include glyph sdk to release build

.gitea/workflows/android-release.yml

@@ -4,10 +4,10 @@
 # unit tests run — `:core`'s suite is in `tests.yml`, where no SDK is needed
 # because `settings.gradle.kts` leaves `:app` out when there is none.
 #
-# The Glyph Matrix AAR is deliberately *not* fetched: its licence forbids
-# redistribution, and `app/build.gradle.kts` compiles the `noglyph` source set
-# without it. A CI APK therefore has an inert rear display, which is also exactly
-# right for any phone that is not a Nothing.
+# The Glyph Matrix AAR is not committed (its licence forbids redistribution), so
+# the job runs `android/fetch-glyph-sdk.sh` to download it from Nothing before
+# Gradle configures the app. That means the APK this produces really has the
+# rear-display implementation compiled in, rather than the no-op fallback.
 name: android
 
 on:
@@ -32,6 +32,13 @@ jobs:
           apt-get install -y --no-install-recommends \
             openjdk-21-jdk-headless curl unzip >/dev/null
 
+      # The AAR is git-ignored but required for a Glyph-enabled build. The
+      # script exits non-zero if the download is not a real archive, so a vendor
+      # URL that moves fails the job instead of quietly producing a no-op APK.
+      - name: Fetch the Glyph Matrix SDK
+        working-directory: android
+        run: ./fetch-glyph-sdk.sh
+
       # Keyed on the pinned SDK versions, so this is a download once and a
       # restore every time after.
       - uses: actions/cache@v4

.gitea/workflows/docker.yml

@@ -15,13 +15,14 @@ on:
     branches: [master]
     tags: ["v*"]
 
-# The built-in job token is enough to push to this instance's own registry; a
-# REGISTRY_TOKEN secret is only needed when it is not (an older Gitea, or a
-# restricted default permission mode). Ask for packages: write explicitly so the
-# token is not silently read-only on instances that default to restricted.
+# The built-in job token (`secrets.GITEA_TOKEN`) **cannot** publish packages on
+# Gitea — `permissions:` has no effect on container pushes, and the job token is
+# read-only there by design. Publishing therefore needs a personal access token
+# with `package:write`, stored as REGISTRY_TOKEN. Without it the image is still
+# built and smoke-tested, but not pushed; that keeps the build honest without
+# failing every push on a repository that has not minted a token yet.
 permissions:
   contents: read
-  packages: write
 
 env:
   REGISTRY: git.timka.su
@@ -37,23 +38,27 @@ jobs:
         run: docker version
 
       - name: Log in to the Gitea registry
+        id: login
         env:
           # The username is only needed to pair with the token. Default it to the
           # repository owner — the same account the image namespace belongs to —
           # so a missing REGISTRY_USER secret does not fail the job with docker's
           # unhelpful "username is empty".
           REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.repository_owner }}
-          # Gitea gives every job a built-in token (secrets.GITEA_TOKEN). Prefer
-          # an explicit secret, but fall back to that token so a fresh repository
-          # publishes without anyone having to mint one by hand.
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || secrets.GITEA_TOKEN }}
+          # A personal access token with `package:write`. The built-in job token
+          # is not usable here: Gitea's job token is read-only for packages (its
+          # `permissions:` support does not cover the container registry yet),
+          # so falling back to it only produces a confusing 401.
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           if [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_TOKEN" ]; then
-            echo "::error::Container registry credentials are missing. Set REGISTRY_TOKEN (a token with package:write) under Settings → Actions → Secrets; REGISTRY_USER is optional and defaults to the repository owner."
-            exit 1
+            echo "::warning::No REGISTRY_TOKEN (a personal access token with package:write) — the image will be built and smoke-tested but not pushed. Add it under Settings → Actions → Secrets to publish."
+            echo "push=false" >> "$GITHUB_OUTPUT"
+            exit 0
           fi
           printf '%s' "$REGISTRY_TOKEN" \
             | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+          echo "push=true" >> "$GITHUB_OUTPUT"
 
       - name: Build
         run: |
@@ -80,12 +85,13 @@ jobs:
           docker rm -f kadence-smoke
 
       - name: Push
+        if: steps.login.outputs.push == 'true'
         run: |
           docker push "$IMAGE:$SHORT"
           docker push "$IMAGE:latest"
 
       - name: Push the tag, when there is one
-        if: startsWith(github.ref, 'refs/tags/v')
+        if: steps.login.outputs.push == 'true' && startsWith(github.ref, 'refs/tags/v')
         run: |
           VERSION="${GITHUB_REF#refs/tags/}"
           docker tag "$IMAGE:$SHORT" "$IMAGE:$VERSION"

README.md

@@ -299,7 +299,7 @@ Secrets, all under *Repository → Settings → Actions → Secrets*:
 
 | Secret | For |
 | --- | --- |
-| `REGISTRY_TOKEN` | only when the built-in `GITEA_TOKEN` cannot push to the Gitea registry (older Gitea, or restricted token permissions); `package:write` is needed. `REGISTRY_USER` is optional and defaults to the repository owner |
+| `REGISTRY_TOKEN` | publishing the image: **a personal access token with `package:write`**. Gitea's built-in `GITEA_TOKEN` is read-only for packages, so it cannot be used here. `REGISTRY_USER` is optional and defaults to the repository owner. Without this secret the `docker` workflow still builds and smoke-tests the image, but skips the push |
 | `KADENCE_KEYSTORE_BASE64` | `base64 -w0 your.keystore` |
 | `KADENCE_KEYSTORE_PASSWORD`, `KADENCE_KEY_ALIAS`, `KADENCE_KEY_PASSWORD` | the key inside it |
 
@@ -310,10 +310,13 @@ secret **fail the build**: the Gradle config otherwise falls back to the debug k
 without a word, and a debug-signed "release" installs happily and can then never
 be upgraded by a properly signed one.
 
-The Glyph Matrix AAR is deliberately not fetched in CI — its licence forbids
-redistribution, and the build compiles the `noglyph` source set without it, so a
-CI APK has an inert rear display. That is also the correct behaviour on any phone
-that is not a Nothing.
+The Glyph Matrix AAR is not committed — its licence forbids redistribution — so
+the APK job runs `android/fetch-glyph-sdk.sh` before Gradle configures the app,
+downloading it from Nothing's developer kit. The resulting CI APK therefore
+contains the real rear-display implementation; the `noglyph` no-op fallback is
+only used for local builds where the AAR has not been fetched. Because the
+licence forbids redistribution, the downloaded AAR stays out of the artifacts:
+only the finished APK is uploaded.
 
 ---