Merge commit 'e1a7d527fd412b6bd78833e01fe80f515e324971' into merge/main-into-non-adreno-all

# Conflicts: # .github/workflows/build.yml # app/build.gradle # app/src/main/java/com/droiddeck/launcher/core/DeviceReport.kt # app/src/main/java/com/droiddeck/launcher/gpu/DriverPairs.kt # app/src/main/java/com/droiddeck/launcher/gpu/GpuInfo.kt # app/src/main/java/com/droiddeck/launcher/gpu/TurnipDriver.java # app/src/main/java/com/droiddeck/launcher/gpu/TurnipReleases.kt # app/src/main/java/com/droiddeck/launcher/runtime/LinuxRuntime.java # app/src/main/java/com/droiddeck/launcher/session/SessionFiles.kt # app/src/main/java/com/droiddeck/launcher/session/SessionService.kt # app/src/main/res/values/strings.xml # app/src/test/java/com/droiddeck/launcher/ui/ComponentsPageProfileTest.kt # tools/build_local.sh # tools/gamescope/PATCHES.md # tools/gamescope/release.env # tools/linuxfs/overlay/usr/local/bin/droiddeck-game-env # tools/linuxfs/preload/netif.c # tools/linuxfs/preload/opens.c # tools/release/runtime_inputs.py
2026-11-12 11:31:08 +00:00 · 2026-10-22 12:22:36 -04:00
commit e7b523d653
@@ -0,0 +1,40 @@
+name: Build validation
+
+on:
+  pull_request_target:
+    branches: [main]
+    types: [opened, synchronize, reopened, edited, ready_for_review]
+  push:
+    branches: [main]
+  workflow_run:
+    workflows: [Build APK]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: Pull request to validate; empty for main
+        required: false
+
+permissions:
+  contents: read
+  actions: read
+  pull-requests: read
+  statuses: write
+
+jobs:
+  validate:
+    name: Build APK
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.workflow_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Validate source and APK compilation
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh auth setup-git
+          python3 tools/release/validate_apk.py
@@ -64,6 +64,7 @@ jobs:
          KDE_KWIN_OVERRIDE="$PWD/out/kwin" tools/desktop-kde/build.sh out
          cp out/kwin/desktop-kde.kwin.txt out/
          echo "size $(stat -c %s out/desktop-kde.tar.zst) sha256 $(cat out/desktop-kde.sha256)"
+          echo "language packs $(ls out/desktop-kde-i18n-*.tar.zst | wc -l)"
      - uses: actions/upload-artifact@v4
        with:
          name: desktop-kde
@@ -74,6 +75,8 @@ jobs:
            out/desktop-kde.packages.txt
            out/desktop-kde.kwin.txt
            out/desktop-kde.sha256
+            out/desktop-kde.i18n.txt
+            out/desktop-kde-i18n-*.tar.zst
      - name: Publish
        if: github.event_name == 'workflow_dispatch' && inputs.tag != ''
        env:
@@ -88,5 +91,6 @@ jobs:
          fi
          gh release create "$TAG" --latest=false --prerelease=false --title "$TAG" \
            --notes "KDE Plasma desktop package for DroidDeck's Linux runtime ($GITHUB_REPOSITORY tools/desktop-kde, $GITHUB_SHA). size $(stat -c %s out/desktop-kde.tar.zst), sha256 $(cat out/desktop-kde.sha256). desktop-kde.packages.txt lists the signature-checked Arch Linux ARM packages it was built from." \
-            out/desktop-kde.tar.zst out/desktop-kde.sha256 out/desktop-kde.packages.txt out/desktop-kde.kwin.txt
+            out/desktop-kde.tar.zst out/desktop-kde.sha256 out/desktop-kde.packages.txt out/desktop-kde.kwin.txt \
+            out/desktop-kde.i18n.txt out/desktop-kde-i18n-*.tar.zst
          gh release edit "$TAG" --latest=false --prerelease=false
@@ -29,8 +29,65 @@ env:
  PRELOAD_CACHE_VERSION: v6

