gowalk-cicd 1.0.2 → 1.0.4

package/CLAUDE.md

@@ -2,11 +2,11 @@
 
 ## Purpose
 
-npm package that distributes iOS TestFlight and Flutter Android Google Play
-actions. Consumer runs `npx gowalk-cicd` and gets:
+npm package that distributes iOS TestFlight and Android Google Play actions.
+Consumer runs `npx gowalk-cicd` and gets:
 
 - `.github/actions/swift-app/` — vendored composite action
-- `.github/actions/android-app/` — vendored Flutter Android action
+- `.github/actions/android-app/` — vendored Android action (Flutter or Gradle)
 - `.github/workflows/deploy.yml` — dual-platform workflow
 
 Re-running the command is both install and update. No scope flag, no
@@ -20,7 +20,7 @@ gowalk-cicd/                     ← repo root IS the gowalk-cicd package
 │   ├── action.yml
 │   └── scripts/*.py
 ├── android-action/              ← Android action — canonical source of truth
-│   ├── action.yml
+│   ├── action.yml               ← branches on project kind (flutter | gradle)
 │   └── scripts/*.py
 ├── bin/cli.mjs                  ← CLI entrypoint (parses flags, calls runInstall)
 ├── src/install.mjs              ← copy logic, gitignore-check, summary print
@@ -92,3 +92,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Detect and warn, tell the user to remove lines manually.
 - Store API calls belong in GitHub Actions. Local tests may build/sign but must
   never connect to App Store Connect or Google Play.
+- The Android action serves two build systems. `android_config.project_kind()`
+  is the only place that decides which; every downstream step branches on the
+  `project_kind` output rather than re-sniffing the repo. Flutter wins the tie
+  because a Flutter app also carries `android/settings.gradle`.
+- Version stamping is per-build-system: Flutter takes `--build-number`, Gradle
+  has no equivalent, so `set_gradle_version()` rewrites the literal in the
+  checkout the way the iOS action patches the pbxproj. Never commit that edit.

package/README.md

@@ -1,8 +1,9 @@
 # gowalk-cicd
 
 One installer for iOS TestFlight and Android Google Play delivery. It supports
-native Swift/SwiftUI iOS projects and Flutter apps. Put the platform keys under
-`creds/`, push to `main`, and both store builds run only on GitHub Actions.
+native Swift/SwiftUI iOS projects, native Kotlin/Gradle Android projects, and
+Flutter apps. Put the platform keys under `creds/`, push to `main`, and both
+store builds run only on GitHub Actions.
 
 ## Install
 
@@ -15,7 +16,7 @@ npx --yes gowalk-cicd
 Writes three things into your repo:
 
 - `.github/actions/swift-app/` — the vendored composite action (action.yml + scripts)
-- `.github/actions/android-app/` — Flutter Android build/sign action
+- `.github/actions/android-app/` — Android build/sign action (Flutter or Gradle)
 - `.github/workflows/deploy.yml` — workflow that builds and deploys both platforms
 
 Re-run the same command anytime to pull the latest version.
@@ -56,6 +57,9 @@ Place these files under `creds/`:
    (`Gowalk.json` is valid); the action identifies it by the
    `type: service_account` JSON fields.
 
+These are the same three files whether the app is Flutter or native
+Kotlin/Gradle — see [Android: Flutter or native Gradle](#android-flutter-or-native-gradle).
+
 The service account must have Google Play Console access to the app and the
 Android Publisher API must be enabled. Keep the repository private. The
 workflow reads these files from the checkout, so they must be available to
@@ -129,11 +133,34 @@ create a fresh cert.
 
 ## How it works
 
-On every push, iOS and Android run in parallel. Flutter is installed only on
-the GitHub-hosted runners. The Android job runs `flutter analyze`,
-`flutter test`, builds an AAB with `GITHUB_RUN_NUMBER` as its monotonically
-increasing version code, replaces any development signature with the upload
-key, and retains the signed bundle before contacting Google Play.
+On every push, iOS and Android run in parallel. The Android job builds an AAB
+with `GITHUB_RUN_NUMBER` as its monotonically increasing version code, replaces
+any development signature with the upload key, and retains the signed bundle
+before contacting Google Play.
+
+### Android: Flutter or native Gradle
+
+The Android action detects which build system to drive and needs no
+configuration for either:
+
+| | Flutter | Native Gradle |
+|---|---|---|
+| Detected by | `pubspec.yaml` at the repo root | `settings.gradle(.kts)` + `gradlew` at the root or under `android/` |
+| App module | `android/app` | the one module applying `com.android.application` (version-catalog aliases are resolved; a module named `app` wins a tie against a wear/automotive sibling) |
+| Tests (`run-tests`) | `flutter analyze` + `flutter test` | `<module>:testReleaseUnitTest` |
+| Build | `flutter build appbundle --release` | `<module>:bundleRelease` |
+| Toolchain installed | Flutter + JDK 17 | JDK 21 only |
+
+A Flutter app also carries `android/settings.gradle`, so `pubspec.yaml` wins the
+tie — Flutter apps must be built through the Flutter tool.
+
+Gradle has no equivalent of `flutter build --build-number`, so the action
+rewrites the literal `versionCode` (and `versionName`, when `build-name` is
+set) in the app module's build file inside the CI checkout — the Gradle
+counterpart to the iOS action patching the `.pbxproj`. The edit is never
+committed back. If the module computes its `versionCode` instead of declaring a
+literal, the action emits a `::warning::` and leaves the project's own value
+alone.
 
