[codex] Enforce GCP release lab artifacts

[adamcohenhillel]

Summary

This PR corrects the release/lab path so OpenPhone release publishing is explicitly GCP-backed instead of silently dispatching the Android compile to an ambiguous self-hosted build runner.

It:

• replaces the release build job with a GitHub-hosted controller that authenticates to GCP via Workload Identity Federation;
• adds scripts/lab/gcp/run-release.sh to create a disposable GCP VM, use warm cache state, build target-files/OTA tooling, run the emulator gate, copy artifacts back, and clean up;
• adds scripts/stage-release-ota.sh to stage an OTA from target-files using Android releasetools instead of relying on the Lineage bacon wrapper as the artifact contract;
• makes non-dry release publishing require the GCP emulator gate;
• adds GCP lab workflow summaries with project, zone, VM, ref, cache mode, cleanup, and disabled VM identity details;
• updates public docs/comments so AWS/EC2 and openphone-build are not described as the official OpenPhone CI/CD path.

Why

The previous release workflow looked GCP-related, but the real Android compile still used runs-on: [self-hosted, openphone-build], which resolved to non-GCP infrastructure. That defeated the goal: trusted PRs and releases need evidence from a real GCP build/emulator path, not a shallow smoke or hidden runner.

Validation

• bash -n scripts/stage-release-ota.sh scripts/lab/gcp/run-release.sh scripts/lab/gcp/run-smoke.sh scripts/check-assistant-java.sh scripts/bootstrap-android-build-host.sh
• Ruby YAML parse for .github/workflows/release.yml and .github/workflows/gcp-lab.yml
• git diff --check
• ./scripts/check.sh
• ./scripts/check-release-notes.sh v0.0.2 docs/releases/0.0.2.md
• Confirmed gh release view v0.0.2 still reports release not found

Remaining Before Merge

• Run the GCP release lab path from this branch and inspect artifacts/logs.
• Confirm the run shows GCP project/zone/VM/source/cache/emulator/artifact validation evidence.
• Publish v0.0.2 only after that GCP build/emulator/release path passes.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openphone-docs	Ready	Preview, Comment	Jul 2, 2026 11:01am

[adamcohenhillel]

Validation update before merge:

• PR CI passed: https://github.com/secondly-com/OpenPhone/actions/runs/28585068059
• Manual GCP emulator lab passed on this branch: https://github.com/secondly-com/OpenPhone/actions/runs/28585197367
  • GCP VM: openphone-lab-manual-108-1
  • Source ref: b9c824bcca107654ed99da47959e8eb4ecb386fe
  • Cache mode: snapshot from openphone-cache-x86-64-bp4a-20260701-032204
  • Built/booted OpenPhone SDK Phone x86_64 / emu64x
  • boot_completed=1
  • Found openphone_agent, openphone_context, and openphone_assistant_data
  • Found org.openphone.assistant versionCode:165
  • Ran runtime CLI status smoke, runtime screen smoke, and local assistant task smoke
  • Uploaded logcat, screenshot, runtime status, screen result, service checks, and emulator logs
  • Cleanup verified: temporary VM and per-run disks deleted; only persistent warm cache disk remains
• Release dry-run passed on this branch: https://github.com/secondly-com/OpenPhone/actions/runs/28587240629

Next after merge: dispatch the non-dry v0.0.2 release from main, which should build/stage/publish the real release assets through the GCP release lab.