_MODE = /\bsteps\.mode(?![\w-])/, STATUS = /\b(?:always|failure|cancelled)\(/;
+
+function conjuncts(body) {
+  const terms = [];
+  let depth = 0, quoted = false, start = 0;
+  for (let index = 0; index < body.length; index++) {
+    const char = body[index];
+    if (char === "'") quoted = !quoted;
+    else if (!quoted && (char === '(' || char === ')')) depth += char === '(' ? 1 : -1;
+    else if (!quoted && !depth && body.startsWith('&&', index)) {
+      terms.push(body.slice(start, index).trim());
+      start = ++index + 1;
+    }
+  }
+  return [...terms, body.slice(start).trim()];
+}
+
+function modeChange(file, change, ownMode) {
+  const [jobs, job, steps, items, name, key] = change.path;
+  if (file !== 'deploy.yml' || jobs !== 'jobs' || job !== 'android' || steps !== 'steps' || items !== 'items'
+      || ownMode) return change;
+  const step = change.path.length === 5 && change.value && typeof change.value === 'object';
+  const condition = step ? change.value.if : change.path.length === 6 && key === 'if' ? change.value : null;
+  if (typeof condition !== 'string' || !USES_MODE.test(condition)) return change;
+  const terms = conjuncts(condition.trim().replace(/^\$\{\{([\s\S]*)\}\}$/, '$1').trim())
+    .filter(term => !MODE.test(term));
+  if (terms.some(term => USES_MODE.test(term) || STATUS.test(term))) {
+    throw new MigrationRepair('android_mode_condition_requires_edit', file, change.path);
+  }
+  console.log(`  Migrated ${file} android step ${name}: dropped steps.mode (step deleted in 1.0.168)`);
+  const migrated = terms.length ? `\${{ ${terms.join(' && ')} }}` : undefined;
+  if (!step) return migrated === undefined ? { path: change.path, remove: true } : { ...change, value: migrated };
+  return { ...change, value: Object.fromEntries(Object.entries(change.value).flatMap(([field, value]) =>
+    field !== 'if' ? [[field, value]] : migrated === undefined ? [] : [[field, migrated]])) };
+}
+
 export function mergeChanges(base, incoming, changes, file) {
   const result = structuredClone(incoming);
-  for (const change of changes) {
+  const ownMode = changes.some(change => equal(change.path, ['jobs', 'android', 'steps', 'items', 'id:mode']));
+  for (const raw of changes) {
+    const change = modeChange(file, raw, ownMode);
     const before = at(base, change.path), after = at(incoming, change.path);
     if (change.path.at(-1) === 'order' && Array.isArray(before) && Array.isArray(after)) {
       assign(result, { path: change.path, value: mergeOrder(before, change.value, after, file, change.path) });

package/src/config/workflows.mjs

@@ -35,13 +35,16 @@ function render(source, normalized, file) {
   return doc.toString({ lineWidth: 120 });
 }
 
-// deploy-web.yml is no longer installed: a copy still identical to what the lock
-// says was generated, with no overrides, is removed. Anything customized stays.
+const WARM = 'warm-android-cache.yml';
+const MANAGED = ['deploy.yml', 'mobile-candidate.yml', 'deploy-web.yml', 'deploy-backend.yml', WARM];
+
+// A generated file this install no longer wants (deploy-web.yml always; the warm-up without
+// candidates) is removed while it is still what the lock says was generated, with no overrides.
+// Anything customized stays and keeps upgrading.
 function retired(root, file, state) {
-  if (file !== 'deploy-web.yml' || state.migrating) return false;
+  if (state.migrating || state.config.workflows[file]?.overrides?.length) return false;
   const previous = load(root, `.github/workflows/${file}`);
-  return !state.config.workflows[file]?.overrides?.length
-    && (previous === null || digest(previous) === state.lock.workflows[file]?.generated);
+  return previous === null || digest(previous) === state.lock.workflows[file]?.generated;
 }
 
 function upgradeWorkflow(root, file, templateDir, state) {
@@ -81,23 +84,31 @@ export function planWorkflows(root, templateDir, files, version) {
   const state = configState(root);
   const selected = [...new Set([...files, ...Object.keys(state.config.workflows)])];
   for (const file of selected) {
-    if (!['deploy.yml', 'mobile-candidate.yml', 'deploy-web.yml', 'deploy-backend.yml'].includes(file)) {
-      throw new MigrationRepair('unknown_managed_workflow', CONFIG);
-    }
+    if (!MANAGED.includes(file)) throw new MigrationRepair('unknown_managed_workflow', CONFIG);
+  }
+  const removed = selected.filter(file => file === 'deploy-web.yml' && retired(root, file, state));
+  const writes = selected.filter(file => !removed.includes(file) && file !== WARM)
+    .map(file => upgradeWorkflow(root, file, templateDir, state));
+  // Main's warm Android build cache serves Android candidates, so it follows them; deploy.yml has
+  // just settled whether this app builds candidates at all. An iOS-only app builds no Android one.