 ### iOS delivery
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.2
+1.0.4

package/action/scripts/test_write_marketing_version.py

@@ -0,0 +1,101 @@
+#!/usr/bin/env python3
+"""Where write_marketing_version() persists the bump.
+
+The interesting case is a repo that keeps an xcodegen spec *and* commits the
+generated .xcodeproj: auto_detect only runs `xcodegen generate` when no
+.xcodeproj is present, so a bump written to the spec alone never reaches
+xcodebuild and the archive ships the stale version.
+"""
+
+from __future__ import annotations
+
+import os
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import version_utils
+
+
+PBXPROJ = """// !$*UTF8*$!
+{
+\t\t\t\tCURRENT_PROJECT_VERSION = 1;
+\t\t\t\tMARKETING_VERSION = 0.1.0;
+}
+"""
+
+SPEC = """name: EmreForms
+targets:
+  EmreForms:
+    settings:
+      base:
+        MARKETING_VERSION: 0.1.0
+"""
+
+
+class WriteMarketingVersionTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temp = tempfile.TemporaryDirectory()
+        self.root = Path(self.temp.name)
+        self.project = self.root / "EmreForms.xcodeproj"
+        self.project.mkdir()
+        self.pbxproj = self.project / "project.pbxproj"
+        self.pbxproj.write_text(PBXPROJ, encoding="utf-8")
+        self.spec = self.root / "project.yml"
+        self.previous = Path.cwd()
+        os.chdir(self.root)
+        self.env = mock.patch.dict(
+            os.environ,
+            {"PROJECT": str(self.project), "WORKSPACE": "", "RUNNER_TEMP": ""},
+        )
+        self.env.start()
+        # _record_bumped_path shells out to `git add`; irrelevant here.
+        self.record = mock.patch.object(version_utils, "_record_bumped_path")
+        self.record.start()
+
+    def tearDown(self) -> None:
+        self.record.stop()
+        self.env.stop()
+        os.chdir(self.previous)
+        self.temp.cleanup()
+
+    def test_spec_and_committed_pbxproj_are_kept_in_sync(self) -> None:
+        self.spec.write_text(SPEC, encoding="utf-8")
+
+        self.assertTrue(version_utils.write_marketing_version("0.2.0"))
+
+        self.assertIn("MARKETING_VERSION: 0.2.0", self.spec.read_text())
+        self.assertIn("MARKETING_VERSION = 0.2.0;", self.pbxproj.read_text())
+
+    def test_pbxproj_alone_is_written_without_a_spec(self) -> None:
+        self.assertTrue(version_utils.write_marketing_version("0.2.0"))
+
+        self.assertIn("MARKETING_VERSION = 0.2.0;", self.pbxproj.read_text())
+
+    def test_spec_write_still_succeeds_without_a_generated_project(self) -> None:
+        # The usual xcodegen flow: the .xcodeproj is gitignored, so there is
+        # nothing to sync and the spec is the only source of truth.
+        self.spec.write_text(SPEC, encoding="utf-8")
+        self.pbxproj.unlink()
+
+        self.assertTrue(version_utils.write_marketing_version("0.2.0"))
+
+        self.assertIn("MARKETING_VERSION: 0.2.0", self.spec.read_text())
+
+    def test_refuses_the_pbxproj_when_the_spec_lacks_the_key(self) -> None:
+        # Unchanged behaviour: a spec that does not declare MARKETING_VERSION
+        # means we cannot tell where the value really lives, so we refuse
+        # rather than edit a file the next regenerate would overwrite.
+        self.spec.write_text("name: EmreForms\n", encoding="utf-8")
+
+        with mock.patch.object(
+            version_utils, "_write_xcconfig_marketing_version", return_value=False
+        ):
+            self.assertFalse(version_utils.write_marketing_version("0.2.0"))
+
+        self.assertIn("MARKETING_VERSION = 0.1.0;", self.pbxproj.read_text())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/version_utils.py

@@ -269,9 +269,11 @@ def _write_pbxproj_marketing_version(pbx: Path, new_version: str) -> bool:
     ``MARKETING_VERSION = <new_version>;``. Returns True when at least
     one substitution happened, False otherwise.
 
-    SAFETY: caller MUST have ruled out xcodegen first. Editing a
-    generated pbxproj is futile when ``project.yml`` is the source of
-    truth -- the next ``xcodegen generate`` would wipe the bump."""
+    SAFETY: caller MUST have written the xcodegen spec first when one
+    exists. On its own this edit is futile for a generated pbxproj --
+    the next ``xcodegen generate`` wipes it -- so with a spec present
+    it is only ever a *sync* of a value already persisted in the real
+    source of truth, never a substitute for writing that source."""
     text = pbx.read_text(encoding="utf-8")
     new_text, count = _MARKETING_LINE.subn(
         rf"\g<1>MARKETING_VERSION = {new_version};", text,
@@ -361,6 +363,14 @@ def write_marketing_version(new_version: str) -> bool:
              if (d / name).is_file()]
     for spec in specs:
         if _write_yaml_marketing_version(spec, new_version):
+            # Repos that commit BOTH the spec and the generated .xcodeproj
+            # archive from the pbxproj -- auto_detect only runs `xcodegen
+            # generate` when no .xcodeproj is present -- so the spec write
+            # alone would never reach xcodebuild. Sync the pbxproj too; a
+            # later regenerate produces the same value either way.
+            pbx = _resolve_pbxproj_path()
+            if pbx is not None:
+                _write_pbxproj_marketing_version(pbx, new_version)
             return True
     if _write_xcconfig_marketing_version(new_version):
         return True

