Build standalone Android APKs in CI

[phucnguyen1707]

Summary

• build a standalone Android APK on ordinary PR and main-branch CI without consuming EAS cloud credits
• pin Java, Android SDK/build-tools, and NDK inputs for reproducibility
• upload the debug-signed release APK as a GitHub Actions artifact
• keep EAS builds manual-only and reserve production submission for an explicit dispatch
• document installation, signing limitations, and the path to a store-ready artifact

Validation

• mobile typecheck and lint: pass
• mobile tests: 6 passed
• Expo Android and iOS bundle exports: pass
• clean Expo Android prebuild: pass
• GitHub Actions android-apk: pass (8m33s)
• produced APK: 69,264,518 bytes; archive integrity verified
• final Fable max-effort reviews: approved

No paid EAS build was started.

[github-actions]

ThreatCrush Security Scan

49 finding(s)

MEDIUM: 31 | LOW: 18

Severity	Rule	Location
MEDIUM	js-open-redirect	apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/newtab.js:237
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/newtab.js:266
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/newtab.js:336
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/options.js:305
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/sidepanel.js:77
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/sidepanel.js:165
MEDIUM	sh-remote-script-execution	apps/desktop/launcher/tronbrowser:84
MEDIUM	sh-remote-script-execution	apps/desktop/launcher/tronbrowser:394
MEDIUM	js-unescaped-html-sink	apps/extensions/public/store.js:77
MEDIUM	js-unescaped-html-sink	apps/extensions/public/store.js:227
MEDIUM	js-unescaped-html-sink	apps/extensions/public/store.js:569
MEDIUM	js-unescaped-html-sink	apps/web/public/app.js:29
MEDIUM	js-unescaped-html-sink	apps/web/public/dns.js:54
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:138
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:143
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:242
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:260
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:870
MEDIUM	js-unescaped-html-sink	apps/web/public/settings.js:96
MEDIUM	js-unescaped-html-sink	apps/web/public/settings.js:168
MEDIUM	js-dynamic-code-execution	packages/sdk/src/mcp/tools.ts:80
MEDIUM	js-dynamic-code-execution	packages/sdk/src/mcp/tools.ts:92
MEDIUM	js-dynamic-code-execution	packages/sdk/src/mcp/tools.ts:103
MEDIUM	js-dynamic-code-execution	packages/sdk/src/page.ts:65
MEDIUM	js-dynamic-code-execution	packages/sdk/src/page.ts:70
MEDIUM	sql-template-interpolation	services/api/src/store/db.ts:116
MEDIUM	js-dynamic-code-execution	services/api/src/store/scanner.ts:44
MEDIUM	sh-predictable-temp-path	start.sh:25
LOW	js-dynamic-code-execution	packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW	js-unescaped-html-sink	packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW	js-unescaped-html-sink	packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW	js-dynamic-code-execution	packages/browser-core/src/automation/extract-script.test.ts:6
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:35
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:47
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:70
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:89
LOW	js-dynamic-code-execution	packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/snapshot-script.test.ts:24
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/snapshot-script.test.ts:63
LOW	js-unescaped-html-sink	packages/provenance/src/scan.test.ts:47
LOW	js-unescaped-html-sink	packages/provenance/src/scan.test.ts:170
LOW	js-unescaped-html-sink	packages/provenance/src/scan.test.ts:216
LOW	secret-generic-api-key	packages/storage/src/config.ts:51
LOW	secret-generic-credential	packages/storage/src/config.ts:51
LOW	js-dynamic-code-execution	services/api/src/store/scanner.test.ts:32
LOW	js-hardcoded-crypto-key	services/api/src/store/signing.test.ts:24

Snippets are redacted; ThreatCrush never prints matched credential material.