 jobs:
+  xbox:
+    name: Xbox ARM64 backend
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 30
+    outputs:
+      base-sha: ${{ steps.merge.outputs.base-sha }}
+      tree-sha: ${{ steps.source.outputs.tree-sha }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Pin and merge the APK source
+        id: merge
+        if: github.event_name == 'pull_request'
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin main
+          echo "base-sha=$(git rev-parse origin/main)" >> "$GITHUB_OUTPUT"
+          git config user.name "ci"
+          git config user.email "ci@users.noreply.github.com"
+          git merge --no-ff --no-edit origin/main
+      - name: Record backend source tree
+        id: source
+        run: echo "tree-sha=$(git rev-parse 'HEAD^{tree}')" >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@v4
+        id: xbox-cache
+        with:
+          path: |
+            app/src/main/assets/linuxfs/usr/local/lib/droiddeck-xbox
+            app/build/xbox/xodus-droiddeck-source.tar.xz
+            app/build/xbox/runtime/*-source.tar.xz
+          key: xbox-arm64-${{ hashFiles('tools/xbox/**') }}
+      - name: Build Xbox backend
+        if: steps.xbox-cache.outputs.cache-hit != 'true'
+        run: |
+          rustup toolchain install 1.99.0 --profile minimal
+          sudo apt-get update -qq
+          sudo apt-get install -y build-essential pkg-config libssl-dev protobuf-compiler cmake xz-utils
+          bash tools/xbox/build.sh
+      - uses: actions/upload-artifact@v4
+        with:
+          name: xbox-arm64
+          path: app/src/main/assets/linuxfs/usr/local/lib/droiddeck-xbox
+          retention-days: 14
+      - uses: actions/upload-artifact@v4
+        with:
+          name: xbox-corresponding-source
+          path: |
+            app/build/xbox/xodus-droiddeck-source.tar.xz
+            app/build/xbox/runtime/*-source.tar.xz
+          if-no-files-found: error
+          retention-days: 14
+
  build:
-    name: Build APK
+    needs: xbox
+    name: Compile and test APK
    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
    runs-on: ubuntu-24.04
    timeout-minutes: 45
@@ -42,18 +99,24 @@ jobs:
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
          submodules: true
+          persist-credentials: false

-      - name: Check co-authors
-        if: github.event_name == 'pull_request'
+      - name: Check human authorship
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BEFORE: ${{ github.event.before }}
        run: |
          set -euo pipefail
-          git fetch --no-tags origin main
-          base=$(git merge-base origin/main HEAD)
-          messages=$(git log --format=%B "$base..HEAD")
-          messages+=$'\n'"$(jq -r '.pull_request.title, (.pull_request.body // "")' "$GITHUB_EVENT_PATH")"
-          if grep -Eiq '^[[:space:]]*Co-authored-by:.*(Claude|Anthropic|OpenAI|ChatGPT|GPT|Copilot|Cursor|Gemini|Codex|Devin|Windsurf|Codeium|Amazon Q|Tabnine|Cody|\[bot\])' <<<"$messages"; then
-            echo "::error::AI and bot identities cannot be co-authors; remove the Co-authored-by trailer."
-            exit 1
+          if [ "$EVENT_NAME" = pull_request ]; then
+            git fetch --no-tags origin main
+            base=$(git merge-base origin/main HEAD)
+            checker="$RUNNER_TEMP/droiddeck-check-authorship.py"
+            git show origin/main:tools/release/check_authorship.py > "$checker"
+            python3 "$checker" "$base..HEAD" --event "$GITHUB_EVENT_PATH"
+          elif [ "$EVENT_NAME" = push ] && [ "$BEFORE" != 0000000000000000000000000000000000000000 ]; then
+            python3 tools/release/check_authorship.py "$BEFORE..HEAD"
+          else
+            python3 tools/release/check_authorship.py HEAD
          fi

      - name: The packages a signed build ships as
@@ -87,14 +150,17 @@ jobs:

