build_local: sign with DroidDeck's key when a local .signing.env has it

A local build was signed with the testkey alone, which a release refuses
as an update ("signatures do not match"): testing on a device with a CI
build meant uninstalling it and losing its data first.

With an untracked .signing.env (RELEASE_KEYSTORE, RELEASE_STORE_PASSWORD,
RELEASE_KEY_ALIAS) in the checkout, or in the main checkout for a
worktree, build_local.sh finishes with tools/release/sign-apk.sh as CI's
main builds do, and the apk installs over a release. Without the file
nothing changes. DROIDDECK_SIGNING_ENV points at the file explicitly.

.github/workflows/build.yml

@@ -34,12 +34,18 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
     runs-on: ubuntu-24.04
     timeout-minutes: 45
+    outputs:
+      variants: ${{ steps.variants.outputs.list }}
     steps:
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
 
+      - name: The packages a signed build ships as
+        id: variants
+        run: echo "list=$(awk '!/^#/ && NF { print $1 }' tools/release/variants.txt | jq -R . | jq -sc .)" >> "$GITHUB_OUTPUT"
+
       - name: No private key in the tree
         run: |
           set -euo pipefail
@@ -427,5 +433,5 @@ jobs:
     uses: ./.github/workflows/sign.yml
     with:
       environment: signing-main
-      variants: '["standard"]'
+      variants: ${{ needs.build.outputs.variants }}
     secrets: inherit

.gitignore

@@ -29,3 +29,6 @@ app/src/main/jniLibs/arm64-v8a/libproot-loader.so
 droiddeck-release-key/
 password.txt
 __pycache__/
+
+# Local signing with the release key (tools/build_local.sh); holds a password.
+.signing.env

tools/build_local.sh

@@ -309,6 +309,29 @@ grep -qi 'CN=Android, OU=Android, O=Android' <<<"${signature_output}" || {
     exit 1
 }
 
+# With DroidDeck's own key at hand, sign as CI's main builds are (tools/release/sign-apk.sh), so
+# the apk installs over a release instead of being refused as a different signer. The key's
+# location and password live in an untracked .signing.env (RELEASE_KEYSTORE, RELEASE_STORE_PASSWORD,
+# RELEASE_KEY_ALIAS), looked for in this checkout and then in the main one, which worktrees share.
+signing_env=${DROIDDECK_SIGNING_ENV:-}
+if [[ -z "${signing_env}" ]]; then
+    for candidate in "${repo_root}/.signing.env" \
+            "$(dirname "$(git -C "${repo_root}" rev-parse --path-format=absolute --git-common-dir 2>/dev/null || echo .)")/.signing.env"; do
+        [[ -f "${candidate}" ]] && { signing_env=${candidate}; break; }
+    done
+fi
+if [[ -n "${signing_env}" ]]; then
+    echo "Signing with DroidDeck's key (${signing_env})"
+    (
+        set -a
+        # shellcheck disable=SC1090
+        . "${signing_env}"
+        set +a
+        BUILD_TOOLS="${build_tools}" "${repo_root}/tools/release/sign-apk.sh" "${apk}" standard "${apk}.release"
+    )
+    mv "${apk}.release" "${apk}"
+fi
+
 printf 'APK: %s\n' "${apk}"
 printf 'SHA-256: '
 shasum -a 256 "${apk}" | awk '{print $1}'