+  const candidates = selected.includes('mobile-candidate.yml')
+    && state.config.mobile?.['candidate-artifacts'] !== false
+    && String(state.config.mobile?.platforms ?? '').trim() !== 'ios';
+  if (candidates || (selected.includes(WARM) && !retired(root, WARM, state))) {
+    writes.push(upgradeWorkflow(root, WARM, templateDir, state));
+  } else if (selected.includes(WARM)) {
+    removed.push(WARM);
   }
-  const removed = selected.filter(file => retired(root, file, state));
   for (const file of removed) {
     delete state.config.workflows[file];
     delete state.lock.workflows[file];
   }
-  const writes = selected.filter(file => !removed.includes(file))
-    .map(file => upgradeWorkflow(root, file, templateDir, state));
   writes.push(...removed.map(file => ({ file: `.github/workflows/${file}`, content: null })));
   assertReferences(state.config, CONFIG);
   for (const [file, entry] of Object.entries(state.config.workflows)) {
     for (const change of entry.overrides) assertReferences(change.value, file, change.path);
   }
-  writes.push(...planValidation(root, selected));
+  writes.push(...planValidation(root, [...selected, WARM]));
   state.lock.package = version;
   const config = state.text && equal(readYaml(state.text, CONFIG).value, state.config)
     ? state.text

package/templates/warm-android-cache.yml

@@ -0,0 +1,256 @@
+name: Warm Android build cache
+
+# Candidates restore only what the default branch saved, and a release that promotes its
+# candidate compiles nothing, so main may hold no Gradle cache for the inputs candidates build.
+# After this app's own default-branch release that included Android succeeds, this compiles the
+# Android bundle once, unsigned, when main has no entry for the android job's Gradle key. It runs on
+# no other event: never on a candidate, a dispatch or a schedule. Installed only with candidates.
+on:
+  workflow_run:
+    workflows: [Mobile Deploy]
+    types: [completed]
+
+permissions:
+  contents: read
+
+jobs:
+  warm:
+    name: Warm Android build cache
+    if: >-
+      ${{ github.event.workflow_run.conclusion == 'success'
+          && github.event.workflow_run.event == 'push'
+          && github.event.workflow_run.head_branch == github.event.repository.default_branch
+          && contains(fromJSON('["both", "android"]'), vars.DEPLOY_PLATFORMS || 'both') }}
+    # The android job's runner, so the Gradle key's OS/architecture and cache paths match it.
+    runs-on: ${{ vars.ANDROID_RUNNER || 'ubuntu-24.04' }}
+    # workflow_run gets a read-only cache token unless the job asks for write. This job runs
+    # only for the repository's own default-branch push and builds that exact commit.
+    cache-mode: write
+    concurrency:
+      group: warm-android-cache
+      cancel-in-progress: false
+    # A backstop only: each long step is bounded below, so a cold build never reaches it.
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        continue-on-error: true
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+      # Only a release whose intent names Android built or promoted an Android binary.
+      - name: Check that this release included Android
+        id: intent
+        continue-on-error: true
+        shell: bash
+        run: |
+          if node -e "process.exit(require('./.factory/releases/mobile.json').platforms?.android ? 0 : 1)" 2>/dev/null; then
+            echo "android=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "This release built no Android binary: nothing to warm."
+          fi
+      # Linux only, like the android job's disk and heap steps (GNU timeout, df, /proc).
+      - name: Retain Gradle cache scope
+        id: gradle_scope
+        if: ${{ steps.intent.outputs.android == 'true' && runner.os == 'Linux' }}
+        continue-on-error: true
+        shell: bash
+        run: |
+          node .github/actions/android-app/scripts/cache_scope.cjs --snapshot
+          node - <<'NODE'
+          require('fs').appendFileSync(process.env.GITHUB_OUTPUT,
+            `home=${require('os').homedir()}\narch=${process.arch}\n`);
+          NODE
+      # The android job's exact key. GitHub also matches it as a prefix, so an earlier warm-up
+      # (`-warm-`) or failed release (`-partial-`) of the same inputs counts as present. A lookup
+      # that times out stops the warm-up; one the cache service rejects reads as a miss (the
+      # pinned action logs the error and reports no match), costing one build and a duplicate entry.