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.2
+1.0.4

package/android-action/action.yml

@@ -1,8 +1,9 @@
-name: Flutter Android build and signing
+name: Android build and signing
 description: >
-  Auto-detect a Flutter Android app, build a release AAB, and sign it with
-  the upload key stored under creds/. Google Play upload is handled by the
-  package workflow so the signed artifact is always retained first.
+  Auto-detect an Android app — Flutter or native Gradle — build a release AAB,
+  and sign it with the upload key stored under creds/. Google Play upload is
+  handled by the package workflow so the signed artifact is always retained
+  first.
 
 inputs:
   package-name:
@@ -10,15 +11,22 @@ inputs:
     required: false
     default: ""
   build-number:
-    description: Android versionCode override; defaults to GITHUB_RUN_NUMBER
+    description: >-
+      Android versionCode override. When unset, the action uses
+      max(GITHUB_RUN_NUMBER, highest versionCode already on Play + 1), so a repo whose
+      CI run numbers start at 1 cannot collide with codes Play already holds.
     required: false
     default: ""
   build-name:
-    description: Flutter versionName override; defaults to pubspec.yaml
+    description: >-
+      versionName override; defaults to pubspec.yaml (Flutter) or the value
+      declared in the module's build.gradle (native Gradle)
     required: false
     default: ""
   run-tests:
-    description: Run flutter analyze and flutter test before the release build
+    description: >-
+      Run the project's analyzer and unit tests before the release build
+      (flutter analyze + flutter test, or the Gradle module's unit tests)
     required: false
     default: "true"
 
@@ -35,33 +43,54 @@ outputs:
   play-service-account:
     description: Path to the discovered Google Play service-account JSON
     value: ${{ steps.config.outputs.service_account }}
+  project-kind:
+    description: Detected build system — `flutter` or `gradle`
+    value: ${{ steps.config.outputs.project_kind }}
 
 runs:
   using: composite
   steps:
+    # resolve_android.py asks Google Play for the highest versionCode already
+    # uploaded, so it needs these. Installing them here (rather than relying on the
+    # caller) keeps the action self-contained.
+    - name: Install Play API dependencies
+      shell: bash
+      run: python3 -m pip install --disable-pip-version-check -q 'google-auth>=2.40,<3' 'requests>=2.32,<3' || true
+
     - name: Resolve Android app and credentials
       id: config
       shell: bash
       env:
         INPUT_PACKAGE_NAME: ${{ inputs.package-name }}
         INPUT_BUILD_NUMBER: ${{ inputs.build-number }}
+        INPUT_BUILD_NAME: ${{ inputs.build-name }}
       run: python3 "${{ github.action_path }}/scripts/resolve_android.py"
 
+    # --- Flutter --------------------------------------------------------
     - name: Get Flutter dependencies
+      if: ${{ steps.config.outputs.project_kind == 'flutter' }}
       shell: bash
       run: flutter pub get
 
     - name: Analyze Flutter app
-      if: ${{ inputs.run-tests == 'true' }}
+      if: ${{ steps.config.outputs.project_kind == 'flutter' && inputs.run-tests == 'true' }}
       shell: bash
       run: flutter analyze
 
+    # `flutter test` hard-fails with "Test directory \"test\" not found" when a repo
+    # has no tests, which is not a real failure. Skip instead of blowing up the deploy.
     - name: Test Flutter app
-      if: ${{ inputs.run-tests == 'true' }}
+      if: ${{ steps.config.outputs.project_kind == 'flutter' && inputs.run-tests == 'true' }}
       shell: bash
-      run: flutter test
+      run: |
+        if [ -d test ]; then
+          flutter test
+        else
+          echo "No test/ directory; skipping flutter test."
+        fi
 
     - name: Build release Android App Bundle
+      if: ${{ steps.config.outputs.project_kind == 'flutter' }}
       shell: bash
       env:
         BUILD_NAME: ${{ inputs.build-name }}
@@ -76,6 +105,27 @@ runs:
         fi
         flutter "${args[@]}"
 
+    # --- Native Gradle --------------------------------------------------
+    # resolve_android.py has already rewritten versionCode/versionName in the
+    # module build file, so these are plain Gradle invocations with no extra
+    # properties for the project to have to opt into reading.
+    - name: Test Android app
+      if: ${{ steps.config.outputs.project_kind == 'gradle' && inputs.run-tests == 'true' }}
+      shell: bash
+      working-directory: ${{ steps.config.outputs.gradle_root || '.' }}
+      run: |
+        chmod +x ./gradlew
+        ./gradlew "${ANDROID_GRADLE_MODULE}:testReleaseUnitTest" --console=plain --stacktrace
+
+    - name: Build release Android App Bundle with Gradle
+      if: ${{ steps.config.outputs.project_kind == 'gradle' }}
+      shell: bash
+      working-directory: ${{ steps.config.outputs.gradle_root || '.' }}
+      run: |
+        chmod +x ./gradlew
+        ./gradlew "${ANDROID_GRADLE_MODULE}:bundleRelease" --console=plain --stacktrace
+
+    # --- Shared ---------------------------------------------------------
     - name: Locate Android App Bundle
       id: bundle
       shell: bash

