refactor(build): extract Firebase/Google-services into a -Pgoogle-only script so the FOSS build is genuinely Firebase-free (F-Droid) + bump 1.0.7 (#534)

The FOSS build (bare `assembleRelease`) already skipped applying the Firebase
Gradle plugins at runtime, but every Firebase/Google-services coordinate — the
two plugin ids, the Crashlytics per-build-type config, and the firebase-*
dependencies — still lived inline in app/build.gradle.kts, guarded only by
`if (googleBuild)`. F-Droid's source scanner is static, so it still saw those
non-FOSS coordinates in a file that survives into the FOSS build. The fdroiddata
maintainer asked us to remove the non-FOSS deps in prebuild rather than
allow-list them with scanignore.

This extracts ALL Google/Firebase build config into
gradle/google-services.gradle.kts, applied from app/build.gradle.kts ONLY under
`-Pgoogle` (`if (googleBuild) { apply(from = ...) }`). The bare FOSS build never
applies it, so it compiles ZERO Firebase: no plugins on the classpath, no
firebase-* deps, no Crashlytics config, and google-services.json is not required
to assemble it. Verified: aapt2 dump strings on the FOSS APK shows no
firebase/gms strings and the DEX contains no com.google.firebase /
com.google.android.gms classes, while the `-Pgoogle` APK still links Firebase.

The extracted file lives in the repo-root gradle/ dir (not app/) because Android
Lint's build-script visitor (lintVitalRelease, which the FOSS release build runs)
crashes trying to FIR-resolve a standalone apply(from=...) script inside an
Android module; the root project has no Android lint task. Its Crashlytics
mapping/symbol toggles are set by reflection because an apply-script has no AGP /
crashlytics DSL types on its classpath.

The fdroiddata recipe now removes the file in `prebuild:
rm -f gradle/google-services.gradle.kts` before the scanner runs (no
scanignore/scandelete), and the version/toolchain fields + MaintainerNotes are
updated to 1.0.7. Adds changelog 8.txt (build-internal, no user-facing change
vs 1.0.6). Part of #465.

Co-authored-by: Jason Monk <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>

Author: 3 people

app/build.gradle.kts

@@ -19,16 +19,32 @@ plugins {
 // non-default and forced task-name sniffing to re-derive "is this credentialed?".
 val googleBuild = project.hasProperty("google")
 
-// The Firebase Gradle plugins (`google-services`, `firebase-crashlytics`) are
-// applied only for the Google build. The FOSS build skips them entirely so that:
-//   * `google-services.json` is NOT required to assemble it, and
-//   * no Play-Services / Firebase Gradle processing runs.
-// Keeping the plugins behind the flag preserves the google-services plugin's
-// hard-fail-on-missing-credentials — a `-Pgoogle` build with no
+// ALL Firebase / Google-services build config — the two Gradle plugins, the
+// Crashlytics per-build-type setup, and the Firebase runtime dependencies —
+// lives in gradle/google-services.gradle.kts and is applied ONLY for the
+// `-Pgoogle` build. The bare FOSS build never applies it, so the FOSS build
+// compiles ZERO Firebase/Google-services: no plugins on the classpath, no
+// Firebase deps, no Crashlytics config, and `google-services.json` is NOT
+// required to assemble it.
+//
+// The config is extracted into a separate file (rather than guarded inline) so
+// that NO Firebase dependency/plugin coordinate appears in any build file that
+// survives into the FOSS build. F-Droid's static source scanner therefore sees
+// no non-FOSS coordinates; the fdroiddata recipe removes the file in `prebuild:`
+// before scanning (safe — the FOSS build never applies it).
+//
+// The script lives OUTSIDE app/ (in the repo-root gradle/ dir) because Android
+// Lint's build-script visitor (lintVitalRelease) crashes when it tries to build
+// a FIR light-class for a standalone `apply(from=...)` script inside a module
+// that has the Android plugin. Keeping it out of app/'s lint scan tree — the
+// root project has no Android lint task — sidesteps that upstream crash while
+// still letting the `-Pgoogle` app build apply it.
+//
+// Applying the plugins only under `-Pgoogle` also preserves the google-services
+// plugin's hard-fail-on-missing-credentials: a `-Pgoogle` build with no
 // `google-services.json` fails loudly rather than producing a broken APK.
 if (googleBuild) {
-    apply(plugin = "com.google.gms.google-services")
-    apply(plugin = "com.google.firebase.crashlytics")
+    apply(from = "$rootDir/gradle/google-services.gradle.kts")
 }
 
