[damarals]

Summary

• eas.json with production profile producing APK (not AAB), autoIncrement: version
• .github/workflows/release.yml triggers on v* tag → typecheck/lint/test → eas build --platform android --profile production → download APK → generate release notes → gh release create with APK attached
• scripts/release-notes.sh generates body with SHA-256 + signing key fingerprint + verify instructions + verbatim disclaimer
• README.md rewritten with: install (sideload), verify, build from source, how it works, privacy, legal disclaimer (verbatim from PRD §Further Notes), MIT license note
• Closes EAS APK build + GitHub Releases pipeline + sideload README #12

Maintainer HITL handoff (before tagging v0.1.0)

1. eas login && eas init
2. eas credentials → generate production Android keystore (EAS-managed)
3. Capture SHA-256 fingerprint from the same flow
4. Add repo secret ANDROID_SIGNING_FINGERPRINT (Settings → Secrets → Actions); without it, release notes ship a placeholder
5. Generate EXPO_TOKEN at expo.dev → add as repo secret EXPO_TOKEN
6. git tag v0.1.0 && git push origin v0.1.0 — workflow builds and publishes

Test plan

• npm test — 131 pass
• npm run typecheck clean
• npm run lint clean
• Tag v0.1.0 after merge to verify the workflow end-to-end and confirm APK installs on Android 12+