Feature/tasker bridge

.github/security/permission-allowlist.txt

@@ -23,6 +23,10 @@ android.car.permission.CONTROL_CAR_CLIMATE
 # seule une app signée avec la clé plateforme peut l'obtenir. Elle restreint un accès,
 # elle n'en accorde pas.
 com.mg4.control.permission.RECEIVE_HARDKEY
+# External control API: signature-level permission protecting ProfileControlService.
+# protectionLevel="signature" → réservée aux apps signées avec la clé plateforme.
+# Déclarée ET demandée par MG4Control : demandée pour pouvoir émettre le broadcast.
+com.mg4.control.permission.CONTROL_PROFILES
 # --- network / auto-update (online variant only) ---
 android.permission.INTERNET
 android.permission.ACCESS_NETWORK_STATE

.github/workflows/release.yml

@@ -18,6 +18,8 @@ jobs:
       MG4_KEYSTORE_BASE64: ${{ secrets.MG4_KEYSTORE_BASE64 }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - uses: actions/setup-java@v4
         with:
@@ -51,7 +53,12 @@ jobs:
       - name: Collect APKs
         run: |
           mkdir -p dist
-          find app/build/outputs/apk -name "MG4Control-*-*.apk" -exec cp {} dist/ \;
+          # AGP 9 emits app-<flavor>-release.apk; rename to the published convention.
+          for f in $(find app/build/outputs/apk -name "app-*-release.apk"); do
+            flavor=$(basename "$f" | sed -E 's/app-(.*)-release.apk/\1/')
+            ver=$(grep -oE 'versionName = "[^"]+"' app/build.gradle.kts | head -1 | sed -E 's/.*"([^"]+)"/\1/')
+            cp "$f" "dist/MG4Control-${flavor}-${ver}.apk"
+          done
           ls -la dist/
 
       - name: Upload APKs as workflow artifacts

.github/workflows/security.yml

@@ -18,6 +18,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
       - name: Check manifest permissions
         run: bash .github/security/check-permissions.sh
 
@@ -36,6 +38,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
       - uses: actions/setup-python@v5
         with: { python-version: "3.12" }
 
@@ -46,7 +50,7 @@ jobs:
             printf '%s' '{"version":"2.1.0","$schema":"https://json.schemastore.org/sarif-2.1.0.json","runs":[{"tool":{"driver":{"name":"'"$1"'","rules":[]}},"results":[]}]}' > "$2"
           }
           pip install mobsfscan semgrep
-          mobsfscan --sarif -o mobsfscan.sarif . || true
+          mobsfscan --sarif -o mobsfscan.sarif app/src || true
           [ -s mobsfscan.sarif ] || empty_sarif mobsfscan mobsfscan.sarif
           semgrep --config p/kotlin --config p/security-audit --sarif -o semgrep.sarif . || true
           [ -s semgrep.sarif ] || empty_sarif semgrep semgrep.sarif
@@ -94,6 +98,8 @@ jobs:
       NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
       # Runs only when an NVD API key is configured — otherwise the NVD API is too
       # rate-limited to be useful, and an empty --nvdApiKey breaks the tool.
       - name: OWASP Dependency-Check

.github/workflows/tests.yml

@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - uses: actions/setup-java@v4
         with:

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "MG4Hardware"]
+	path = MG4Hardware
+	url = https://github.com/malys/MG4Hardware