fix: publish android debug symbols

.github/workflows/gradle-publish.yml

@@ -9,18 +9,32 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: "Version to publish (e.g., v0.1.0)"
+        description: "Version/tag to publish (e.g., v0.5.19 or 0.5.19)"
         required: true
 
 jobs:
   publish:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
       packages: write
 
     steps:
+    - name: Normalize release version
+      id: version
+      shell: bash
+      run: |
+        VERSION="${{ github.event.inputs.version || github.event.release.tag_name || github.ref_name }}"
+        TAG="$VERSION"
+        if [[ "$TAG" != v* ]]; then
+          TAG="v$TAG"
+        fi
+        echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+        echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
+
     - uses: actions/checkout@v4
+      with:
+        ref: ${{ steps.version.outputs.tag }}
     - name: Set up JDK 17
       uses: actions/setup-java@v4
       with:
@@ -32,24 +46,44 @@ jobs:
     - name: Setup Gradle
       uses: gradle/actions/setup-gradle@v4
 
-    - name: Extract version from input or tag
-      id: version
-      shell: bash
-      run: |
-        VERSION="${{ inputs.version }}"
-        if [[ -z "$VERSION" ]]; then
-          VERSION="$GITHUB_REF_NAME"
-        fi
-        echo "version=${VERSION#v}" >> $GITHUB_OUTPUT
+    - name: Install native build dependencies
+      run: sudo apt-get update && sudo apt-get install -y pkg-config protobuf-compiler
+
+    - name: Set up Android SDK
+      uses: android-actions/setup-android@v3
+
+    - name: Set up Android NDK
+      id: setup-ndk
+      uses: nttld/setup-ndk@v1
+      with:
+        ndk-version: r28c
+        add-to-path: true
+
+    - name: Export Android NDK root
+      run: echo "ANDROID_NDK_ROOT=${{ steps.setup-ndk.outputs.ndk-path }}" >> "$GITHUB_ENV"
+
+    - name: Generate Android bindings
+      run: ./build_android.sh
 
     - name: Build with Gradle
       working-directory: bindings/android
       run: ./gradlew build -Pversion=${{ steps.version.outputs.version }}
 
+    - name: Upload native debug symbols artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: vss-client-native-debug-symbols-${{ steps.version.outputs.version }}
+        path: bindings/android/native-debug-symbols.zip
+
+    - name: Upload native debug symbols to release
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: gh release upload "${{ steps.version.outputs.tag }}" bindings/android/native-debug-symbols.zip --clobber
+
     - name: Publish to GitHub Packages
       working-directory: bindings/android
       env:
         GITHUB_ACTOR: ${{ github.actor }}
-        GITHUB_TOKEN: ${{ secrets.ORG_PACKAGES_TOKEN }}
+        GITHUB_TOKEN: ${{ github.token }}
         GITHUB_REPO: ${{ github.repository }}
       run: ./gradlew publish -Pversion=${{ steps.version.outputs.version }}

.gitignore

@@ -1,6 +1,7 @@
 .idea/
 .DS_Store
 /target/
+bindings/android/native-debug-symbols.zip
 .rust-analyzer/
 .cargo/
 # Default ignored files

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "vss-rust-client-ffi"
-version = "0.5.13"
+version = "0.5.19"
 edition = "2021"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

Package.swift

@@ -3,8 +3,8 @@
 
 import PackageDescription
 
-let tag = "v0.5.13"
-let checksum = "5b0143f05a1f49c580b8442b43e18293c5a7af6e97071221ca4899877898a1ad"
+let tag = "v0.5.19"
+let checksum = "0fa59810f5b778481e88984cbb6e1676b5d018417cbc3eece3f8614c754913ba"
 let url = "https://github.com/synonymdev/vss-rust-client-ffi/releases/download/\(tag)/VssRustClientFfi.xcframework.zip"
 
 let package = Package(

bindings/android/README.md

@@ -86,6 +86,9 @@ Or trigger the "Gradle Publish" workflow manually.
 ### Terminal
 
 ```sh
-cd bindings/android
+./build_android.sh
+cd ./bindings/android
 ./gradlew publish -Pversion=0.1.0
 ```
+
+Run `./build_android.sh` before any direct Gradle publish so `jniLibs` is regenerated as stripped release libraries with separate `native-debug-symbols.zip` metadata and 16 KB page-size alignment.

bindings/android/build.gradle.kts

@@ -1,4 +1,5 @@
-import java.util.Properties
+import java.io.ByteArrayOutputStream
+import java.io.File
 
 plugins {
     id("com.android.library") version "8.5.2"
@@ -44,6 +45,107 @@ dependencies {
     implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.8.1")
 }
 
+val androidNativeAbis = listOf("armeabi-v7a", "arm64-v8a", "x86", "x86_64")
+
+fun executableFromPath(name: String): String? {
+    return System.getenv("PATH")
+        ?.split(File.pathSeparator)
+        ?.asSequence()
+        ?.map { File(it, name) }
+        ?.firstOrNull { it.canExecute() }
+        ?.absolutePath
+}
+
+fun findReadelf(): String {
+    executableFromPath("llvm-readelf")?.let { return it }
+    executableFromPath("readelf")?.let { return it }
+
+    return listOf("ANDROID_NDK_ROOT", "ANDROID_NDK_HOME", "NDK_HOME")
+        .mapNotNull { System.getenv(it) }
+        .map { File(it, "toolchains/llvm/prebuilt") }
+        .firstNotNullOfOrNull { prebuiltDir ->
+            if (!prebuiltDir.isDirectory) return@firstNotNullOfOrNull null
+
+            prebuiltDir
+                .walkTopDown()
+                .firstOrNull { it.name == "llvm-readelf" && it.canExecute() }
+                ?.absolutePath
+        }
+        ?: throw GradleException(
+            "llvm-readelf or readelf is required to validate Android native debug symbols"
+        )
+}
+
+fun Project.runReadelf(readelf: String, vararg args: String): Pair<Int, String> {
+    val stdout = ByteArrayOutputStream()
+    val stderr = ByteArrayOutputStream()
+    val result = exec {
+        commandLine(readelf, *args)
+        standardOutput = stdout
+        errorOutput = stderr
+        isIgnoreExitValue = true
+    }
+
+    return result.exitValue to stdout.toString().ifBlank { stderr.toString() }
+}
+
+fun String.parseElfAlignment(): Long {
+    return if (startsWith("0x")) {
+        removePrefix("0x").toLong(16)
+    } else {
+        toLong()
+    }
+}
+
+val validateReleaseNativeLibraries by tasks.registering {
+    group = "verification"
+    description = "Validates release JNI libraries are stripped and keep 16 KB LOAD alignment."
+
+    doLast {
+        val readelf = findReadelf()
+        val loadAlignmentRegex = Regex("""^\s*LOAD\s+.*\s+(0x[0-9a-fA-F]+|\d+)\s*$""")
+
+        androidNativeAbis.forEach { abi ->
+            val lib = layout.projectDirectory.file("src/main/jniLibs/$abi/libvss_rust_client_ffi.so").asFile
+            if (!lib.isFile) {
+                throw GradleException("Android native library missing at '${lib.path}'")
+            }
+
+            val (sectionsExit, sections) = runReadelf(readelf, "-S", lib.absolutePath)
+            if (sectionsExit != 0) {
+                throw GradleException("Unable to inspect Android native library sections: '${lib.path}'")
+            }
+            if (Regex("""\.debug_""").containsMatchIn(sections)) {
+                throw GradleException("Android release native library still contains .debug_* sections: '${lib.path}'")
+            }
+
+            val wideHeaders = runReadelf(readelf, "-W", "-l", lib.absolutePath)
+            val headers = if (wideHeaders.first == 0) {
+                wideHeaders.second
+            } else {
+                val fallbackHeaders = runReadelf(readelf, "-l", lib.absolutePath)
+                if (fallbackHeaders.first != 0) {
+                    throw GradleException("Unable to inspect Android native library headers: '${lib.path}'")
+                }
+                fallbackHeaders.second
+            }
+
+            val alignments = headers
+                .lineSequence()
+                .mapNotNull { loadAlignmentRegex.matchEntire(it)?.groupValues?.get(1)?.parseElfAlignment() }
+                .toList()
+
+            if (alignments.isEmpty() || alignments.any { it < 16_384 }) {
+                throw GradleException("Android native library is not 16 KB page-size aligned: '${lib.path}'")
+            }
+        }
+    }
+}
+
+tasks.matching { it.name == "bundleReleaseAar" || it.name.startsWith("publish") }.configureEach {
+    dependsOn(validateReleaseNativeLibraries)
+}
+
 afterEvaluate {
     publishing {
         publications {
@@ -54,6 +156,10 @@ afterEvaluate {
                 version = project.version.toString()
 
                 from(components["release"])
+                artifact(rootProject.layout.projectDirectory.file("native-debug-symbols.zip")) {
+                    classifier = "native-debug-symbols"
+                    extension = "zip"
+                }
                 pom {
                     name.set(mavenArtifactId)
                     description.set("VSS Rust Client Android bindings.")

bindings/android/gradle.properties

@@ -3,4 +3,4 @@ android.useAndroidX=true
 android.nonTransitiveRClass=true
 kotlin.code.style=official
 # project settings:
-version=0.5.12
+version=0.5.19