      - name: Merge onto main, or say what conflicts
        if: github.event_name == 'pull_request'
+        env:
+          BUILD_BASE_SHA: ${{ needs.xbox.outputs.base-sha }}
        run: |
          set -uo pipefail
          git config user.name "ci"
          git config user.email "ci@users.noreply.github.com"
          git fetch --no-tags origin main
-          BASE=$(git rev-parse --short origin/main)
+          git fetch --no-tags origin "$BUILD_BASE_SHA"
+          BASE=$(git rev-parse --short FETCH_HEAD)
          HEAD=$(git rev-parse --short HEAD)
-          if git merge --no-ff --no-edit origin/main >/tmp/merge.out 2>&1; then
+          if git merge --no-ff --no-edit FETCH_HEAD >/tmp/merge.out 2>&1; then
            {
              echo "###  Mergeable"
              echo
@@ -141,6 +207,11 @@ jobs:
          echo "::error::the pull request conflicts with main: $(echo $FILES | tr '\n' ' ')"
          exit 1

+      - name: Verify backend and APK source match
+        env:
+          XBOX_SOURCE_TREE: ${{ needs.xbox.outputs.tree-sha }}
+        run: test "$(git rev-parse 'HEAD^{tree}')" = "$XBOX_SOURCE_TREE"
+
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
@@ -185,15 +256,14 @@ jobs:
        uses: actions/cache@v4
        with:
          path: app/src/main/assets/linuxfs
-          key: preloads-${{ env.PRELOAD_CACHE_VERSION }}-${{ hashFiles('app/src/main/cpp/fakeinput_steam.cpp', 'app/src/main/cpp/adrenotools/src/hook/kgsl.h', 'tools/quest/*', 'tools/linuxfs/preload/*.c', 'tools/linuxfs/build-x86-preloads.sh', 'tools/linuxfs/fex/*', 'tools/linuxfs/clipboard/*.c', 'tools/linuxfs/ssbs/*.c', 'tools/linuxfs/xclipse-layer/*', 'tools/proot/fastpath/*.c', 'tools/linuxfs/overlay/usr/local/bin/*', 'tools/linuxfs/overlay/usr/bin/**', 'tools/linuxfs/desktop/*', 'tools/gamescope/release.env', 'tools/wlroots/release.env', 'tools/linuxfs/uruntime.env', 'tools/linuxfs/licenses/*', 'tools/mangoapp/*', 'tools/msitools/**', 'tools/comet/**', 'external/MaliBridge/client/**', 'external/MaliBridge/common/**', 'external/MaliBridge/tests/**', 'external/MaliBridge/scripts/build-client-linux.sh', 'tools/venus/glprobe.c', 'tools/linuxfs/debian-image.env', 'tools/vr/**') }}
+          key: preloads-${{ env.PRELOAD_CACHE_VERSION }}-${{ hashFiles('app/src/main/cpp/fakeinput_steam.cpp', 'app/src/main/cpp/adrenotools/src/hook/kgsl.h', 'tools/quest/*', 'tools/linuxfs/preload/*.c', 'tools/linuxfs/build-x86-preloads.sh', 'tools/linuxfs/fex/*', 'tools/linuxfs/clipboard/*.c', 'tools/linuxfs/ssbs/*.c', 'tools/linuxfs/xclipse-layer/*', 'tools/proot/fastpath/*.c', 'tools/linuxfs/overlay/usr/local/bin/*', 'tools/linuxfs/overlay/usr/bin/**', 'tools/linuxfs/desktop/*', 'tools/gamescope/release.env', 'tools/wlroots/release.env', 'tools/linuxfs/uruntime.env', 'tools/linuxfs/licenses/*', 'tools/mangoapp/*', 'tools/msitools/**', 'tools/comet/**', 'tools/xbox/**', 'external/MaliBridge/client/**', 'external/MaliBridge/common/**', 'external/MaliBridge/tests/**', 'external/MaliBridge/scripts/build-client-linux.sh', 'tools/venus/glprobe.c', 'tools/linuxfs/debian-image.env', 'tools/vr/**') }}

      - name: Build libfakeinput.so and libblsession.so (glibc aarch64)
        if: steps.preloads.outputs.cache-hit != 'true'
-        env:
-          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
-          sudo apt-get update -qq
+          sudo apt-get -o Dir::Etc::sourcelist=sources.list.d/ubuntu.sources \
+            -o Dir::Etc::sourceparts=- -o Acquire::Retries=3 update -qq
          sudo apt-get install -y -qq gcc-aarch64-linux-gnu g++-aarch64-linux-gnu libvulkan-dev libvulkan1 mesa-vulkan-drivers >/dev/null
          D=app/src/main/assets/linuxfs
          mkdir -p "$D"
@@ -237,7 +307,7 @@ jobs:
          done
          if [ -f tools/gamescope/release.env ]; then
            . tools/gamescope/release.env
-            gh release download "${GAMESCOPE_TAG}" -R "${GAMESCOPE_REPO:-${GITHUB_REPOSITORY}}" -p gamescope.tzst -O gamescope.tzst
+            curl -fsSL --retry 3 -o gamescope.tzst "https://github.com/${GAMESCOPE_REPO:-${GITHUB_REPOSITORY}}/releases/download/${GAMESCOPE_TAG}/gamescope.tzst"
            echo "${GAMESCOPE_SHA256}  gamescope.tzst" | sha256sum -c -
            tar --use-compress-program=unzstd -xf gamescope.tzst -C "$D"
            test -f "$D/usr/local/bin/gamescope"
@@ -268,6 +338,17 @@ jobs:
          install -Dm644 tools/mangoapp/mangoapp "$D/usr/local/bin/mangoapp"
          rm -rf mango-pkgs
          ls -l "$M"
+          mkdir -p pw-pkgs
+          grep -v '^#' tools/pipewire/packages.txt | while read -r sum url; do
+            [ -n "$url" ] || continue
+            curl -fsSL --retry 3 -o pw-pkgs/pkg.tar.zst "$url"
+            echo "$sum  pw-pkgs/pkg.tar.zst" | sha256sum -c -
+            tar --use-compress-program=unzstd -xf pw-pkgs/pkg.tar.zst -C pw-pkgs
+            rm pw-pkgs/pkg.tar.zst
+          done
+          tools/pipewire/assemble.sh pw-pkgs "$D/usr/local/lib/droiddeck-pipewire.tzst"
+          rm -rf pw-pkgs
+          ls -l "$D/usr/local/lib/droiddeck-pipewire.tzst"
          T="$D/usr/local/lib/droiddeck-msitools"
          mkdir -p "$T" msi-pkgs
          grep -v '^#' tools/msitools/packages.txt | while read -r sum url; do
@@ -340,18 +421,17 @@ jobs:
          ls -l app/src/main/assets/linuxfs/x86_64 app/src/main/assets/linuxfs/i386

      - name: Bundle the droiddeck-esync packs
-        env:
-          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          if [ -f tools/droiddeck-esync/release.env ]; then
            . tools/droiddeck-esync/release.env
-            gh release download "$SYNC_BUNDLE_TAG" -R "$SYNC_BUNDLE_REPO" -p "$SYNC_BUNDLE_ASSET" -O sync-bundle.tzst
+            release_url="https://github.com/${SYNC_BUNDLE_REPO}/releases/download/${SYNC_BUNDLE_TAG}"
+            curl -fsSL --retry 3 -o sync-bundle.tzst "$release_url/$SYNC_BUNDLE_ASSET"
            echo "$SYNC_BUNDLE_SHA256  sync-bundle.tzst" | sha256sum -c -
            mkdir -p app/src/main/assets/droiddeck-esync
            tar --use-compress-program=unzstd -xf sync-bundle.tzst -C app/src/main/assets/droiddeck-esync
            rm sync-bundle.tzst
-            gh release download "$SYNC_BUNDLE_TAG" -R "$SYNC_BUNDLE_REPO" -p index.json -O sync-index.json
+            curl -fsSL --retry 3 -o sync-index.json "$release_url/index.json"
            revoked=$(python3 -c 'import json, sys; print(" ".join(p["id"] for p in json.load(open(sys.argv[1]))["packs"] if p.get("revoked") is True))' sync-index.json)
            for id in $revoked; do
              if [ -e "app/src/main/assets/droiddeck-esync/packs/$id.tzst" ]; then
@@ -450,6 +530,8 @@ jobs:
          /tmp/test-xr-tracking
          g++ -std=c++17 -Wall -Wextra -Werror tools/vr/tests/test_xr_touch.cpp -o /tmp/test-xr-touch
          /tmp/test-xr-touch
+          g++ -std=c++17 -Wall -Wextra -Werror tools/vr/tests/test_pad_controller_config.cpp -o /tmp/test-pad-controller-config
+          /tmp/test-pad-controller-config
          g++ -std=c++17 -Wall -Wextra -Werror -pthread tools/vr/tests/test_xr_vsync.cpp -o /tmp/test-xr-vsync
          /tmp/test-xr-vsync
          g++ -std=c++17 -Wall -Wextra -Werror -pthread tools/vr/tests/test_xr_frames.cpp -o /tmp/test-xr-frames
@@ -499,6 +581,11 @@ jobs:
          restore-keys: |
            cxx-${{ env.NDK_VERSION }}-