package/android-action/scripts/android_config.py

@@ -22,6 +22,28 @@ class SigningConfig:
     key_alias: str
 
 
+@dataclass(frozen=True)
+class GradleProject:
+    """A native (non-Flutter) Android project and its application module.
+
+    ``root`` is the directory holding ``settings.gradle(.kts)`` and ``gradlew``
+    — the repo root for a standalone Android repo, ``android/`` for a repo that
+    keeps the Android app beside another platform's sources.
+    """
+
+    root: Path
+    module: str
+    build_file: Path
+
+    @property
+    def module_dir(self) -> Path:
+        return self.build_file.parent
+
+    @property
+    def gradlew(self) -> Path:
+        return self.root / "gradlew"
+
+
 def parse_properties(path: Path) -> dict[str, str]:
     values: dict[str, str] = {}
     for line_number, raw_line in enumerate(path.read_text().splitlines(), start=1):
@@ -97,34 +119,188 @@ def find_play_service_account(workspace: Path) -> Path:
     return _single(matches, "Google Play service-account JSON")
 
 
-def detect_package_name(workspace: Path) -> str:
-    gradle_files = (
-        workspace / "android" / "app" / "build.gradle.kts",
-        workspace / "android" / "app" / "build.gradle",
+APPLICATION_ID_PATTERNS = (
+    re.compile(r"\bapplicationId\s*=\s*[\"']([^\"']+)[\"']"),
+    re.compile(r"\bapplicationId\s+[\"']([^\"']+)[\"']"),
+)
+
+SETTINGS_FILES = ("settings.gradle.kts", "settings.gradle")
+BUILD_FILES = ("build.gradle.kts", "build.gradle")
+
+# Where the Android Gradle build can live relative to the repo root. A repo
+# that is nothing but an Android app puts it at the root; a repo that also
+# holds an iOS app (or any other platform) conventionally nests it in android/.
+GRADLE_ROOT_CANDIDATES = (".", "android")
+
+
+def project_kind(workspace: Path) -> str:
+    """``flutter`` when a pubspec.yaml drives the build, else ``gradle``.
+
+    Flutter wins the tie deliberately: a Flutter app also carries
+    ``android/settings.gradle``, but it must be built through the Flutter tool,
+    not by invoking Gradle directly.
+    """
+    return "flutter" if (workspace / "pubspec.yaml").is_file() else "gradle"
+
+
+def _first_existing(directory: Path, names: tuple[str, ...]) -> Path | None:
+    for name in names:
+        candidate = directory / name
+        if candidate.is_file():
+            return candidate
+    return None
+
+
+def find_gradle_root(workspace: Path) -> Path:
+    for relative in GRADLE_ROOT_CANDIDATES:
+        candidate = (workspace / relative).resolve()
+        if _first_existing(candidate, SETTINGS_FILES) and (candidate / "gradlew").is_file():
+            return candidate
+    raise ConfigError(
+        "no Gradle build found: expected settings.gradle(.kts) and gradlew "
+        "at the repo root or under android/"
     )
-    patterns = (
-        re.compile(r"\bapplicationId\s*=\s*[\"']([^\"']+)[\"']"),
-        re.compile(r"\bapplicationId\s+[\"']([^\"']+)[\"']"),
+
+
+def _catalog_application_aliases(gradle_root: Path) -> set[str]:
+    """Version-catalog plugin aliases that resolve to com.android.application.
+
+    Modules increasingly declare the plugin as ``alias(libs.plugins.foo)``,
+    which says nothing about the plugin id on its own — that lives in
+    ``gradle/libs.versions.toml``. Without resolving it we cannot tell the
+    application module from a library module.
+    """
+    catalog = gradle_root / "gradle" / "libs.versions.toml"
+    if not catalog.is_file():
+        return set()
+    aliases: set[str] = set()
+    in_plugins = False
+    for raw_line in catalog.read_text().splitlines():
+        line = raw_line.strip()
+        if line.startswith("["):
+            in_plugins = line.replace(" ", "") == "[plugins]"
+            continue
+        if not in_plugins or "=" not in line:
+            continue
+        alias, _, definition = line.partition("=")
+        if re.search(r"""id\s*=\s*["']com\.android\.application["']""", definition):
+            # Gradle exposes `my-plugin` / `my_plugin` as `libs.plugins.my.plugin`.
+            aliases.add(re.sub(r"[-_]", ".", alias.strip()))
+    return aliases
+
+
+def _declares_application_plugin(build_file: Path, aliases: set[str]) -> bool:
+    for raw_line in build_file.read_text().splitlines():
+        line = raw_line.split("//", 1)[0]
+        # `apply false` in a root build file only declares the plugin's version
+        # for subprojects; it does not make that project an Android application.
+        if "apply false" in line:
+            continue
+        if "com.android.application" in line:
+            return True
+        match = re.search(r"alias\s*\(\s*libs\.plugins\.([A-Za-z0-9_.]+)\s*\)", line)
+        if match and match.group(1) in aliases:
+            return True
+    return False
+
+
+def _module_candidates(gradle_root: Path) -> list[Path]:
+    directories = sorted(
+        path
+        for path in gradle_root.iterdir()
+        if path.is_dir() and not path.name.startswith(".") and path.name != "buildSrc"
     )
+    return [path for path in directories if _first_existing(path, BUILD_FILES)]
+
+
+def find_gradle_project(workspace: Path) -> GradleProject:
+    root = find_gradle_root(workspace)
+    aliases = _catalog_application_aliases(root)
+    matches: list[Path] = []
+    for directory in _module_candidates(root):
+        build_file = _first_existing(directory, BUILD_FILES)
+        if build_file and _declares_application_plugin(build_file, aliases):
+            matches.append(build_file)
+    if not matches:
+        raise ConfigError(
+            f"no module under {root.name}/ applies com.android.application; "
+            "cannot tell which module is the app"
+        )
+    if len(matches) > 1:
+        preferred = [path for path in matches if path.parent.name == "app"]
+        if len(preferred) != 1:
+            names = ", ".join(sorted(path.parent.name for path in matches))
+            raise ConfigError(f"multiple Android application modules found: {names}")
+        matches = preferred
+    build_file = matches[0].resolve()
+    return GradleProject(
+        root=root, module=f":{build_file.parent.name}", build_file=build_file
+    )
+
+
+def detect_package_name(workspace: Path, build_file: Path | None = None) -> str:
+    if build_file is not None:
+        gradle_files: tuple[Path, ...] = (build_file,)
+        manifest = build_file.parent / "src" / "main" / "AndroidManifest.xml"
+    else:
+        gradle_files = (
+            workspace / "android" / "app" / "build.gradle.kts",
+            workspace / "android" / "app" / "build.gradle",
+        )
+        manifest = workspace / "android" / "app" / "src" / "main" / "AndroidManifest.xml"
     for path in gradle_files:
         if not path.is_file():
             continue
         text = path.read_text()
-        for pattern in patterns:
+        for pattern in APPLICATION_ID_PATTERNS:
             match = pattern.search(text)
             if match:
                 return match.group(1)
 
