From c8e95b8c77babb10a9e7578a36ba35fe6f38ff9f Mon Sep 17 00:00:00 2001
From: SimpleTest <simpletestxxx@gmail.com>
Date: Tue, 28 Jul 2026 04:32:13 +0300
Subject: [PATCH] Verify universal APKs generated from Play bundles

---
 android/Dockerfile               | 40 +++++++++++++++++++++++++++++++-
 scripts/android-release-build.sh | 10 ++++++--
 2 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/android/Dockerfile b/android/Dockerfile
index a36f060..d0ec932 100644
--- a/android/Dockerfile
+++ b/android/Dockerfile
@@ -299,7 +299,33 @@ RUN --mount=type=cache,target=/home/gradle/.gradle,uid=1000,gid=1000 \
         app/build/outputs/bundle/release/signing-verification.txt \
     && java -jar /opt/bundletool.jar validate \
         --bundle=app/build/outputs/bundle/release/app-release.aab \
-        >app/build/outputs/bundle/release/bundletool-validation.txt
+        >app/build/outputs/bundle/release/bundletool-validation.txt \
+    && java -jar /opt/bundletool.jar build-apks \
+        --bundle=app/build/outputs/bundle/release/app-release.aab \
+        --output=app/build/outputs/bundle/release/app-release-universal.apks \
+        --mode=universal \
+        --ks=/run/secrets/android_upload_keystore \
+        --ks-pass=file:/run/secrets/android_upload_password \
+        --ks-key-alias="${WNH_ANDROID_SIGNING_KEY_ALIAS}" \
+        --key-pass=file:/run/secrets/android_upload_password \
+        --overwrite \
+    && unzip -p \
+        app/build/outputs/bundle/release/app-release-universal.apks \
+        universal.apk \
+        >app/build/outputs/bundle/release/app-release-universal.apk \
+    && "${ANDROID_HOME}/build-tools/37.0.0/apksigner" \
+        verify --verbose --print-certs \
+        app/build/outputs/bundle/release/app-release-universal.apk \
+        >app/build/outputs/bundle/release/universal-signing-certificate.txt \
+    && grep -Fqi \
+        "certificate SHA-256 digest: $(printf '%s' "${WNH_SIGNING_CERT_SHA256}" | tr -d ':')" \
+        app/build/outputs/bundle/release/universal-signing-certificate.txt \
+    && "${ANDROID_HOME}/build-tools/37.0.0/aapt2" dump badging \
+        app/build/outputs/bundle/release/app-release-universal.apk \
+        | sed -n "s/^package: name='\\([^']*\\)'.*/\\1/p" \
+        >app/build/outputs/bundle/release/universal-package-name.txt \
+    && grep -Fx "org.whoneedhelp.mobile" \
+        app/build/outputs/bundle/release/universal-package-name.txt
 
 FROM scratch AS release-artifact
 
@@ -311,9 +337,21 @@ COPY --from=android-release-sdk \
 COPY --from=android-release-sdk \
     /workspace/android/app/build/outputs/bundle/release/app-release.aab \
     /who-need-help-release.aab
+COPY --from=android-release-sdk \
+    /workspace/android/app/build/outputs/bundle/release/app-release-universal.apks \
+    /who-need-help-release-universal.apks
+COPY --from=android-release-sdk \
+    /workspace/android/app/build/outputs/bundle/release/app-release-universal.apk \
+    /who-need-help-release-universal.apk
 COPY --from=android-release-sdk \
     /workspace/android/app/build/outputs/apk/release/signing-certificate.txt \
     /signing-certificate.txt
+COPY --from=android-release-sdk \
+    /workspace/android/app/build/outputs/bundle/release/universal-signing-certificate.txt \
+    /universal-signing-certificate.txt
+COPY --from=android-release-sdk \
+    /workspace/android/app/build/outputs/bundle/release/universal-package-name.txt \
+    /universal-package-name.txt
 COPY --from=android-release-sdk \
     /workspace/android/app/build/outputs/apk/release/package-name.txt \
     /package-name.txt
diff --git a/scripts/android-release-build.sh b/scripts/android-release-build.sh
index e2f0dd6..31aa41b 100755
--- a/scripts/android-release-build.sh
+++ b/scripts/android-release-build.sh
@@ -95,8 +95,12 @@ docker build \
 for artifact in \
   "$OUTPUT_DIR/who-need-help-release.apk" \
   "$OUTPUT_DIR/who-need-help-release.aab" \
+  "$OUTPUT_DIR/who-need-help-release-universal.apks" \
+  "$OUTPUT_DIR/who-need-help-release-universal.apk" \
   "$OUTPUT_DIR/signing-certificate.txt" \
+  "$OUTPUT_DIR/universal-signing-certificate.txt" \
   "$OUTPUT_DIR/package-name.txt" \
+  "$OUTPUT_DIR/universal-package-name.txt" \
   "$OUTPUT_DIR/bundle-signing-verification.txt" \
   "$OUTPUT_DIR/bundletool-validation.txt" \
   "$OUTPUT_DIR/source-fingerprint.sha256" \
@@ -111,5 +115,7 @@ done
 
 sha256sum \
   "$OUTPUT_DIR/who-need-help-release.apk" \
-  "$OUTPUT_DIR/who-need-help-release.aab"
-echo "Signed Android APK, Play AAB, certificate report, and lint report: $OUTPUT_DIR"
+  "$OUTPUT_DIR/who-need-help-release.aab" \
+  "$OUTPUT_DIR/who-need-help-release-universal.apks" \
+  "$OUTPUT_DIR/who-need-help-release-universal.apk"
+echo "Signed Android APK, Play AAB, universal APK set, reports, and lint report: $OUTPUT_DIR"