fix(release): install the pinned Gradle rather than running the wrapper

[stozo04]

Unable to access jarfile gradle/wrapper/gradle-wrapper.jar.

.gitignore excludes /gradle/wrapper/gradle-wrapper.jar, so a fresh checkout gets the gradlew script with no engine behind it. This has never surfaced because every existing environment already had the jar on disk from a local Gradle run.

The fix reads the version the wrapper pins out of gradle-wrapper.properties (9.7.1 today) and has setup-gradle provide exactly that, then calls gradle directly. Same Gradle the wrapper would have downloaded, read from the same file — so when you upgrade the wrapper, CI moves with it and there's no hardcoded version to drift.

The chmod +x gradlew from the previous PR is gone with it; nothing runs the script now.

The alternative, if you'd rather

Gradle's own guidance is to commit gradle-wrapper.jar — it's what makes ./gradlew work on a machine with no Gradle installed, which is the entire point of the wrapper. Your .gitignore opts out, presumably to keep a binary out of a public repo. That's a defensible call, but worth knowing it's a deviation, and it means anyone cloning this repo fresh can't build until they run Gradle some other way first.

If you'd rather commit it, git add -f gradle/wrapper/gradle-wrapper.jar, drop the ignore line, and this workflow can go back to ./gradlew — I can't upload a binary through the API, so that one's yours.

State of the dry run

Cleared so far: checkout, compileSdk 37 install, JDK 17, and the keystore opening with your alias. Still unproven: R8, the baseline profile, and jarsigner.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Miqsf1M14nY5TKiZHzyjNY

---

Note

Low Risk
CI-only release workflow change; build still uses the same pinned Gradle version and the same bundleRelease gate.

Overview
Fixes release CI failing on fresh checkouts with Unable to access jarfile gradle/wrapper/gradle-wrapper.jar because gradle-wrapper.jar is gitignored and never present on the runner.

The workflow now parses the pinned version from gradle-wrapper.properties, passes it to gradle/actions/setup-gradle@v4, and runs gradle :app:bundleRelease instead of ./gradlew (and drops the chmod +x gradlew workaround).

Header comments for RELEASE_TOKEN are clarified to describe any credential that can bypass the branch ruleset (fine-grained PAT or GitHub App token), not only a PAT with specific scopes.

^{Reviewed by Cursor Bugbot for commit bfff849. Bugbot is set up for automated code reviews on this repo. Configure here.}