-    manifest = workspace / "android" / "app" / "src" / "main" / "AndroidManifest.xml"
     if manifest.is_file():
         match = re.search(r"\bpackage\s*=\s*[\"']([^\"']+)[\"']", manifest.read_text())
         if match:
             return match.group(1)
-    raise ConfigError("cannot detect Android applicationId from android/app")
+    raise ConfigError(f"cannot detect Android applicationId from {gradle_files[0].parent}")
 
 
-def detect_bundle(workspace: Path) -> Path:
-    candidates = sorted(
-        (workspace / "build" / "app" / "outputs" / "bundle").glob("**/*.aab")
-    )
+def detect_bundle(workspace: Path, search_root: Path | None = None) -> Path:
+    # Flutter collects every module's outputs under build/app/; a plain Gradle
+    # build leaves them in the module's own build/outputs/bundle/.
+    base = search_root if search_root is not None else workspace / "build" / "app"
+    candidates = sorted((base / "outputs" / "bundle").glob("**/*.aab"))
     return _single(candidates, "release Android App Bundle")
+
+
+VERSION_CODE_RE = re.compile(r"(?m)^(?P<pre>\s*versionCode\s*=?\s*)(?P<value>\d+)")
+VERSION_NAME_RE = re.compile(
+    r"(?m)^(?P<pre>\s*versionName\s*=?\s*)(?P<quote>[\"'])(?P<value>[^\"']*)(?P=quote)"
+)
+
+
+def set_gradle_version(
+    build_file: Path, version_code: int, version_name: str | None = None
+) -> dict[str, bool]:
+    """Pin versionCode (and optionally versionName) in a module build file.
+
+    Gradle has no equivalent of `flutter build --build-number`, and a literal
+    `versionCode = 1` checked into the repo means every run after the first
+    is rejected by Play as a duplicate. Rewriting the literal in the checkout
+    is the Gradle counterpart to the iOS action patching the pbxproj.
+    """
+    original = build_file.read_text()
+    patched, code_hits = VERSION_CODE_RE.subn(
+        lambda match: f"{match.group('pre')}{version_code}", original
+    )
+    name_hits = 0
+    if version_name:
+        patched, name_hits = VERSION_NAME_RE.subn(
+            lambda match: (
+                f"{match.group('pre')}{match.group('quote')}"
+                f"{version_name}{match.group('quote')}"
+            ),
+            patched,
+        )
+    if patched != original:
+        build_file.write_text(patched)
+    return {"version_code": bool(code_hits), "version_name": bool(name_hits)}

package/android-action/scripts/find_bundle.py

@@ -9,10 +9,19 @@ from pathlib import Path
 from android_config import ConfigError, detect_bundle
 
 
+def gradle_module_dir() -> Path | None:
+    """The Gradle application module's directory, when this is a native build."""
+    root = os.environ.get("ANDROID_GRADLE_ROOT", "")
+    module = os.environ.get("ANDROID_GRADLE_MODULE", "")
+    if not root or not module:
+        return None
+    return Path(root) / module.lstrip(":").replace(":", "/") / "build"
+
+
 def main() -> None:
     workspace = Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve()
     try:
-        bundle = detect_bundle(workspace).resolve()
+        bundle = detect_bundle(workspace, gradle_module_dir()).resolve()
     except ConfigError as exc:
         print(f"::error::{exc}")
         raise SystemExit(1) from exc

package/android-action/scripts/resolve_android.py

@@ -10,8 +10,11 @@ from pathlib import Path
 from android_config import (
     ConfigError,
     detect_package_name,
+    find_gradle_project,
     find_play_service_account,
     find_signing_config,
+    project_kind,
+    set_gradle_version,
 )
 
