Harden APK build pipeline and Android download landing flow

.github/workflows/build-apk.yml

@@ -2,6 +2,8 @@ name: Build Android APK
 on:
   push:
     branches: [ main ]
+  pull_request:
+    branches: [ main ]
   workflow_dispatch:
 
 jobs:
@@ -16,7 +18,7 @@ jobs:
         with:
           node-version: 20
           cache: 'npm'
-          cache-dependency-path: App_369/package-lock.json
+          cache-dependency-path: package-lock.json
 
       - name: 🏗 Setup Expo
         uses: expo/expo-github-action@v8
@@ -26,9 +28,9 @@ jobs:
           token: ${{ secrets.EXPO_TOKEN }}
 
       - name: 📦 Install dependencies
-        working-directory: ./App_369
-        run: npm install
+        run: npm ci
 
       - name: 🚀 Build APK
-        working-directory: ./App_369
-        run: eas build --platform android --profile preview --non-interactive
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+        run: npm run build:apk

DEPLOY_APK.md

@@ -0,0 +1,73 @@
+# APK Distribution Runbook
+
+This runbook covers generating and publishing the Android APK so users can install ASTRA MATRIX from your landing page.
+
+## 1) Build the APK with EAS
+
+Use the preview profile for downloadable APK output:
+
+```bash
+npm ci
+npm run build:apk
+```
+
+Use production profile when you are ready for release-grade signing controls:
+
+```bash
+npm run build:apk:production
+```
+
+## 2) Retrieve the build artifact
+
+After `eas build` completes, download the generated APK and rename it:
+
+```bash
+astra-matrix-latest.apk
+```
+
+## 2.5) Publish artifact + metadata in one command
+
+Use the helper script to copy a real APK into the landing download path and generate checksum metadata:
+
+```bash
+scripts/publish-apk-release.sh /path/to/your-real.apk 1.0.0 2026-05-05T08:00:00Z "Initial public APK release"
+```
+
+This updates:
+
+- `public/download/astra-matrix-latest.apk`
+- `public/download/latest.json`
+
+The landing page reads `latest.json` to show version/build date/size/SHA256.
+
+## 3) Publish on your server
+
+Upload the APK to your web root so it is publicly available at:
+
+```text
+/download/astra-matrix-latest.apk
+```
+
+Your landing page already links to this path.
+
+## 4) Recommended web server headers for APK
+
+Set these response headers for the APK file:
+
+- `Content-Type: application/vnd.android.package-archive`
+- `Content-Disposition: attachment; filename="astra-matrix-latest.apk"`
+
+## 5) Post-release smoke test
+
+From an Android device:
+
+1. Open landing page
+2. Tap **Download APK**
+3. Install package
+4. Launch app and verify startup scene renders without crash
+
+## 6) Security and signing reminders
+
+- Keep EAS signing credentials backed up and access-controlled.
+- Never embed private keys or long-lived API secrets directly in the mobile client.
+- If Gemini integration is required in production, use a backend proxy/API and not a raw client-side secret.

app.json

@@ -1,6 +1,7 @@
 {
   "expo": {
     "name": "App_369",
+    "owner": "psybrninja",
     "slug": "app-369",
     "version": "1.0.0",
     "orientation": "portrait",
@@ -26,6 +27,11 @@
     },
     "web": {
       "favicon": "./assets/favicon.png"
+    },
+    "extra": {
+      "eas": {
+        "projectId": "440a38e6-afe8-42f9-82a5-f9f987e5c44d"
+      }
     }
   }
 }

eas.json

@@ -13,7 +13,11 @@
         "buildType": "apk"
       }
     },
-    "production": {}
+    "production": {
+      "android": {
+        "buildType": "apk"
+      }
+    }
   },
   "submit": {
     "production": {}

package.json

@@ -4,10 +4,14 @@
   "description": "",
   "main": "node_modules/expo/AppEntry.js",
   "scripts": {
-    "start": "node src/cli/index.js",
+    "start": "expo start",
+    "start:cli": "node src/cli/index.js",
     "gui": "expo start",
     "android": "expo start --android",
-    "build:apk": "eas build --platform android --profile preview",
+    "web": "expo start --web",
+    "build:web": "expo export --platform web",
+    "build:apk": "eas build --platform android --profile preview --non-interactive",
+    "build:apk:production": "eas build --platform android --profile production --non-interactive",
     "test": "echo \"Error: no test specified\" && exit 1"
   },
   "repository": {

public/download/latest.json

@@ -0,0 +1,9 @@
+{
+  "version": "0.0.0-placeholder",
+  "buildDate": "1970-01-01T00:00:00Z",
+  "fileName": "astra-matrix-latest.apk",
+  "fileSizeBytes": 0,
+  "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "minAndroidSdk": 24,
+  "releaseNotes": "Placeholder artifact. Upload a real APK to publish a release."
+}