dist.sh builds versioned, signed artifacts for both apps from a git tag

(semver drives Android versionCode/versionName and package.json). The
build-image/ Dockerfile pins the same toolchain for a portable,
containerized Gitea Actions runner (build-image.sh builds and pushes
it) so releases don't depend on any one machine's local setup.
Pushing vX.Y.Z now builds and publishes a Gitea Release automatically.

.gitea/workflows/release.yml

@@ -13,25 +13,13 @@ jobs:
     # regardless of this instance's default Actions permission mode.
     permissions:
       contents: write
-    # Runner defaults `run:` steps to `sh`, which doesn't understand
-    # `set -o pipefail` used below — force bash explicitly.
-    defaults:
-      run:
-        shell: bash
-    # Must match a label your act_runner is registered with. The runner's
-    # own default label-image is irrelevant here since `container:` below
-    # overrides the actual build image per-job.
-    runs-on: ubuntu-latest
+    # Must match the label your self-hosted act_runner registers with.
+    runs-on: self-hosted
     container:
       # :latest — always the most recently pushed build-image.sh output.
       # Pin to a specific tag here (see build-image/VERSION) if you need a
       # release build to be reproducible against an exact toolchain image.
       image: cr.ladkau.de/schwert-und-magie/builder:latest
-      # Lets the runner pull a private image without a manual `docker login`
-      # on the runner host — see docs/publish.md §4.3.
-      credentials:
-        username: ${{ secrets.REGISTRY_USER }}
-        password: ${{ secrets.REGISTRY_PASSWORD }}
 
     steps:
       - uses: actions/checkout@v4

README.md

@@ -159,7 +159,6 @@ publishes a Gitea Release with the versioned artifacts attached — see
    |---|---|
    | `RELEASE_KEYSTORE_B64` | `base64 -w0 SchwertUndMagieOnPebbleCompanionApp/release.keystore` |
    | `RELEASE_KEYSTORE_PROPERTIES` | full contents of `SchwertUndMagieOnPebbleCompanionApp/keystore.properties` |
-   | `REGISTRY_USER` / `REGISTRY_PASSWORD` | same as in `registry.env`, so the runner can pull the private build image |
 
    `GITEA_TOKEN` is injected automatically per job — nothing to add for it.
 4. `git tag v1.2.3 && git push origin v1.2.3`.

SchwertUndMagieOnPebbleCompanionApp/app/src/main/jni/build_nibtools.sh

@@ -42,11 +42,7 @@ fi
 if [ ! -d "${SRC}" ]; then
     echo "Unpacking nibtools..."
     tar -xzf "${TARBALL}" -C "${SCRIPT_DIR}"
-    # Hardcoded, not a glob: on a non-ephemeral runner workspace, a
-    # nibtools-*/ glob can also match SRC itself once it exists, or other
-    # stray nibtools-prefixed leftovers, and mv then fails with "target is
-    # not a directory" (multiple sources, no existing target dir).
-    mv "${SCRIPT_DIR}/nibtools-91344e0ee3" "${SRC}"
+    mv "${SCRIPT_DIR}"/nibtools-*/ "${SRC}"
     echo "Unpacked to ${SRC}"
 fi
 

docs/publish.md

@@ -285,21 +285,18 @@ line in `.gitea/workflows/release.yml` to the versioned tag instead.
    # https://gitea.com/gitea/act_runner — grab the latest release binary
    ./act_runner register --no-interactive \
      --instance <your gitea URL> --token <token> \
-     --name <runner-name> --labels ubuntu-latest:docker://node:20-bookworm
+     --name <runner-name> --labels self-hosted:docker://node:20-bookworm
    ./act_runner daemon
    ```
    The image after `docker://` in `--labels` is only a fallback for jobs that
    don't specify their own `container:` — irrelevant here since
    `.gitea/workflows/release.yml` always pins its own image, but the runner
    still needs a Docker-executor label registered to use that executor at
-   all. The label name itself (`ubuntu-latest` above) must match `runs-on:`
-   in `.gitea/workflows/release.yml` — edit both together if you rename it,
-   or reuse a label an existing runner already advertises (check Site Admin →
-   Actions → Runners) to skip registering a new one entirely.
-
-   No manual `docker login` needed on the runner host — the workflow's
-   `container:` block authenticates the image pull itself via the
-   `REGISTRY_USER`/`REGISTRY_PASSWORD` secrets (§4.3).
+   all. The label name itself (`self-hosted`) must match `runs-on:` in
+   `.gitea/workflows/release.yml` — edit both together if you rename it.
+4. The runner's Docker daemon needs pull access to the registry — run
+   `docker login <registry>` once on that machine with the same credentials
+   as `registry.env`.
 
 ### 4.3 Repo secrets
 
@@ -309,8 +306,6 @@ Settings → Actions → Secrets, add:
 |---|---|
 | `RELEASE_KEYSTORE_B64` | `base64 -w0 SchwertUndMagieOnPebbleCompanionApp/release.keystore` |
 | `RELEASE_KEYSTORE_PROPERTIES` | the full contents of `SchwertUndMagieOnPebbleCompanionApp/keystore.properties` (§2.2) |
-| `REGISTRY_USER` | same as `REGISTRY_USER` in `registry.env` |
-| `REGISTRY_PASSWORD` | same as `REGISTRY_PASSWORD` in `registry.env` |
 
 `secrets.GITEA_TOKEN` (used to create the release and upload assets) is
 Gitea's own auto-generated per-job token — nothing to create or add yourself.