 
@@ -30,18 +33,124 @@ def resolve_build_number(raw: str) -> int:
     return number
 
 
+def highest_play_version_code(package_name: str, service_account: Path) -> int | None:
+    """Highest versionCode Google Play already holds for this package, or None.
+
+    Best-effort: any failure (offline, no permission, app not yet created) returns
+    None so the caller falls back to GITHUB_RUN_NUMBER.
+    """
+    try:
+        import google.auth.transport.requests  # noqa: PLC0415
+        import requests  # noqa: PLC0415
+        from google.oauth2 import service_account as gsa  # noqa: PLC0415
+
+        creds = gsa.Credentials.from_service_account_file(
+            str(service_account),
+            scopes=["https://www.googleapis.com/auth/androidpublisher"],
+        )
+        creds.refresh(google.auth.transport.requests.Request())
+        base = "https://androidpublisher.googleapis.com/androidpublisher/v3"
+        headers = {"Authorization": f"Bearer {creds.token}"}
+
+        edit = requests.post(
+            f"{base}/applications/{package_name}/edits", headers=headers, timeout=60
+        )
+        edit.raise_for_status()
+        edit_id = edit.json()["id"]
+        try:
+            listed = requests.get(
+                f"{base}/applications/{package_name}/edits/{edit_id}/bundles",
+                headers=headers,
+                timeout=60,
+            )
+            listed.raise_for_status()
+            codes = [
+                int(b["versionCode"])
+                for b in listed.json().get("bundles", [])
+                if b.get("versionCode") is not None
+            ]
+        finally:
+            requests.delete(
+                f"{base}/applications/{package_name}/edits/{edit_id}",
+                headers=headers,
+                timeout=60,
+            )
+        return max(codes) if codes else None
+    except Exception as exc:  # noqa: BLE001 - never fail the build over this
+        print(f"::warning::Could not read existing Play versionCodes ({exc}); "
+              f"falling back to GITHUB_RUN_NUMBER")
+        return None
+
+
+def auto_build_number(package_name: str, service_account: Path) -> int:
+    """versionCode to use when the caller did not pin one.
+
+    GITHUB_RUN_NUMBER alone is wrong: it restarts at 1 on a freshly-onboarded repo,
+    so it collides with versionCodes Play already holds and every upload is rejected
+    ("Version code N has already been used"). Take whichever is higher: the run
+    number, or one past the highest code Play knows about.
+    """
+    run_number = resolve_build_number(os.environ.get("GITHUB_RUN_NUMBER", "1"))
+    highest = highest_play_version_code(package_name, service_account)
+    if highest is None:
+        return run_number
+    candidate = max(run_number, highest + 1)
+    if candidate != run_number:
+        print(
+            f"Play already holds versionCode {highest}; using {candidate} "
+            f"instead of GITHUB_RUN_NUMBER {run_number}"
+        )
+    return candidate
+
+
+def apply_gradle_version(project, build_number: int, build_name: str) -> None:
+    """Write the resolved versionCode/versionName into the Gradle module.
+
+    A miss is a warning rather than an error: the declared versionCode is still
+    valid for a first upload, and Play rejects a genuine duplicate with a far
+    clearer message than anything this script could guess at here.
+    """
+    applied = set_gradle_version(project.build_file, build_number, build_name or None)
+    relative = project.build_file.name
+    if applied["version_code"]:
+        print(f"Pinned versionCode {build_number} in {project.module}/{relative}")
+    else:
+        print(
+            f"::warning::No literal versionCode found in {project.module}/{relative}; "
+            f"leaving the project's own value in place"
+        )
+    if build_name and not applied["version_name"]:
+        print(
+            f"::warning::No literal versionName found in {project.module}/{relative}; "
+            f"build-name {build_name} was not applied"
+        )
+
+
 def main() -> None:
     workspace = Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve()
     env_path = Path(os.environ["GITHUB_ENV"])
     output_path = Path(os.environ["GITHUB_OUTPUT"])
+    gradle_root = ""
+    gradle_module = ""
     try:
-        if not (workspace / "pubspec.yaml").is_file():
-            raise ConfigError("pubspec.yaml not found; Android action requires Flutter")
+        kind = project_kind(workspace)
+        project = None if kind == "flutter" else find_gradle_project(workspace)
         signing = find_signing_config(workspace)
         service_account = find_play_service_account(workspace)
-        package_name = os.environ.get("INPUT_PACKAGE_NAME") or detect_package_name(workspace)
-        raw_number = os.environ.get("INPUT_BUILD_NUMBER") or os.environ.get("GITHUB_RUN_NUMBER", "")
-        build_number = resolve_build_number(raw_number)
+        package_name = os.environ.get("INPUT_PACKAGE_NAME") or detect_package_name(
+            workspace, project.build_file if project else None
+        )
+        pinned = os.environ.get("INPUT_BUILD_NUMBER") or ""
+        if pinned:
+            build_number = resolve_build_number(pinned)
+        else:
+            build_number = auto_build_number(package_name, service_account)
+        if project is not None:
+            gradle_root = str(project.root)
+            gradle_module = project.module
+            apply_gradle_version(
+                project, build_number, os.environ.get("INPUT_BUILD_NAME") or ""
+            )
     except (ConfigError, KeyError, OSError) as exc:
         print(f"::error::{exc}")
         raise SystemExit(1) from exc
@@ -54,6 +163,9 @@ def main() -> None:
         "ANDROID_SIGNING_PROPERTIES": str(signing.properties_path),
         "ANDROID_KEYSTORE_PATH": str(signing.keystore_path),
         "ANDROID_PLAY_SERVICE_ACCOUNT": str(service_account),
+        "ANDROID_PROJECT_KIND": kind,
+        "ANDROID_GRADLE_ROOT": gradle_root,
+        "ANDROID_GRADLE_MODULE": gradle_module,
     }
     for name, value in values.items():
         append_value(env_path, name, value)
@@ -61,9 +173,12 @@ def main() -> None:
         ("package_name", package_name),
         ("service_account", str(service_account)),
         ("build_number", str(build_number)),
+        ("project_kind", kind),
+        ("gradle_root", gradle_root),
+        ("gradle_module", gradle_module),
     ):
         append_value(output_path, name, value)
-    print(f"Resolved Android package {package_name}, build {build_number}")
+    print(f"Resolved {kind} Android package {package_name}, build {build_number}")
 