 // Loads a value from `.signing/release.properties` if that file exists.
@@ -109,8 +125,8 @@ android {
         applicationId = "com.rousecontext"
         minSdk = 24
         targetSdk = 35
-        versionCode = 7
-        versionName = "1.0.6"
+        versionCode = 8
+        versionName = "1.0.7"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 
@@ -149,17 +165,9 @@ android {
         debug {
             signingConfig = signingConfigs.getByName("debug")
             applicationIdSuffix = ".debug"
-            // No mapping upload in debug — the Crashlytics plugin runs even here
-            // (under `-Pgoogle`) because the library is linked in that build. We
-            // still skip the slow symbol upload work to keep debug assembly fast
-            // for iteration. Guarded so FOSS builds, which never apply the
-            // Crashlytics plugin, don't reference a missing extension.
-            if (googleBuild) {
-                configure<com.google.firebase.crashlytics.buildtools.gradle.CrashlyticsExtension> {
-                    mappingFileUploadEnabled = false
-                    nativeSymbolUploadEnabled = false
-                }
-            }
+            // Crashlytics per-build-type config (mapping/symbol upload toggles)
+            // lives in app/google-services.gradle.kts, applied only under
+            // `-Pgoogle`. The FOSS build has no Crashlytics extension to configure.
         }
         release {
             // Only sign when credentials are present; otherwise build unsigned
@@ -175,15 +183,8 @@ android {
             // AGP embeds VCS/commit info in the release APK by default, which is
             // non-reproducible. Drop it so F-Droid reproducible builds succeed.
             vcsInfo.include = false
-            // Release builds ship R8-obfuscated code; upload the mapping so
-            // Crashlytics deobfuscates stacks. We have no NDK code, so native
-            // symbol upload stays off. Guarded as above for FOSS builds.
-            if (googleBuild) {
-                configure<com.google.firebase.crashlytics.buildtools.gradle.CrashlyticsExtension> {
-                    mappingFileUploadEnabled = true
-                    nativeSymbolUploadEnabled = false
-                }
-            }
+            // Crashlytics mapping upload is configured in
+            // app/google-services.gradle.kts, applied only under `-Pgoogle`.
         }
     }
 
@@ -268,18 +269,15 @@ dependencies {
     ksp(libs.room.compiler)
 
     // Distribution-specific dependencies, selected by the `-Pgoogle` flag
-    // (issue #467). The Google build links Firebase (FCM wake + Crashlytics);
-    // the FOSS build links UnifiedPush (distributor-based wake) + ACRA (crash
-    // reporting via the relay's `POST /crash`) and zero firebase-* artifacts.
-    // Both distributions sit behind the same distribution-agnostic Koin seams
-    // (BackgroundDelivery, CrashReporter, device-identity providers — see
-    // app/src/{google,foss}).
-    if (googleBuild) {
-        implementation(platform(libs.firebase.bom))
-        implementation(libs.firebase.auth)
-        implementation(libs.firebase.messaging)
-        implementation(libs.firebase.crashlytics)
-    } else {
+    // (issue #467). The Google build links Firebase (FCM wake + Crashlytics) via
+    // app/google-services.gradle.kts (applied only under `-Pgoogle`, so no
+    // Firebase coordinate appears in any build file that survives into the FOSS
+    // build); the FOSS build links UnifiedPush (distributor-based wake) + ACRA
+    // (crash reporting via the relay's `POST /crash`) and zero firebase-*
+    // artifacts. Both distributions sit behind the same distribution-agnostic
+    // Koin seams (BackgroundDelivery, CrashReporter, device-identity providers —
+    // see app/src/{google,foss}).
+    if (!googleBuild) {
         implementation(libs.unifiedpush.connector)
         implementation(libs.acra.core)
         implementation(libs.acra.http)

fastlane/metadata/android/en-US/changelogs/7.txt

@@ -1,8 +1,6 @@
-First F-Droid release of the FOSS build.
-
-Wakes via UnifiedPush (no Firebase or Play Services), keeps an on-device audit
-log of every tool call, and secures each session with a hardware-backed keypair.
-On-demand MCP server with per-integration opt-in.
+FOSS build: wakes via UnifiedPush (no Firebase or Play Services), keeps an
+on-device audit log of every tool call, and secures each session with a
+hardware-backed keypair. On-demand MCP server with per-integration opt-in.
 
