feat(core): add versioned build manifest flow

.github/workflows/android13.yml

@@ -67,9 +67,17 @@ jobs:
       - name: Prepare tools directory
         run: |
           mkdir -p tools
+          APKTOOL_URL=$(python3 -c "import json; print(json.load(open('tools/versions.lock'))['apktool']['url'])")
+          APKTOOL_SHA=$(python3 -c "import json; print(json.load(open('tools/versions.lock'))['apktool']['sha256'])")
           if [ ! -f tools/apktool.jar ]; then
-            wget -O tools/apktool.jar https://github.com/iBotPeaches/Apktool/releases/download/v2.9.3/apktool_2.9.3.jar
+            wget -q -O tools/apktool.jar "$APKTOOL_URL"
           fi
+          ACTUAL_SHA=$(sha256sum tools/apktool.jar | cut -d' ' -f1)
+          if [ "$ACTUAL_SHA" != "$APKTOOL_SHA" ]; then
+            echo "❌ apktool.jar SHA256 mismatch!"
+            exit 1
+          fi
+          echo "✅ apktool.jar verified"
 
       - name: Download framework JARs
         run: |
@@ -234,6 +242,9 @@ jobs:
           echo "Running patcher with JAR flags: $JAR_FLAGS"
           echo "Feature flags: $FEATURE_FLAGS"
 
+          export WORKFLOW_RUN_ID="${{ github.run_id }}"
+          export WORKFLOW_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
           ./scripts/patcher_a13.sh \
             "${{ github.event.inputs.api_level }}" \
             "${{ steps.set_codename.outputs.codename }}" \
@@ -257,13 +268,10 @@ jobs:
       - name: Set Release Info
         id: release_info
         run: |
-          # Format version name to be git tag friendly
-          SAFE_VERSION=$(echo "${{ github.event.inputs.version_name }}" | sed 's/[^a-zA-Z0-9._-]/_/g')
-          # Add timestamp to ensure unique tags
-          TIMESTAMP=$(date +'%Y%m%d-%H%M%S')
-          RELEASE_TAG="${{ steps.set_codename.outputs.codename }}_${SAFE_VERSION}_${TIMESTAMP}"
+          RELEASE_TAG="build-tmp-${{ github.run_id }}"
+          RELEASE_NAME="Android 13 | ${{ steps.set_codename.outputs.codename }} | ${{ github.event.inputs.version_name }}"
           echo "tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
-          echo "name=Android 13 Framework Patch for ${{ github.event.inputs.device_name }} (${{ github.event.inputs.version_name }})" >> $GITHUB_OUTPUT
+          echo "name=${RELEASE_NAME}" >> $GITHUB_OUTPUT
 
       - name: Find Module ZIP
         id: find_zip
@@ -392,7 +400,9 @@ jobs:
         with:
           tag_name: ${{ steps.release_info.outputs.tag }}
           name: ${{ steps.release_info.outputs.name }}
-          files: ${{ steps.find_zip.outputs.file_path }}
+          files: |
+            ${{ steps.find_zip.outputs.file_path }}
+            build-manifest.json
           body: |
             ${{ steps.generate_release_body.outputs.release_body }}
 
@@ -426,6 +436,15 @@ jobs:
           path: build_log_android13.txt
           retention-days: 7
 
+      - name: Upload build manifest
+        if: success()
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-manifest-${{ github.run_id }}
+          if-no-files-found: warn
+          path: build-manifest.json
+          retention-days: 30
+
       - name: Send Telegram Notification (Success)
         if: success() && github.event.inputs.user_id != ''
         run: |

.github/workflows/android14.yml

@@ -67,9 +67,17 @@ jobs:
       - name: Prepare tools directory
         run: |
           mkdir -p tools
+          APKTOOL_URL=$(python3 -c "import json; print(json.load(open('tools/versions.lock'))['apktool']['url'])")
+          APKTOOL_SHA=$(python3 -c "import json; print(json.load(open('tools/versions.lock'))['apktool']['sha256'])")
           if [ ! -f tools/apktool.jar ]; then
-            wget -O tools/apktool.jar https://github.com/iBotPeaches/Apktool/releases/download/v2.9.3/apktool_2.9.3.jar
+            wget -q -O tools/apktool.jar "$APKTOOL_URL"
           fi
+          ACTUAL_SHA=$(sha256sum tools/apktool.jar | cut -d' ' -f1)
+          if [ "$ACTUAL_SHA" != "$APKTOOL_SHA" ]; then
+            echo "❌ apktool.jar SHA256 mismatch!"
+            exit 1
+          fi
+          echo "✅ apktool.jar verified"
 
