From 1f128174b759046b0fcdb79f025360804607bd76 Mon Sep 17 00:00:00 2001
From: Strycher <strycher@gmail.com>
Date: Mon, 20 Jul 2026 03:31:32 -0400
Subject: [PATCH] feat(#330): pin Flutter and pass GIPHY_API_KEY in the signed
 build

Rebased onto dev after #331 landed. Brings the signing workflow in line
with the rest of the matrix:

  - Pinned to Flutter 3.44.1, matching the bench and every other
    workflow. A release artifact in particular must not be built by
    whatever `stable` happens to point at that day, which was the whole
    argument for #331.
  - Generates dart_defines.json and passes --dart-define-from-file, so
    the signed release does not ship with a dead GIF picker.
  - Cleanup step now removes dart_defines.json alongside the keystore
    material, since it holds the Giphy key.

Verified that a job pinned to an environment still receives repository
secrets (precedence is org < repo < environment, environment winning on
a name collision), so the repo-scoped GIPHY_API_KEY reaches this job
while the keystore secrets stay environment-scoped behind the reviewer
gate.

Part of epic #312, plan #321 (Phase 5).
---
 .github/workflows/release-signed.yml | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release-signed.yml b/.github/workflows/release-signed.yml
index 8d0c595..6a255b0 100644
--- a/.github/workflows/release-signed.yml
+++ b/.github/workflows/release-signed.yml
@@ -49,9 +49,12 @@ jobs:
           distribution: "temurin"
           java-version: "17"
 
+      # Pinned to the bench toolchain, matching every other workflow (#331).
+      # A release artifact in particular must not be built by whatever
+      # version `stable` happens to point at on the day.
       - uses: subosito/flutter-action@v2
         with:
-          channel: "stable"
+          flutter-version: "3.44.1"
           cache: true
 
       - name: Cache Gradle
@@ -98,11 +101,18 @@ jobs:
 
       - run: flutter pub get
 
+      # Same mechanism as build.yml (#331). A signed release that shipped
+      # without the Giphy key would have a dead GIF picker.
+      - name: Write dart_defines.json
+        env:
+          GIPHY_API_KEY: ${{ secrets.GIPHY_API_KEY }}
+        run: jq -n --arg k "$GIPHY_API_KEY" '{GIPHY_API_KEY:$k}' > dart_defines.json
+
       - name: Build signed APK
-        run: flutter build apk --release --no-pub
+        run: flutter build apk --release --no-pub --dart-define-from-file=dart_defines.json
 
       - name: Build signed AAB
-        run: flutter build appbundle --release --no-pub
+        run: flutter build appbundle --release --no-pub --dart-define-from-file=dart_defines.json
 
       # The load-bearing check. A green build does NOT prove the artifact is
       # release-signed: build.gradle.kts silently falls back to the debug
@@ -179,5 +189,5 @@ jobs:
       - name: Remove keystore material
         if: always()
         run: |
-          rm -f android/app/release.jks android/key.properties
-          echo "Keystore material removed."
+          rm -f android/app/release.jks android/key.properties dart_defines.json
+          echo "Keystore material and dart_defines removed."