+      - name: Look up the default branch's Gradle cache
+        id: gradle_lookup
+        if: ${{ steps.gradle_scope.outcome == 'success' }}
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25
+        continue-on-error: true
+        timeout-minutes: 2
+        env:
+          NODE_OPTIONS: --require "${{ steps.gradle_scope.outputs.preloader }}"
+          SEGMENT_DOWNLOAD_TIMEOUT_MINS: '1'
+        with:
+          lookup-only: true
+          path: |
+            ${{ steps.gradle_scope.outputs.home }}/.gradle/caches
+            ${{ steps.gradle_scope.outputs.home }}/.gradle/wrapper
+          key: >-
+            ${{ format('setup-java-{0}-{1}-gradle-{2}', runner.os, steps.gradle_scope.outputs.arch,
+                hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'buildSrc/**/Versions.kt',
+                'buildSrc/**/Dependencies.kt', 'gradle/*.versions.toml', '**/versions.properties')) }}
+      # Only a lookup that ended without a match goes on. An empty kind: no Android project.
+      - name: Resolve the Android build inputs
+        id: build_inputs
+        if: >-
+          ${{ steps.gradle_lookup.outcome == 'success'
+              && steps.gradle_lookup.outputs.cache-matched-key == '' }}
+        continue-on-error: true
+        shell: bash
+        run: python3 .github/actions/android-app/scripts/android_config.py
+      # The android job's own setup steps follow; only `if`, ids and failure bounds differ.
+      - name: Detect Flutter
+        id: flutter
+        if: ${{ steps.build_inputs.outputs.project_kind != '' }}
+        shell: bash
+        run: |
+          if [ -f pubspec.yaml ]; then
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Free runner disk space
+        if: ${{ steps.build_inputs.outputs.project_kind != '' }}
+        shell: bash
+        run: |
+          df -h / | tail -1
+          if [ "$(df --output=avail -BG / | tail -1 | tr -dc 0-9)" -ge 40 ]; then exit 0; fi
+          # NOT /usr/local/lib/node_modules: npm and npx live there, and the
+          # Android action's Crashlytics symbol upload shells out to npx.
+          # Keep installed Android SDK/NDKs: removing them makes AGP download them again.
+          unused="/usr/share/dotnet /opt/ghc /usr/local/.ghcup /usr/local/share/powershell"
+          unused="$unused /usr/share/swift /usr/local/share/chromium"
+          nohup sudo sh -c "rm -rf $unused; docker image prune --all --force" >/dev/null 2>&1 </dev/null &
+      - name: Choose the JDK for this build
+        id: jdk
+        if: ${{ steps.build_inputs.outputs.project_kind != '' }}
+        shell: bash
+        env:
+          JAVA_VERSION: ${{ vars.JAVA_VERSION }}
+          FLUTTER_ENABLED: ${{ steps.flutter.outputs.enabled }}
+        run: |
+          # Never let a chooser bug take down every Android job: fall back to the
+          # JDK this workflow used before the chooser existed.
+          if ! python3 .github/actions/android-app/scripts/select_jdk.py; then
+            echo "::warning::select_jdk.py failed; falling back"
+            if [ "${FLUTTER_ENABLED}" = "true" ]; then fallback=17; else fallback=21; fi
+            echo "version=${fallback}" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Set up Java
+        id: java
+        if: ${{ steps.build_inputs.outputs.project_kind != '' }}
+        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
+        continue-on-error: true
+        timeout-minutes: 5
+        with:
+          distribution: temurin
+          java-version: ${{ steps.jdk.outputs.version }}
+      - name: Set up Flutter
+        id: flutter_setup
+        if: ${{ steps.flutter.outputs.enabled == 'true' }}
+        uses: ./.github/actions/android-app/flutter-setup
+        continue-on-error: true
+        timeout-minutes: 10
+        with:
+          channel: stable
+          cache: true
+      - name: Authenticate private git dependencies
+        if: ${{ steps.flutter.outputs.enabled == 'true' }}
+        shell: bash
+        env:
+          GIT_PRIVATE_TOKEN: ${{ secrets.GIT_PRIVATE_TOKEN }}
+        run: |
+          if [ -z "${GIT_PRIVATE_TOKEN:-}" ]; then
+            echo "No GIT_PRIVATE_TOKEN secret; private git dependencies must carry their own credentials."
+            exit 0
+          fi
+          echo "::add-mask::$GIT_PRIVATE_TOKEN"
+          git config --global \
+            url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
+          echo "Configured authenticated github.com remotes for pub."