       - name: Download framework JARs
         run: |
@@ -234,6 +242,9 @@ jobs:
           echo "Running patcher with JAR flags: $JAR_FLAGS"
           echo "Feature flags: $FEATURE_FLAGS"
 
+          export WORKFLOW_RUN_ID="${{ github.run_id }}"
+          export WORKFLOW_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
           ./scripts/patcher_a14.sh \
             "${{ github.event.inputs.api_level }}" \
             "${{ steps.set_codename.outputs.codename }}" \
@@ -257,13 +268,10 @@ jobs:
       - name: Set Release Info
         id: release_info
         run: |
-          # Format version name to be git tag friendly
-          SAFE_VERSION=$(echo "${{ github.event.inputs.version_name }}" | sed 's/[^a-zA-Z0-9._-]/_/g')
-          # Add timestamp to ensure unique tags
-          TIMESTAMP=$(date +'%Y%m%d-%H%M%S')
-          RELEASE_TAG="${{ steps.set_codename.outputs.codename }}_${SAFE_VERSION}_${TIMESTAMP}"
+          RELEASE_TAG="build-tmp-${{ github.run_id }}"
+          RELEASE_NAME="Android 14 | ${{ steps.set_codename.outputs.codename }} | ${{ github.event.inputs.version_name }}"
           echo "tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
-          echo "name=Android 14 Framework Patch for ${{ github.event.inputs.device_name }} (${{ github.event.inputs.version_name }})" >> $GITHUB_OUTPUT
+          echo "name=${RELEASE_NAME}" >> $GITHUB_OUTPUT
 
       - name: Find Module ZIP
         id: find_zip
@@ -392,7 +400,9 @@ jobs:
         with:
           tag_name: ${{ steps.release_info.outputs.tag }}
           name: ${{ steps.release_info.outputs.name }}
-          files: ${{ steps.find_zip.outputs.file_path }}
+          files: |
+            ${{ steps.find_zip.outputs.file_path }}
+            build-manifest.json
           body: |
             ${{ steps.generate_release_body.outputs.release_body }}
 
@@ -426,6 +436,15 @@ jobs:
           path: build_log_android14.txt
           retention-days: 7
 
+      - name: Upload build manifest
+        if: success()
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-manifest-${{ github.run_id }}
+          if-no-files-found: warn
+          path: build-manifest.json
+          retention-days: 30
+
       - name: Send Telegram Notification (Success)
         if: success() && github.event.inputs.user_id != ''
         run: |

.github/workflows/android15.yml

@@ -67,9 +67,21 @@ jobs:
       - name: Prepare tools directory
         run: |
           mkdir -p tools
+          # Read pinned version from lock file
+          APKTOOL_URL=$(python3 -c "import json; print(json.load(open('tools/versions.lock'))['apktool']['url'])")
+          APKTOOL_SHA=$(python3 -c "import json; print(json.load(open('tools/versions.lock'))['apktool']['sha256'])")
           if [ ! -f tools/apktool.jar ]; then
-            wget -O tools/apktool.jar https://github.com/iBotPeaches/Apktool/releases/download/v2.9.3/apktool_2.9.3.jar
+            wget -q -O tools/apktool.jar "$APKTOOL_URL"
           fi
+          # Verify SHA256
+          ACTUAL_SHA=$(sha256sum tools/apktool.jar | cut -d' ' -f1)
+          if [ "$ACTUAL_SHA" != "$APKTOOL_SHA" ]; then
+            echo "❌ apktool.jar SHA256 mismatch!"
+            echo "  Expected: $APKTOOL_SHA"
+            echo "  Actual:   $ACTUAL_SHA"
+            exit 1
+          fi
+          echo "✅ apktool.jar verified (SHA256 match)"
 