 Also: while a UnifiedPush distributor is connecting, Home now shows a neutral
 "Finishing delivery setup…" instead of a false "wake is off".

fastlane/metadata/android/en-US/changelogs/8.txt

@@ -0,0 +1,8 @@
+First F-Droid release of the FOSS build.
+
+Wakes via UnifiedPush (no Firebase or Play Services), keeps an on-device audit
+log of every tool call, and secures each session with a hardware-backed keypair.
+On-demand MCP server with per-integration opt-in.
+
+No user-facing changes since 1.0.6 — this release is a build-internal change
+that makes the FOSS build compile with zero Firebase/Google-services code.

fdroid/com.rousecontext.yml

@@ -75,21 +75,31 @@ Binaries: https://github.com/Monkopedia/rouse-context/releases/download/v%v/rous
 AllowedAPKSigningKeys: 7cc8d2d568eb3d20a5e190e77baa97b3bde80782dd2576f29088a16c4ce47850
 
 Builds:
-  - versionName: 1.0.6
-    versionCode: 7
-    # Build from the signed release tag. `v1.0.6` does not exist yet; it is
+  - versionName: 1.0.7
+    versionCode: 8
+    # Build from the signed release tag. `v1.0.7` does not exist yet; it is
     # created when the owner cuts the release. Until then this is a template.
     #
     # IMPORTANT — when copying this to fdroiddata, pin `commit:` to the IMMUTABLE
     # release SHA, NOT the tag:
-    #     git rev-parse v1.0.6^{commit}
+    #     git rev-parse v1.0.7^{commit}
     # and put that full 40-char SHA here. This matches the proven
     # com.monkopedia.healthdisconnect recipe, whose published Builds entry pins a
     # full commit SHA rather than a movable tag ref. A SHA can't be retargeted
     # after submission, so the from-source build is locked to exactly the bytes
     # F-Droid reviewed.
-    commit: v1.0.6
+    commit: v1.0.7
     subdir: app
+    # Remove the Google-only Gradle config BEFORE F-Droid scans/builds. All
+    # Firebase / Google-services build coordinates (the two Gradle plugins, the
+    # Crashlytics config, and the firebase-* dependencies) live exclusively in
+    # gradle/google-services.gradle.kts, which the app build applies ONLY under
+    # `-Pgoogle`. The bare FOSS build (what F-Droid runs) never applies it, so
+    # deleting it here is safe and leaves ZERO Firebase coordinates for the
+    # source scanner to see — no `scanignore` needed (the F-Droid maintainer
+    # asked us to remove the non-FOSS deps in prebuild rather than allow-list
+    # them). See app/build.gradle.kts (`if (googleBuild) { apply(from = ...) }`).
+    prebuild: rm -f gradle/google-services.gradle.kts
     # No flavor: the bare build is FOSS. The FOSS/Google split is a `-Pgoogle`
     # project property, not a product flavor, so the default `assembleRelease`
     # (which `gradle: [yes]` invokes) is exactly the FOSS variant. The no-flavor
@@ -125,10 +135,12 @@ Builds:
     # (no `-Pgoogle`, no `-Pdomain`), so this is satisfied today — just don't
     # regress it.
     #
-    # Reproducibility recon (issue #465) found nothing the scanner flags beyond
-    # the standard gradle/wrapper/gradle-wrapper.jar, which F-Droid allow-lists.
-    # No `scandelete` / `rm` is required. If a future fdroidserver scanner run
-    # disagrees, prefer `scandelete` over disabling the scan.
+    # The only non-FOSS coordinates in the tree are the Firebase plugins/deps in
+    # gradle/google-services.gradle.kts, which `prebuild:` deletes above before
+    # the scanner runs. Everything else the scanner might flag is the standard
+    # gradle/wrapper/gradle-wrapper.jar, which F-Droid allow-lists. No
+    # `scanignore` / `scandelete` is used — the maintainer asked us to remove the
+    # non-FOSS deps in prebuild instead of allow-listing them.
 
