From 370b417bcb355cf18776b328d685429fd763e444 Mon Sep 17 00:00:00 2001
From: Sambit Biswas <sambit.biswas2@gmail.com>
Date: Tue, 1 Sep 2026 20:16:46 -0400
Subject: [PATCH] ci: publish Android APKs only from main

---
 .github/workflows/ci.yml         |  9 +++++++--
 README.md                        |  2 +-
 scripts/check-ci-policy.test.mjs | 18 ++++++++++++++++++
 3 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 73859289..5d58d447 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -157,12 +157,11 @@ jobs:
           "emulator"
           "system-images;android-36;google_apis;x86_64"
 
-      - name: Verify Android and assemble debug APK
+      - name: Verify Android
         run: >-
           ./gradlew
           :app:testDebugUnitTest
           :app:lintDebug
-          :app:assembleDebug
           :app:compileDebugAndroidTestKotlin
           --stacktrace
 
@@ -178,10 +177,16 @@ jobs:
           disable-animations: true
           script: ./gradlew :app:connectedDebugAndroidTest --stacktrace
 
+      - name: Assemble installable debug APK
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+        run: ./gradlew :app:assembleDebug --stacktrace
+
       - name: Record APK checksum
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
         run: sha256sum app/build/outputs/apk/debug/app-debug.apk > app/build/outputs/apk/debug/app-debug.apk.sha256
 
       - name: Upload installable debug APK
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: aiden-on-the-go-debug-apk
diff --git a/README.md b/README.md
index a7fd8ec1..a40d0fe7 100644
--- a/README.md
+++ b/README.md
@@ -91,7 +91,7 @@ The native Aiden On The Go iPhone and iPad client lives in [`ios/`](ios/README.m
 
 ### Mobile distribution
 
-The iPhone and iPad app is distributed through **TestFlight only**. GitHub releases do not publish an IPA; [`ios/README.md`](ios/README.md) documents local development and device validation. Android validation builds remain separate from the macOS release and are uploaded by CI as installable APK artifacts.
+The iPhone and iPad app is distributed through **TestFlight only**. GitHub releases do not publish an IPA; [`ios/README.md`](ios/README.md) documents local development and device validation. Android validation remains separate from the macOS release. Pull requests run the Android verification gates without retaining an installable artifact; relevant merges to `main` publish the debug APK and its checksum.
 
 The development launcher prepares a cached, ad-hoc-signed **Aiden Agent Dev** runtime that can run beside the installed **Aiden Agent** app. Development uses separate Application Support, Chromium session, log, crash, and `~/.aiden-dev` roots; it does not copy production data, register global shortcuts, or check the production update feed by default. Set `AIDEN_DEV_GLOBAL_SHORTCUTS=1` only when a development run intentionally needs the global bindings.
 
diff --git a/scripts/check-ci-policy.test.mjs b/scripts/check-ci-policy.test.mjs
index 3f3cf52f..1e6f1365 100644
--- a/scripts/check-ci-policy.test.mjs
+++ b/scripts/check-ci-policy.test.mjs
@@ -9,6 +9,14 @@ const catalogWorkflowUrl = new URL(
   import.meta.url,
 );
 
+function workflowStep(workflow, name) {
+  const marker = `      - name: ${name}`;
+  const start = workflow.indexOf(marker);
+  assert.notEqual(start, -1, `Missing workflow step: ${name}`);
+  const next = workflow.indexOf("\n      - name:", start + marker.length);
+  return workflow.slice(start, next === -1 ? workflow.length : next);
+}
+
 test("Android CI only runs for Android or CI workflow changes", async () => {
   const workflow = await readFile(workflowUrl, "utf8");
 
@@ -20,6 +28,16 @@ test("Android CI only runs for Android or CI workflow changes", async () => {
   assert.match(workflow, /^ {4}needs: changes$/mu);
   assert.match(workflow, /^ {4}if: \$\{\{ needs\.changes\.outputs\.android == 'true' \}\}$/mu);
   assert.match(workflow, /npm run test:model-catalog/u);
+
+  const mainPushOnly =
+    /if: \$\{\{ github\.event_name == 'push' && github\.ref == 'refs\/heads\/main' \}\}/u;
+  assert.doesNotMatch(workflowStep(workflow, "Verify Android"), /:app:assembleDebug/u);
+
+  const assembly = workflowStep(workflow, "Assemble installable debug APK");
+  assert.match(assembly, mainPushOnly);
+  assert.match(assembly, /:app:assembleDebug/u);
+  assert.match(workflowStep(workflow, "Record APK checksum"), mainPushOnly);
+  assert.match(workflowStep(workflow, "Upload installable debug APK"), mainPushOnly);
 });
 
 test("model catalog workflow verifies read-only and publishes with isolated credentials", async () => {