+      - name: Cap the Gradle daemon heap for this runner
+        if: ${{ steps.build_inputs.outputs.project_kind != '' }}
+        shell: bash
+        env:
+          MAX_HEAP_GB: '4'
+          MAX_META_GB: '2'
+        run: |
+          if awk '/^MemTotal:/ { kb = $2 } END { exit !(kb >= 16777216) }' /proc/meminfo; then exit 0; fi
+          shopt -s nullglob
+          for f in android/gradle.properties gradle.properties; do
+            [ -f "$f" ] || continue
+            before=$(grep -m1 '^org.gradle.jvmargs' "$f" || true)
+            [ -n "$before" ] || continue
+            heap=$(sed -nE 's/.*-Xmx([0-9]+)[Gg].*/\1/p' <<<"$before")
+            meta=$(sed -nE 's/.*MaxMetaspaceSize=([0-9]+)[Gg].*/\1/p' <<<"$before")
+            changed=""
+            if [ -n "$heap" ] && [ "$heap" -gt "$MAX_HEAP_GB" ]; then
+              sed -i -E "s/-Xmx${heap}[Gg]/-Xmx${MAX_HEAP_GB}G/" "$f"; changed=1
+            fi
+            if [ -n "$meta" ] && [ "$meta" -gt "$MAX_META_GB" ]; then
+              sed -i -E "s/MaxMetaspaceSize=${meta}[Gg]/MaxMetaspaceSize=${MAX_META_GB}G/" "$f"; changed=1
+            fi
+            if [ -n "$changed" ]; then
+              echo "::warning::$f asked for more heap than this runner has; capped it for this build only ($before)"
+              grep -m1 '^org.gradle.jvmargs' "$f"
+            fi
+          done
+      - name: Generate localizations
+        if: ${{ steps.flutter.outputs.enabled == 'true' }}
+        continue-on-error: true
+        timeout-minutes: 5
+        shell: bash
+        run: |
+          if [ -f l10n.yaml ]; then
+            flutter pub get
+            flutter gen-l10n
+          fi
+      # What a candidate compiles, with no credentials, signing, version write, store read or
+      # upload: an init script outside the cached paths disables every upload task. The compiler's
+      # output stays inert and it stops within 30 minutes.
+      - name: Build the release bundle without signing it
+        id: build
+        if: >-
+          ${{ steps.java.outcome == 'success'
+              && (steps.flutter.outputs.enabled != 'true' || steps.flutter_setup.outcome == 'success') }}
+        continue-on-error: true
+        shell: bash
+        working-directory: ${{ steps.build_inputs.outputs.gradle_root || '.' }}
+        env:
+          PROJECT_KIND: ${{ steps.build_inputs.outputs.project_kind }}
+          GRADLE_MODULE: ${{ steps.build_inputs.outputs.gradle_module }}
+        run: |
+          mkdir -p "$HOME/.gradle/init.d"
+          cat > "$HOME/.gradle/init.d/gowalk-no-uploads.gradle" <<'GRADLE'
+          gradle.beforeProject { project ->
+              project.tasks.configureEach { task ->
+                  def name = task.name.toLowerCase()
+                  if (name.contains('upload') || name.startsWith('bugsnagrelease')) task.enabled = false
+              }
+          }
+          GRADLE
+          if [ "$PROJECT_KIND" = flutter ]; then
+            python3 .github/actions/android-app/scripts/android_config.py --flutter-toolchain
+            build=(flutter build appbundle --release --obfuscate --split-debug-info "$RUNNER_TEMP/dart-symbols/android")
+          else
+            chmod +x ./gradlew
+            build=(./gradlew "${GRADLE_MODULE}:bundleRelease" --console=plain)
+          fi
+          token=$(openssl rand -hex 16)
+          echo "::stop-commands::$token"
+          status=0
+          timeout -k 30 30m "${build[@]}" || status=$?
+          echo "::$token::"
+          echo "status=$status" >> "$GITHUB_OUTPUT"
+          echo "Build exit status $status (124: stopped at 30 minutes)."
+          exit "$status"
+      # Only a finished build or one stopped at 30 minutes saves: an early failure (the candidate
+      # compiled this commit, so a transient fault) saves nothing, and the next release retries.
+      # Never the android job's exact key: a real default-branch build still saves that one,
+      # which replaces whatever this warm-up compiled differently.
+      - name: Save Gradle dependencies
+        if: ${{ always() && (steps.build.outputs.status == '0' || steps.build.outputs.status == '124') }}
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25
+        continue-on-error: true
+        timeout-minutes: 2
+        env:
+          NODE_OPTIONS: --require "${{ steps.gradle_scope.outputs.preloader }}"
+        with:
+          path: |
+            ${{ steps.gradle_scope.outputs.home }}/.gradle/caches
+            ${{ steps.gradle_scope.outputs.home }}/.gradle/wrapper
+          key: >-
+            ${{ format('{0}-warm-{1}-{2}', steps.gradle_lookup.outputs.cache-primary-key,
+                github.run_id, github.run_attempt) }}