 MaintainerNotes: |-
     DRAFT recipe staged inside the upstream repo (fdroid/com.rousecontext.yml).
@@ -156,10 +168,37 @@ MaintainerNotes: |-
         be built with a bare assembleRelease (no stray -P flags) so it matches
         fdroidserver's bare build; release.yml already does this.
 
+    Firebase-free FOSS build (extract + prebuild-remove, NOT scanignore):
+      * ALL Firebase / Google-services build config — the google-services and
+        firebase-crashlytics Gradle plugins, the Crashlytics per-build-type
+        setup, and the firebase-* runtime dependencies — is extracted into
+        gradle/google-services.gradle.kts. app/build.gradle.kts applies that file
+        ONLY under `-Pgoogle` (`if (googleBuild) { apply(from = ...) }`). The
+        bare FOSS build never applies it, so it compiles ZERO Firebase: no
+        plugins on the classpath, no firebase-* deps, no Crashlytics config, and
+        google-services.json is not required to assemble it.
+      * Because every non-FOSS coordinate lives in that one extracted file, the
+        recipe's `prebuild: rm -f gradle/google-services.gradle.kts` deletes it
+        before F-Droid's source scanner runs, leaving nothing for the scanner to
+        flag. This replaces the earlier scanignore-free-but-inline approach: the
+        maintainer asked us to remove the non-FOSS deps in prebuild rather than
+        allow-list them, and this does exactly that with no `scanignore` /
+        `scandelete`.
+      * Verified: `aapt2 dump strings` on the FOSS app-release APK shows no
+        firebase/gms strings, and the DEX contains no com.google.firebase /
+        com.google.android.gms classes. (The wire field name `firebaseToken` and
+        UnifiedPush's own org.unifiedpush...FirebaseReceiver are distribution-
+        agnostic / FOSS and unrelated to Google Firebase.)
+      * The extracted file lives in the repo-root gradle/ dir (not app/) so that
+        Android Lint's build-script visitor (lintVitalRelease, which the FOSS
+        release build runs) does not try to FIR-resolve a standalone
+        apply(from=...) script inside an Android module and crash. The root
+        project has no Android lint task.
+
     Variant facts (do not regress):
       * Bare build = FOSS (UnifiedPush + ACRA, no Firebase/GMS). `-Pgoogle` is
         the Firebase build and must NOT be used for F-Droid.
-      * Toolchain at v1.0.6: AGP 8.13.2, Kotlin 2.2.21, JDK 21, compileSdk 36,
+      * Toolchain at v1.0.7: AGP 8.13.2, Kotlin 2.2.21, JDK 21, compileSdk 36,
         minSdk 24, targetSdk 35, Gradle 8.14.3.
       * FOSS-only runtime deps: UnifiedPush connector 2.5.0, ACRA 5.13.1.
 
@@ -168,5 +207,5 @@ MaintainerNotes: |-
 
 AutoUpdateMode: Version
 UpdateCheckMode: Tags ^v[0-9.]+$
-CurrentVersion: 1.0.6
-CurrentVersionCode: 7
+CurrentVersion: 1.0.7
+CurrentVersionCode: 8