       - name: Download framework JARs
         run: |
@@ -243,6 +255,10 @@ jobs:
           echo "Running patcher with JAR flags: $JAR_FLAGS"
           echo "Feature flags: $FEATURE_FLAGS"
 
+          # Pass CI metadata for build manifest
+          export WORKFLOW_RUN_ID="${{ github.run_id }}"
+          export WORKFLOW_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
           ./scripts/patcher_a15.sh \
             ${{ github.event.inputs.api_level }} \
             "${{ steps.set_codename.outputs.codename }}" \
@@ -266,13 +282,11 @@ jobs:
       - name: Set Release Info
         id: release_info
         run: |
-          # Format version name to be git tag friendly
-          SAFE_VERSION=$(echo "${{ github.event.inputs.version_name }}" | sed 's/[^a-zA-Z0-9._-]/_/g')
-          # Add timestamp to ensure unique tags
-          TIMESTAMP=$(date +'%Y%m%d-%H%M%S')
-          RELEASE_TAG="${{ steps.set_codename.outputs.codename }}_${SAFE_VERSION}_${TIMESTAMP}"
+          # Use temporary tag — will be cleaned up by scheduled workflow
+          RELEASE_TAG="build-tmp-${{ github.run_id }}"
+          RELEASE_NAME="Android 15 | ${{ steps.set_codename.outputs.codename }} | ${{ github.event.inputs.version_name }}"
           echo "tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
-          echo "name=Android 15 Framework Patch for ${{ github.event.inputs.device_name }} (${{ github.event.inputs.version_name }})" >> $GITHUB_OUTPUT
+          echo "name=${RELEASE_NAME}" >> $GITHUB_OUTPUT
 
       - name: Find Module ZIP
         id: find_zip
@@ -410,7 +424,9 @@ jobs:
         with:
           tag_name: ${{ steps.release_info.outputs.tag }}
           name: ${{ steps.release_info.outputs.name }}
-          files: ${{ steps.find_zip.outputs.file_path }}
+          files: |
+            ${{ steps.find_zip.outputs.file_path }}
+            build-manifest.json
           body: |
             ${{ steps.generate_release_body.outputs.release_body }}
 
@@ -444,6 +460,15 @@ jobs:
           path: build_log_android15.txt
           retention-days: 7
 
+      - name: Upload build manifest
+        if: success()
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-manifest-${{ github.run_id }}
+          if-no-files-found: warn
+          path: build-manifest.json
+          retention-days: 30
+
       - name: Send Telegram Notification (Success)
         if: success() && github.event.inputs.user_id != ''
         run: |

.github/workflows/android16.yml

@@ -67,9 +67,17 @@ jobs:
       - name: Prepare tools directory
         run: |
           mkdir -p tools
+          APKTOOL_URL=$(python3 -c "import json; print(json.load(open('tools/versions.lock'))['apktool']['url'])")
+          APKTOOL_SHA=$(python3 -c "import json; print(json.load(open('tools/versions.lock'))['apktool']['sha256'])")
           if [ ! -f tools/apktool.jar ]; then
-            wget -O tools/apktool.jar https://github.com/iBotPeaches/Apktool/releases/download/v2.9.3/apktool_2.9.3.jar
+            wget -q -O tools/apktool.jar "$APKTOOL_URL"
           fi
+          ACTUAL_SHA=$(sha256sum tools/apktool.jar | cut -d' ' -f1)
+          if [ "$ACTUAL_SHA" != "$APKTOOL_SHA" ]; then
+            echo "❌ apktool.jar SHA256 mismatch!"
+            exit 1
+          fi
+          echo "✅ apktool.jar verified"
 
       - name: Download framework JARs
         run: |
@@ -243,6 +251,9 @@ jobs:
           echo "Running patcher with JAR flags: $JAR_FLAGS"
           echo "Feature flags: $FEATURE_FLAGS"
 