 
 if __name__ == "__main__":

package/android-action/scripts/test_android_config.py

@@ -3,16 +3,21 @@
 from __future__ import annotations
 
 import json
+import os
 import tempfile
 import unittest
 from pathlib import Path
+from unittest import mock
 
 from android_config import (
     ConfigError,
     detect_bundle,
     detect_package_name,
+    find_gradle_project,
     find_play_service_account,
     find_signing_config,
+    project_kind,
+    set_gradle_version,
 )
 
 
@@ -93,5 +98,197 @@ class AndroidConfigTest(unittest.TestCase):
         self.assertEqual(detect_bundle(self.workspace), bundle)
 
 
+class NativeGradleProjectTest(unittest.TestCase):
+    """Native Kotlin/Gradle apps ship through the same action as Flutter ones."""
+
+    def setUp(self) -> None:
+        self.temp = tempfile.TemporaryDirectory()
+        self.workspace = Path(self.temp.name)
+
+    def tearDown(self) -> None:
+        self.temp.cleanup()
+
+    def scaffold(self, base: str = "android", *, alias: bool = False) -> Path:
+        root = self.workspace / base if base != "." else self.workspace
+        (root / "app").mkdir(parents=True)
+        (root / "settings.gradle.kts").write_text('include(":app")')
+        (root / "gradlew").write_text("#!/bin/sh\n")
+        (root / "build.gradle.kts").write_text(
+            "plugins { alias(libs.plugins.android.application) apply false }"
+        )
+        if alias:
+            (root / "gradle").mkdir()
+            (root / "gradle" / "libs.versions.toml").write_text(
+                '[plugins]\nandroid-application = { id = "com.android.application" }\n'
+            )
+            plugins = "plugins { alias(libs.plugins.android.application) }"
+        else:
+            plugins = 'plugins { id("com.android.application") }'
+        (root / "app" / "build.gradle.kts").write_text(
+            f"{plugins}\n"
+            "android {\n"
+            "    defaultConfig {\n"
+            '        applicationId = "com.gowalk.form"\n'
+            "        versionCode = 1\n"
+            '        versionName = "1.0.0"\n'
+            "    }\n"
+            "}\n"
+        )
+        return root
+
+    def test_flutter_wins_over_a_nested_gradle_build(self) -> None:
+        self.scaffold()
+        self.assertEqual(project_kind(self.workspace), "gradle")
+        (self.workspace / "pubspec.yaml").write_text("name: app\n")
+        self.assertEqual(project_kind(self.workspace), "flutter")
+
+    def test_finds_app_module_under_android(self) -> None:
+        root = self.scaffold()
+
+        project = find_gradle_project(self.workspace)
+
+        self.assertEqual(project.root, root.resolve())
+        self.assertEqual(project.module, ":app")
+        self.assertEqual(project.build_file, (root / "app" / "build.gradle.kts").resolve())
+
+    def test_finds_app_module_at_the_repo_root(self) -> None:
+        self.scaffold(".")
+
+        self.assertEqual(find_gradle_project(self.workspace).module, ":app")
+
+    def test_resolves_version_catalog_plugin_aliases(self) -> None:
+        # `alias(libs.plugins.android.application)` says nothing about the plugin
+        # id without the catalog, and the root build file declares the same alias
+        # with `apply false`.
+        self.scaffold(alias=True)
+
+        self.assertEqual(find_gradle_project(self.workspace).module, ":app")
+
+    def test_ignores_library_modules(self) -> None:
+        root = self.scaffold()
+        (root / "network").mkdir()
+        (root / "network" / "build.gradle.kts").write_text(
+            'plugins { id("com.android.library") }'
+        )
+
+        self.assertEqual(find_gradle_project(self.workspace).module, ":app")
+
+    def test_prefers_the_app_module_over_a_sibling_application(self) -> None:
+        # A wear/automotive companion is also `com.android.application`; the
+        # module named `app` is the one that ships to Play.
+        root = self.scaffold()
+        (root / "wear").mkdir()
+        (root / "wear" / "build.gradle.kts").write_text(
+            'plugins { id("com.android.application") }'
+        )
+
+        self.assertEqual(find_gradle_project(self.workspace).module, ":app")
+
+    def test_rejects_ambiguous_application_modules(self) -> None:
+        root = self.scaffold()
+        (root / "app").rename(root / "phone")
+        (root / "wear").mkdir()
+        (root / "wear" / "build.gradle.kts").write_text(
+            'plugins { id("com.android.application") }'
+        )
+
+        with self.assertRaisesRegex(ConfigError, "multiple Android application"):
+            find_gradle_project(self.workspace)
+
+    def test_reports_a_missing_gradle_build(self) -> None:
+        with self.assertRaisesRegex(ConfigError, "no Gradle build found"):
+            find_gradle_project(self.workspace)
+
+    def test_detects_package_name_from_the_resolved_module(self) -> None:
+        project = find_gradle_project(self.scaffold("."))
+
+        self.assertEqual(
+            detect_package_name(self.workspace, project.build_file), "com.gowalk.form"
