fix(release): dry runs no longer require RELEASE_TOKEN

[stozo04]

The first dispatch failed at actions/checkout with Input required and not supplied: token. My bug: I passed token: ${{ secrets.RELEASE_TOKEN }} unconditionally, and with the secret unset that resolves to an empty string, which checkout rejects. It never reached a permissions question — a dry run only reads the repo and should never have needed a write credential.

• Checkout and gh now fall back to the job's own GITHUB_TOKEN when RELEASE_TOKEN is absent
• A real run still needs the PAT, so it's checked up front with an error that names the secret, instead of failing later mid-push
• The signing secrets are checked the same way, before the build rather than during it

The PAT check lives in the step's shell rather than its if: — secrets isn't an allowed context in a step condition, so the first version of this guard would not have evaluated as intended.

After this, dry_run works with no PAT at all.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Miqsf1M14nY5TKiZHzyjNY

---

Note

Low Risk
CI workflow-only changes that improve credential handling and early validation; no app runtime or signing logic changes.

Overview
Dry-run release builds can run without RELEASE_TOKEN: GH_TOKEN and checkout now use secrets.RELEASE_TOKEN || github.token, so a missing PAT no longer breaks actions/checkout with an empty token.

Real releases still require the PAT. A new upfront step (only when dry_run is false) fails fast with a clear error if RELEASE_TOKEN is missing, instead of failing mid-push/merge. The check runs in shell because secrets cannot be used in step if: conditions.

Signing secrets are validated the same way before the Gradle build: all five keystore/Firebase secrets must be set on every run, with named errors if any are missing.

Workflow header comments were updated to spell out which secrets apply to dry vs full release runs.

^{Reviewed by Cursor Bugbot for commit a669945. Bugbot is set up for automated code reviews on this repo. Configure here.}