feat: trigger mobile release from the main release workflow

Adds a reusable mobile release workflow call from the release pipeline
Passes version, build number, and release tag into Android artifact publishing
Tightens release workflow shell quoting and version handling

.github/workflows/mobile-release.yml

@@ -12,16 +12,32 @@ on:
         required: false
         type: string
       upload_github_release:
-        description: Upload Android artifacts to the matching GitHub Release when running on a tag.
+        description: Upload Android artifacts to GitHub Release. Requires release_tag when called by the release workflow.
         required: false
-        default: true
+        default: false
+        type: boolean
+  workflow_call:
+    inputs:
+      version_name:
+        description: Version name / marketing version. Leave empty to use package.json version.
+        required: false
+        type: string
+      build_number:
+        description: Build number. Leave empty to use GitHub run number.
+        required: false
+        type: string
+      release_tag:
+        description: Existing GitHub Release tag to attach Android artifacts to.
+        required: false
+        type: string
+      upload_github_release:
+        description: Upload Android artifacts to the matching GitHub Release.
+        required: false
+        default: false
         type: boolean
-  push:
-    tags:
-      - "v*"
 
 concurrency:
-  group: mobile-release-${{ github.event_name == 'workflow_dispatch' && github.run_id || github.ref }}
+  group: mobile-release-${{ inputs.release_tag != '' && inputs.release_tag || github.run_id }}
   cancel-in-progress: false
 
 env:
@@ -46,20 +62,20 @@ jobs:
         run: |
           set -euo pipefail
 
-          input_version='${{ github.event.inputs.version_name }}'
+          input_version='${{ inputs.version_name }}'
-          input_build='${{ github.event.inputs.build_number }}'
+          input_build='${{ inputs.build_number }}'
+          input_release_tag='${{ inputs.release_tag }}'
           package_version="$(node -p "require('./package.json').version")"
 
           version_name="${input_version:-$package_version}"
           build_number="${input_build:-${{ github.run_number }}}"
-          release_tag=""
+          release_tag="$input_release_tag"
-          if [[ "${GITHUB_REF_TYPE:-}" == "tag" ]]; then
-            release_tag="$GITHUB_REF_NAME"
-          fi
 
-          echo "version_name=$version_name" >> "$GITHUB_OUTPUT"
+          {
-          echo "build_number=$build_number" >> "$GITHUB_OUTPUT"
+            echo "version_name=$version_name"
-          echo "release_tag=$release_tag" >> "$GITHUB_OUTPUT"
+            echo "build_number=$build_number"
+            echo "release_tag=$release_tag"
+          } >> "$GITHUB_OUTPUT"
 
   android-release:
     name: Android signed release
@@ -116,7 +132,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload Android artifacts to GitHub Release
-        if: needs.resolve-version.outputs.release_tag != '' && (github.event_name != 'workflow_dispatch' || github.event.inputs.upload_github_release == 'true')
+        if: inputs.upload_github_release && needs.resolve-version.outputs.release_tag != ''
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_TAG: ${{ needs.resolve-version.outputs.release_tag }}

.github/workflows/release.yml

@@ -35,13 +35,16 @@ jobs:
 
       - name: Get version
         id: get_version
+        env:
+          RELEASE_INPUT_VERSION: ${{ github.event.inputs.version }}
+          RELEASE_REF: ${{ github.ref }}
         run: |
-          if [[ -n "${{ github.event.inputs.version }}" ]]; then
+          if [[ -n "$RELEASE_INPUT_VERSION" ]]; then
-            echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
+            echo "version=$RELEASE_INPUT_VERSION" >> "$GITHUB_OUTPUT"
-          elif [[ "${{ github.ref }}" == refs/tags/* ]]; then
+          elif [[ "$RELEASE_REF" == refs/tags/* ]]; then
-            echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+            echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
           else
-            echo "version=0.0.0-dev" >> $GITHUB_OUTPUT
+            echo "version=0.0.0-dev" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Extract changelog for release
@@ -173,8 +176,8 @@ jobs:
           security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
           security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
 
-          echo "$APPLE_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12
+          echo "$APPLE_CERTIFICATE" | base64 --decode > "$RUNNER_TEMP/certificate.p12"
-          security import $RUNNER_TEMP/certificate.p12 \
+          security import "$RUNNER_TEMP/certificate.p12" \
             -P "$APPLE_CERTIFICATE_PASSWORD" \
             -A -t cert -f pkcs12 \
             -k "$KEYCHAIN_PATH"
@@ -389,8 +392,19 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+  mobile-release:
+    needs: create-release
+    if: ${{ github.event.inputs.dry_run != 'true' }}
+    uses: ./.github/workflows/mobile-release.yml
+    with:
+      version_name: ${{ needs.create-release.outputs.version }}
+      build_number: ${{ github.run_number }}
+      release_tag: v${{ needs.create-release.outputs.version }}
+      upload_github_release: true
+    secrets: inherit
+
   finalize-release:
-    needs: [create-release, build-desktop-electron-macos, build-desktop-electron-windows, publish-npm, combine-electron-manifests]
+    needs: [create-release, build-desktop-electron-macos, build-desktop-electron-windows, publish-npm, combine-electron-manifests, mobile-release]
     runs-on: ubuntu-latest
     env:
       DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
@@ -486,7 +500,7 @@ jobs:
           curl --fail-with-body -sS -X POST \
             -H "Authorization: Bearer $WEBSITE_TOKEN" \
             -H "Accept: application/vnd.github+json" \
-            https://api.github.com/repos/$WEBSITE_REPO/dispatches \
+            "https://api.github.com/repos/$WEBSITE_REPO/dispatches" \
             -d @- <<JSON
           {
             "event_type": "site_refresh_requested",