+        )
+
+    def test_detects_bundle_in_the_gradle_module_output(self) -> None:
+        root = self.scaffold()
+        bundle = root / "app" / "build" / "outputs" / "bundle" / "release" / "app.aab"
+        bundle.parent.mkdir(parents=True)
+        bundle.write_bytes(b"bundle")
+
+        self.assertEqual(
+            detect_bundle(self.workspace, root / "app" / "build"), bundle
+        )
+
+    def test_pins_version_code_and_name(self) -> None:
+        project = find_gradle_project(self.scaffold())
+
+        applied = set_gradle_version(project.build_file, 214, "1.2.3")
+
+        self.assertEqual(applied, {"version_code": True, "version_name": True})
+        text = project.build_file.read_text()
+        self.assertIn("versionCode = 214", text)
+        self.assertIn('versionName = "1.2.3"', text)
+
+    def test_leaves_version_name_alone_when_not_overridden(self) -> None:
+        project = find_gradle_project(self.scaffold())
+
+        applied = set_gradle_version(project.build_file, 9)
+
+        self.assertFalse(applied["version_name"])
+        self.assertIn('versionName = "1.0.0"', project.build_file.read_text())
+
+    def test_reports_a_non_literal_version_code_instead_of_guessing(self) -> None:
+        project = find_gradle_project(self.scaffold())
+        project.build_file.write_text(
+            "android { defaultConfig { versionCode = computeVersionCode() } }"
+        )
+
+        applied = set_gradle_version(project.build_file, 12)
+
+        self.assertFalse(applied["version_code"])
+        self.assertIn("computeVersionCode()", project.build_file.read_text())
+
+    def test_groovy_version_code_syntax(self) -> None:
+        project = find_gradle_project(self.scaffold())
+        project.build_file.write_text(
+            "android {\n    defaultConfig {\n        versionCode 7\n    }\n}\n"
+        )
+
+        self.assertTrue(set_gradle_version(project.build_file, 88)["version_code"])
+        self.assertIn("versionCode 88", project.build_file.read_text())
+
+
 if __name__ == "__main__":
     unittest.main()
+
+
+class AutoBuildNumberTest(unittest.TestCase):
+    """versionCode must never collide with what Play already holds."""
+
+    def test_uses_play_high_water_mark_when_run_number_is_lower(self) -> None:
+        import resolve_android
+
+        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=173):
+            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "1"}):
+                # A freshly-onboarded repo starts at run 1; Play already has 173.
+                self.assertEqual(
+                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
+                    174,
+                )
+
+    def test_uses_run_number_when_it_is_already_higher(self) -> None:
+        import resolve_android
+
+        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=5):
+            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "42"}):
+                self.assertEqual(
+                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
+                    42,
+                )
+
+    def test_falls_back_to_run_number_when_play_is_unreachable(self) -> None:
+        import resolve_android
+
+        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=None):
+            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "7"}):
+                self.assertEqual(
+                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
+                    7,
+                )

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -110,15 +110,27 @@ jobs:
         run: python3 .github/actions/android-app/scripts/bitrise_deploy.py
 
       # --- Local mode -----------------------------------------------------
+      # Native Gradle apps must not pay for a Flutter install, and their AGP
+      # version generally wants a newer JDK than a Flutter app's does.
+      - name: Detect Flutter
+        id: flutter
+        if: ${{ steps.mode.outputs.mode == 'local' }}
+        shell: bash
+        run: |
+          if [ -f pubspec.yaml ]; then
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Set up Java
         if: ${{ steps.mode.outputs.mode == 'local' }}
         uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: ${{ steps.flutter.outputs.enabled == 'true' && '17' || '21' }}
           cache: gradle
       - name: Set up Flutter
-        if: ${{ steps.mode.outputs.mode == 'local' }}
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
         uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with:
           channel: stable
@@ -126,7 +138,7 @@ jobs:
       # Same reason as the iOS job: apps using AppLocalizations must generate it
       # before anything analyses or compiles them. No-op for apps without l10n.
       - name: Generate localizations
-        if: ${{ steps.mode.outputs.mode == 'local' }}
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
         shell: bash
         run: |
           if [ -f l10n.yaml ]; then