+          export WORKFLOW_RUN_ID="${{ github.run_id }}"
+          export WORKFLOW_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
           ./scripts/patcher_a16.sh \
             "${{ github.event.inputs.api_level }}" \
             "${{ steps.set_codename.outputs.codename }}" \
@@ -266,13 +277,10 @@ jobs:
       - name: Set Release Info
         id: release_info
         run: |
-          # Format version name to be git tag friendly
-          SAFE_VERSION=$(echo "${{ github.event.inputs.version_name }}" | sed 's/[^a-zA-Z0-9._-]/_/g')
-          # Add timestamp to ensure unique tags
-          TIMESTAMP=$(date +'%Y%m%d-%H%M%S')
-          RELEASE_TAG="${{ steps.set_codename.outputs.codename }}_${SAFE_VERSION}_${TIMESTAMP}"
+          RELEASE_TAG="build-tmp-${{ github.run_id }}"
+          RELEASE_NAME="Android 16 | ${{ steps.set_codename.outputs.codename }} | ${{ github.event.inputs.version_name }}"
           echo "tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
-          echo "name=Android 16 Framework Patch for ${{ github.event.inputs.device_name }} (${{ github.event.inputs.version_name }})" >> $GITHUB_OUTPUT
+          echo "name=${RELEASE_NAME}" >> $GITHUB_OUTPUT
 
       - name: Find Module ZIP
         id: find_zip
@@ -401,7 +409,9 @@ jobs:
         with:
           tag_name: ${{ steps.release_info.outputs.tag }}
           name: ${{ steps.release_info.outputs.name }}
-          files: ${{ steps.find_zip.outputs.file_path }}
+          files: |
+            ${{ steps.find_zip.outputs.file_path }}
+            build-manifest.json
           body: |
             ${{ steps.generate_release_body.outputs.release_body }}
 
@@ -435,6 +445,15 @@ jobs:
           path: build_log_android16.txt
           retention-days: 7
 
+      - name: Upload build manifest
+        if: success()
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-manifest-${{ github.run_id }}
+          if-no-files-found: warn
+          path: build-manifest.json
+          retention-days: 30
+
       - name: Send Telegram Notification (Success)
         if: success() && github.event.inputs.user_id != ''
         run: |

.github/workflows/cleanup-tags.yml

@@ -0,0 +1,77 @@
+name: Cleanup Build Tags
+
+on:
+  schedule:
+    # Run weekly on Sunday at 03:00 UTC
+    - cron: '0 3 * * 0'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Dry run — show what would be deleted without deleting'
+        required: false
+        default: 'true'
+        type: choice
+        options:
+          - 'true'
+          - 'false'
+
+jobs:
+  cleanup:
+    name: Cleanup temporary build tags
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # need full history for tags
+
+      - name: Find and delete temporary and legacy build tags
+        env:
+          DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
+        run: |
+          echo "Scanning for temporary and legacy build tags..."
+
+          # New temporary tags + legacy patterns from older workflows.
+          # Keep semantic version tags (vX.Y.Z) intact.
+          TAGS=$(
+            {
+              git tag -l 'build-tmp-*'
+              git tag -l 'android13-*'
+              git tag -l 'android14-*'
+              git tag -l 'android15-*'
+              git tag -l 'android16-*'
+            } | sed '/^$/d' | sort -u
+          )
+
+          COUNT=$(printf '%s\n' "$TAGS" | sed '/^$/d' | wc -l | tr -d ' ')
+
+          echo "Found $COUNT cleanup candidate tags"
+
+          if [ "$COUNT" -eq 0 ]; then
+            echo "No temporary tags to clean up"
+            exit 0
+          fi
+
+          if [ "$DRY_RUN" = "true" ]; then
+            echo "=== DRY RUN — would delete these tags ==="
+            echo "$TAGS"
+            echo "=== End of dry run ==="
+          else
+            echo "Deleting $COUNT temporary build tags..."
+            printf '%s\n' "$TAGS" | while read -r tag; do
+              if [ -n "$tag" ]; then
+                git push --delete origin "$tag" 2>/dev/null || echo "Failed to delete $tag (may already be gone)"
+                git tag -d "$tag" 2>/dev/null || true
+              fi
+            done
+            echo "✅ Cleanup complete"
+          fi
+
+      - name: Summary
+        run: |
+          REMAINING=$(git tag | wc -l)
+          echo "Total remaining tags: $REMAINING"
+          echo "Engine release tags:"
+          git tag -l 'v*' | head -20