feat(release): Automate changelog, asset updates, and tagging (#4407)

.github/workflows/release.yml

@@ -11,6 +11,10 @@ on:
         description: 'The tag that triggered the release'
         required: true
         type: string
+      commit_sha:
+        description: 'The commit SHA to build and tag'
+        required: false
+        type: string
       channel:
         description: 'The channel to create a release for or promote to'
         required: true
@@ -52,12 +56,19 @@ permissions:
   attestations: write
 
 jobs:
+  run-lint:
+    uses: ./.github/workflows/reusable-lint.yml
+    with:
+      ref: ${{ inputs.commit_sha || inputs.tag_name }}
+    secrets: inherit
+
   prepare-build-info:
     runs-on: ubuntu-latest
     outputs:
       APP_VERSION_NAME: ${{ steps.get_version_name.outputs.APP_VERSION_NAME }}
       APP_VERSION_CODE: ${{ steps.calculate_version_code.outputs.versionCode }}
     env:
+      GRADLE_OPTS: "-Dorg.gradle.daemon=false"
       GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
       GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
       GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
@@ -65,7 +76,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.tag_name }}
+          ref: ${{ inputs.commit_sha || inputs.tag_name }}
           fetch-depth: 0
           submodules: 'recursive'
       - name: Set up JDK 17
@@ -102,9 +113,10 @@ jobs:
 
   release-google:
     runs-on: ubuntu-latest
-    needs: prepare-build-info
+    needs: [prepare-build-info, run-lint]
     environment: Release
     env:
+      GRADLE_OPTS: "-Dorg.gradle.daemon=false"
       GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
       GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
       GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
@@ -112,7 +124,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.tag_name }}
+          ref: ${{ inputs.commit_sha || inputs.tag_name }}
           fetch-depth: 0
           submodules: 'recursive'
       - name: Set up JDK 17
@@ -148,6 +160,27 @@ jobs:
           echo "MAPS_API_KEY=$GOOGLE_MAPS_API_KEY" >> ./secrets.properties
           echo "$GOOGLE_PLAY_JSON_KEY" > ./fastlane/play-store-credentials.json
 
+      - name: Determine previous tag
+        id: previous_tag
+        run: |
+          CURRENT_TAG="${{ inputs.tag_name }}"
+          # Find the tag reachable from the parent of the current tag
+          # Exclude tags with hyphens to skip pre-releases (e.g. -internal, -beta)
+          PREV_TAG=$(git describe --tags --abbrev=0 --exclude "*-*" "$CURRENT_TAG^" 2>/dev/null || echo "")
+          echo "Found previous tag: $PREV_TAG"
+          echo "PREV_TAG=$PREV_TAG" >> $GITHUB_OUTPUT
+
+      - name: Generate Changelog for Play Store
+        if: steps.previous_tag.outputs.PREV_TAG != ''
+        uses: mikepenz/release-changelog-builder-action@v6
+        id: build_changelog
+        with:
+          configuration: .github/release.yml
+          fromTag: ${{ steps.previous_tag.outputs.PREV_TAG }}
+          toTag: ${{ inputs.tag_name }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Setup Fastlane
         uses: ruby/setup-ruby@v1
         with:
@@ -158,7 +191,8 @@ jobs:
         env:
           VERSION_NAME: ${{ needs.prepare-build-info.outputs.APP_VERSION_NAME }}
           VERSION_CODE: ${{ needs.prepare-build-info.outputs.APP_VERSION_CODE }}
-        run: bundle exec fastlane internal
+          CHANGELOG: ${{ steps.build_changelog.outputs.changelog }}
+        run: bundle exec fastlane internal changelog:"$CHANGELOG"
 
       - name: Upload Google AAB artifact
         if: always()
@@ -186,9 +220,10 @@ jobs:
 
   release-fdroid:
     runs-on: ubuntu-latest
-    needs: prepare-build-info
+    needs: [prepare-build-info, run-lint]
     environment: Release
     env:
+      GRADLE_OPTS: "-Dorg.gradle.daemon=false"
       GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
       GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
       GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
@@ -196,7 +231,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.tag_name }}
+          ref: ${{ inputs.commit_sha || inputs.tag_name }}
           fetch-depth: 0
           submodules: 'recursive'
       - name: Set up JDK 17
@@ -249,6 +284,18 @@ jobs:
     runs-on: ubuntu-latest
     needs: [prepare-build-info, release-google, release-fdroid]
     steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.commit_sha || inputs.tag_name }}
+          fetch-depth: 0
+
+      - name: Push Git Tag on Success
+        if: ${{ inputs.commit_sha != '' }}
+        run: |
+          git tag ${{ inputs.tag_name }} ${{ inputs.commit_sha }}
+          git push origin ${{ inputs.tag_name }}
+
       - name: Download all artifacts
         uses: actions/download-artifact@v7
         with: