docs: document EAS Workflow GitHub builds and manual Play submission

- Describe the .eas/workflows build-from-GitHub setup (tag/manual triggers,
  Android only) in README, AGENTS, release and development guides
- Note that Google Play submission is currently performed manually
- Add the EAS Workflow entry to the 2.1 changelog

Author: TheStreamCode

AGENTS.md

@@ -15,7 +15,8 @@
 - Web: `bun run web`
 - Preview cloud build: `bun run build:android:preview`
 - Production cloud build: `bun run build:android:production`
-- Production submit: `bun run submit:android:production`
+- Production submit: `bun run submit:android:production` (Google Play submission is currently performed manually)
+- Build from GitHub: EAS Workflow `.eas/workflows/build-android-production.yml` (Android production), triggered on a version tag push (`v*`) or manual dispatch only
 - Android bundle export check: `bunx expo export --platform android --output-dir C:\tmp\keysoft-android-export`
 - Lint: `bun run lint`
 - Typecheck: `bun run typecheck`

CHANGELOG.md

@@ -25,6 +25,7 @@ All notable project changes are documented here.
 
 - Aligned all `expo-*` packages to the exact Expo SDK 55 pins (expo-doctor: 19/19 checks passing).
 - Migrated linting to ESLint 9 with a flat config (`eslint.config.js`); ESLint 8 is end-of-life.
+- Added an EAS Workflow (`.eas/workflows/build-android-production.yml`) for Android production builds from GitHub, triggered on a version tag push (`v*`) or manual dispatch.
 
 ### Release
 

README.md

@@ -112,6 +112,10 @@ bun run build:android:production
 
 EAS builds upload the project to expo.dev. Start them only after the release checklist is complete and the upload has been explicitly approved.
 
+### Build from GitHub
+
+The repository is linked to EAS Build. An EAS Workflow (`.eas/workflows/build-android-production.yml`) builds the Android production app-bundle. To keep build-credit usage low, it runs only on a version tag push (`v*`) or manual dispatch — not on every push. iOS is excluded while it is paused, so the missing-iOS-credentials warning does not apply. Trigger a release build by pushing a tag (`git tag v2.1 && git push origin v2.1`) or by running the workflow from the Expo dashboard. Google Play submission is performed manually.
+
 ## Verification
 
 Run the full local verification suite before shipping changes:

docs/development.md

@@ -153,6 +153,8 @@ bun run build:android:preview
 bun run build:android:production
 ```
 
+The repository is also linked to EAS Build, and the EAS Workflow `.eas/workflows/build-android-production.yml` can build the Android production app-bundle from GitHub. It is triggered only by a version tag push (`v*`) or manual dispatch to limit build-credit usage; it does not run on every push. iOS is excluded while paused.
+
 Expo Go cannot load custom native modules. Keysoft therefore uses the PBKDF2 KDF fallback in Expo Go and keeps Argon2 for EAS/native builds where `react-native-argon2` is available.
 
 Use Expo Go for development and smoke testing only. Create release-test vaults in an EAS/native build when validating Argon2 behavior. Vault metadata that requires Argon2 (`memory > 0`) must fail with the native-KDF diagnostic if the native module is unavailable; do not reintroduce PBKDF2 fallback for that path.

docs/release.md

@@ -55,7 +55,13 @@ bun run build:android:production
 
 These commands upload the project to expo.dev. Do not start them until the release checklist is complete and the upload has been explicitly approved.
 
-Production submission:
+### Build from GitHub
+
+The repository is linked to EAS Build. The EAS Workflow `.eas/workflows/build-android-production.yml` builds the Android production app-bundle and runs only on a version tag push (`v*`) or manual dispatch, to keep build-credit usage low. Trigger a release build by pushing the matching tag (for example `git tag v2.1 && git push origin v2.1`) or by running the workflow from the Expo dashboard. iOS is excluded while paused, so the missing-iOS-credentials warning does not apply; build Android only.
+
+### Google Play Submission
+
+Google Play submission is currently performed manually (upload the app-bundle in the Play Console). To automate it later, configure a Google service-account key in `eas.json` (`submit.production`) and run:
 
 ```bash
 bun run submit:android:production