+      - uses: actions/download-artifact@v4
+        with:
+          name: xbox-arm64
+          path: app/src/main/assets/linuxfs/usr/local/lib/droiddeck-xbox
+
      - name: Build GOG Galaxy companion
        if: steps.preloads.outputs.cache-hit != 'true'
        run: |
@@ -506,6 +593,9 @@ jobs:
          rustup target add --toolchain 1.90.0 aarch64-unknown-linux-gnu
          RUSTUP_TOOLCHAIN=1.90.0 bash tools/comet/build.sh

+      - name: Build the add-on packs
+        run: bash tools/packs/build.sh app/build/packs
+
      - name: Build
        id: build
        env:
@@ -545,6 +635,11 @@ jobs:
          path: app/src/main/rust/stores/Cargo.lock
          if-no-files-found: ignore

+      - name: Install Python test dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq python3-yaml
+
      - name: Steam import and game environment tests
        run: |
          # The Xclipse layer regression test compiles the layer against the distribution's headers.
@@ -608,6 +703,14 @@ jobs:
          retention-days: 30
          compression-level: 0

+      - uses: actions/upload-artifact@v4
+        with:
+          name: droiddeck-packs
+          path: app/build/packs/*.tar.zst
+          if-no-files-found: error
+          retention-days: 30
+          compression-level: 0
+
      - name: Report on the pull request
        if: always() && github.event_name == 'pull_request'
        continue-on-error: true
@@ -710,8 +813,17 @@ jobs:
      variants: ${{ needs.build.outputs.variants }}
    secrets: inherit

