ci: isolated Zapstore publish workflow

[AnthonyRonning]

Replaces the approach in #426 with a fully isolated workflow.

What changed:

• New .github/workflows/zapstore-publish.yml that triggers via workflow_run after the Release workflow succeeds
• Runs in its own isolated runner -- only has Go, zsp, and the ZAPSTORE_SIGN_WITH secret
• Downloads the APK from the GitHub release via gh release download (no build artifacts or source code build access)
• Sparse checkout: only fetches zapstore.yaml and the icon file
• Adds zapstore.yaml for app metadata

Isolation:
The runner never sees the Android keystore, NDK, Rust toolchain, or any build infrastructure. It just gets the published APK and signs it for Zapstore.

Secrets required:

• ZAPSTORE_SIGN_WITH -- your nsec1... or bunker URL

Closes #426

---

Summary by CodeRabbit

• Chores
  • Added automated publishing to Zapstore that runs after a release to publish the app package non-interactively.
  • Included store metadata (project name, summary, full description, website, license, tags and icon) to enable the app listing.
  • Ensured published distribution uses the released build artifacts and requires a signing credential to proceed.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds Zapstore publishing: a new GitHub Actions workflow that runs after the Release workflow to download the Android APK, install and invoke the Zapstore CLI (zsp) to publish using zapstore.yaml, plus a zapstore.yaml manifest with app metadata.

Changes

Cohort / File(s)	Summary
Workflow .github/workflows/zapstore-publish.yml	New GitHub Actions workflow triggered on completion of the Release workflow; performs sparse checkout of zapstore.yaml and icon, finds the release for head_sha, downloads app-universal-release.apk, sets up Go 1.22.x, installs zsp v0.3.3, validates ZAPSTORE_SIGN_WITH, and runs zsp publish non-interactively with --skip-preview and --commit set.
Manifest zapstore.yaml	Adds app metadata for publishing (repository, release_source pointing to APK, name, summary, multi-line description, website, license, tags, icon path, and metadata_sources).

Sequence Diagram

sequenceDiagram
    participant Release as Release Workflow
    participant GH as GitHub Actions
    participant Releases as GitHub Releases
    participant CLI as zsp (Zapstore CLI)
    participant Zapstore as Zapstore

    Release->>GH: workflow_run completed (head_sha)
    GH->>GH: sparse-checkout `zapstore.yaml`, icon
    GH->>Releases: locate release for head_sha, download `app-universal-release.apk`
    Releases->>GH: APK artifact
    GH->>GH: setup Go 1.22.x, install `zsp` v0.3.3
    GH->>GH: validate `ZAPSTORE_SIGN_WITH` secret
    GH->>CLI: `zsp publish --non-interactive --skip-preview --commit HEAD_SHA` (using `zapstore.yaml`)
    CLI->>Zapstore: upload & publish
    Zapstore->>CLI: publish result
    CLI->>GH: exit status

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I hopped through CI beneath the glow,

fetched the APK and let Go flow,
I whispered keys and ran the script,
zsp sailed out, the app equipped,
now Maple hops where users go.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci: isolated Zapstore publish workflow' accurately describes the main change: adding an isolated GitHub Actions workflow for publishing to Zapstore.
Linked Issues check	✅ Passed	The PR fulfills all coding requirements from issue #426: adds a workflow triggering after Release workflow, downloads the APK, includes zapstore.yaml metadata file, requires ZAPSTORE_SIGN_WITH secret, and pins to release commit.
Out of Scope Changes check	✅ Passed	All changes are directly aligned with issue #426 objectives; the PR adds only the Zapstore publish workflow and metadata file with no extraneous modifications.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch zapstore-isolated-publish

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	e017117
Status:	✅  Deploy successful!
Preview URL:	https://6b3aaba8.maple-ca8.pages.dev
Branch Preview URL:	https://zapstore-isolated-publish.maple-ca8.pages.dev

View logs

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.

[coderabbitai]

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In @.github/workflows/zapstore-publish.yml:
- Around line 16-21: The checkout step using actions/checkout@v4 is missing a
ref, so sparse-checkout pulls files from the default branch instead of the
release commit; update the checkout step (the actions/checkout@v4 invocation) to
include a pinned ref (e.g., github.event.release.tag_name or github.sha) so the
sparse-checkout entries (zapstore.yaml and frontend/src-tauri/icons/icon.png)
are fetched from the exact release commit rather than the default branch.