gradle/google-services.gradle.kts

@@ -0,0 +1,86 @@
+// =============================================================================
+// Google/Firebase-only Gradle configuration — applied ONLY under `-Pgoogle`.
+// =============================================================================
+//
+// This file holds EVERY Firebase / Google-services build coordinate: the two
+// Gradle plugins, the Crashlytics per-build-type config, and the Firebase
+// runtime dependencies. It is applied from app/build.gradle.kts exclusively
+// when the `-Pgoogle` credentialed build is selected:
+//
+//     if (googleBuild) { apply(from = "$rootDir/gradle/google-services.gradle.kts") }
+//
+// The bare FOSS build never applies it, so the FOSS build compiles ZERO
+// Firebase/Google-services: no plugins, no deps, no Crashlytics config.
+//
+// It lives in the repo-root gradle/ dir (not app/) on purpose: Android Lint's
+// build-script visitor (lintVitalRelease) crashes trying to build a FIR
+// light-class for a standalone apply(from=...) script inside an Android module.
+// The root project has no Android lint task, so keeping it here sidesteps that
+// upstream crash while the FOSS release build (which runs lintVitalRelease)
+// stays green — it never applies this file.
+//
+// F-Droid: the FOSS build never needs this file, and the fdroiddata recipe
+// removes it in `prebuild:` (rm -f gradle/google-services.gradle.kts) BEFORE the
+// source scanner runs, so the scanner never sees any Firebase coordinate. This
+// is why the coordinates below are written as explicit Maven strings rather
+// than `libs.` version-catalog accessors — version-catalog type-safe accessors
+// are NOT available inside an `apply(from = ...)` script, and keeping the
+// coordinates here (not in libs.versions.toml usage within a surviving build
+// file) is what makes the FOSS build genuinely, statically Firebase-free.
+//
+// Versions are mirrored from gradle/libs.versions.toml — keep them in sync:
+//   * firebase-bom = 34.12.0  (all firebase-* artifacts are versioned by the BOM)
+//   * firebase-auth / firebase-messaging / firebase-crashlytics (no explicit
+//     version; resolved by the BOM platform above)
+// The plugin versions (google-services 4.4.4, firebase-crashlytics 3.0.6) are
+// declared `apply false` in the root build.gradle.kts so the `apply(plugin=...)`
+// calls below can resolve them.
+// =============================================================================
+
+apply(plugin = "com.google.gms.google-services")
+apply(plugin = "com.google.firebase.crashlytics")
+
+// Crashlytics per-build-type config, reaching into the already-configured
+// android extension. Mirrors the guarded inline config that previously lived in
+// app/build.gradle.kts `buildTypes { debug { ... }; release { ... } }`.
+//
+// An `apply(from = ...)` script does NOT have the AGP / firebase-crashlytics
+// Gradle plugin types on its compile classpath (unlike the main build file), so
+// the typed `configure<ApplicationExtension>` / `configure<CrashlyticsExtension>`
+// DSL does not resolve here. We instead reach the build types dynamically and
+// set the two upload toggles by reflection, which stays type-agnostic.
+//
+//   * debug   — no mapping/symbol upload (keep debug assembly fast).
+//   * release — upload the R8 mapping so Crashlytics deobfuscates stacks; no
+//               NDK code, so native symbol upload stays off.
+// The firebase-crashlytics plugin registers a `firebaseCrashlytics` extension
+// (CRASHLYTICS_EXTENSION_NAME) on every build type (each build type is
+// ExtensionAware). We toggle mapping/symbol upload per build type via that
+// named extension.
+val crashlyticsMappingUpload = mapOf("debug" to false, "release" to true)
+val androidExt = extensions.getByName("android")
+@Suppress("UNCHECKED_CAST")
+val buildTypes = androidExt.javaClass
+    .getMethod("getBuildTypes")
+    .invoke(androidExt) as org.gradle.api.NamedDomainObjectContainer<Any>
+crashlyticsMappingUpload.forEach { (buildTypeName, uploadMapping) ->
+    val buildType = buildTypes.getByName(buildTypeName) as org.gradle.api.plugins.ExtensionAware
+    val crashlytics = buildType.extensions.getByName("firebaseCrashlytics")
+    // CrashlyticsExtension exposes boxed-Boolean setters
+    // (set{Mapping,NativeSymbol}UploadEnabled(java.lang.Boolean)).
+    crashlytics.javaClass
+        .getMethod("setMappingFileUploadEnabled", java.lang.Boolean::class.java)
+        .invoke(crashlytics, uploadMapping)
+    crashlytics.javaClass
+        .getMethod("setNativeSymbolUploadEnabled", java.lang.Boolean::class.java)
+        .invoke(crashlytics, false)
+}
+
+dependencies {
+    // FCM wake + Firebase anonymous auth + Crashlytics. Only the `-Pgoogle`
+    // build links these; the FOSS build uses UnifiedPush + ACRA instead.
+    add("implementation", platform("com.google.firebase:firebase-bom:34.12.0"))
+    add("implementation", "com.google.firebase:firebase-auth")
+    add("implementation", "com.google.firebase:firebase-messaging")
+    add("implementation", "com.google.firebase:firebase-crashlytics")
+}