+  packs:
+    needs: build
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    permissions:
+      contents: read
+      actions: read
+    uses: ./.github/workflows/publish-packs.yml
+    secrets: inherit
+
  announce:
-    needs: [build, sign]
+    needs: [build, sign, packs]
    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
@@ -176,6 +176,27 @@ jobs:
          pattern: droiddeck-pr-signed-*
          merge-multiple: true
          path: signed
+      - name: The add-on packs main has not published
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN: ${{ needs.authorize.outputs.run_id }}
+        run: |
+          set -euo pipefail
+          gh run download "$RUN" -R "$GITHUB_REPOSITORY" -n droiddeck-packs -D packs
+          mkdir -p pr-packs
+          for file in packs/*.tar.zst; do
+            name=$(basename "$file" .tar.zst)
+            sha=$(sha256sum "$file" | cut -d' ' -f1)
+            tag="pack-$name-${sha:0:16}"
+            digest=$({ gh api "repos/Droid-Deck/DroidDeck-Components/releases/tags/$tag" 2>/dev/null || echo '{}'; } |
+              jq -r --arg n "$name.tar.zst" '.assets // [] | .[] | select(.name == $n) | .digest // empty')
+            if [ "$digest" = "sha256:$sha" ]; then
+              echo "$name: served from DroidDeck-Components $tag"
+            else
+              cp "$file" "pr-packs/$tag.tar.zst"
+              echo "$name: attached to the PR release as $tag.tar.zst"
+            fi
+          done
      - name: Describe the change
        env:
          GH_TOKEN: ${{ github.token }}
@@ -233,6 +254,7 @@ jobs:
            first=true
          fi
          echo "first=$first" >> "$GITHUB_OUTPUT"
+          cp pr-packs/* signed/ 2>/dev/null || true
          gh release upload "$tag" signed/* -R "$repo" --clobber
          gh release edit "$tag" -R "$repo" --title "PR #$PR_NUMBER" --notes "$notes" --prerelease
          keep=$(cd signed && ls | jq -R . | jq -sc .)
@@ -0,0 +1,83 @@
+name: Publish add-on packs
+
+# The add-on packs (tools/packs/build.sh) a Build APK run made, published to DroidDeck-Components under
+# content-addressed tags (pack-<name>-<first 16 hex of sha256>). The APK from that run pins each pack's
+# SHA-256 and downloads it from that tag. A tag is created once and never replaced.
+# Only main and release builds publish here; a PR test build attaches the packs main has not published
+# to its pr-N release on DroidDeck-CI (pr-release-publish.yml), which is deleted when the PR closes.
+
+on:
+  workflow_call:
+    inputs:
+      run_id:
+        description: The Build APK run whose packs to publish; empty for the calling run's own
+        type: string
+        default: ''
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  publish:
+    name: publish add-on packs
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    concurrency:
+      group: publish-packs
+      cancel-in-progress: false
+    steps:
+      - name: The packs (this run's build)
+        if: inputs.run_id == ''
+        uses: actions/download-artifact@v4
+        with:
+          name: droiddeck-packs
+          path: packs
+
+      - name: The packs (another Build APK run)
+        if: inputs.run_id != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN: ${{ inputs.run_id }}
+        run: gh run download "$RUN" -R "$GITHUB_REPOSITORY" -n droiddeck-packs -D packs
+
+      - uses: actions/create-github-app-token@v2
+        id: components-token
+        with:
+          app-id: ${{ vars.DROIDDECK_CI_APP_ID }}
+          private-key: ${{ secrets.DROIDDECK_CI_APP_KEY }}
+          owner: Droid-Deck
+          repositories: DroidDeck-Components
+
+      - name: Publish
+        env:
+          GH_TOKEN: ${{ steps.components-token.outputs.token }}
+          REPO: Droid-Deck/DroidDeck-Components
+          BUILD_RUN: ${{ inputs.run_id || github.run_id }}
+        run: |
+          set -euo pipefail
+          published_digest() {
+            { gh api "repos/$REPO/releases/tags/$1" 2>/dev/null || echo '{}'; } |
+              jq -r --arg n "$2" '.assets // [] | .[] | select(.name == $n) | .digest // empty'
+          }
+          commit=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$BUILD_RUN" --jq .head_sha 2>/dev/null || echo "$GITHUB_SHA")
+          for name in proot directaudio tracking xbox comet; do
+            file="packs/$name.tar.zst"
+            [ -f "$file" ] || { echo "::error::$name.tar.zst is missing from Build APK run $BUILD_RUN"; exit 1; }
+            sha=$(sha256sum "$file" | cut -d' ' -f1)
+            tag="pack-$name-${sha:0:16}"
+            digest=$(published_digest "$tag" "$name.tar.zst")
+            if [ -z "$digest" ]; then
+              notes="DroidDeck add-on pack \`$name\`, built by [Build APK run $BUILD_RUN]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$BUILD_RUN) from \`$commit\` with tools/packs/build.sh and published by [run $GITHUB_RUN_ID]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID).
+
+          Size: $(stat -c %s "$file") bytes. SHA-256: $sha. APKs built in the same run pin this digest."
+              gh release create "$tag" -R "$REPO" --title "$tag" --notes "$notes" --latest=false "$file" \
+                || echo "::warning::creating $tag failed; checking whether another run published it"
+              digest=$(published_digest "$tag" "$name.tar.zst")
+            fi
+            if [ "$digest" != "sha256:$sha" ]; then
+              echo "::error::$tag holds ${digest:-nothing} for $name.tar.zst, not sha256:$sha"
+              exit 1
+            fi
+            echo "- \`$name\`: [$tag]($GITHUB_SERVER_URL/$REPO/releases/tag/$tag) \`$sha\`" >> "$GITHUB_STEP_SUMMARY"
+          done
@@ -63,9 +63,19 @@ jobs:
      artifact: droiddeck-release
    secrets: inherit

+  packs:
+    needs: find
+    permissions:
+      contents: read
+      actions: read
+    uses: ./.github/workflows/publish-packs.yml
+    with:
+      run_id: ${{ needs.find.outputs.run_id }}
+    secrets: inherit
+
  publish:
    name: publish the release
-    needs: [find, sign]
+    needs: [find, sign, packs]
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions: