Fix pull sync reliability: fail on partial page errors and cap transient retries

.github/workflows/build-distribute.yml

@@ -0,0 +1,136 @@
+name: Build and Distribute
+
+on:
+  workflow_call:
+    inputs:
+      branch:
+        required: true
+        type: string
+      environment:
+        required: true
+        type: string
+      flavor:
+        required: true
+        type: string
+      build_type:
+        required: true
+        type: string
+      version:
+        required: true
+        type: string
+      version_code:
+        required: true
+        type: string
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.branch }}
+
+      - name: Cache NDK
+        uses: actions/cache@v4
+        with:
+          path: /usr/local/lib/android/sdk/ndk
+          key: ubuntu-latest-ndk-r29
+
+      - name: Cache CMake
+        uses: actions/cache@v4
+        with:
+          path: ~/.cmake
+          key: ubuntu-latest-cmake-3.31.1
+
+      - name: Set up JDK
+        uses: actions/setup-java@v4
+        with:
+          distribution: zulu
+          java-version: '17'
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v2
+
+      - name: Set up Android NDK
+        uses: nttld/setup-ndk@v1.5.0
+        with:
+          ndk-version: r29
+          link-to-sdk: true
+
+      - name: Install CMake
+        uses: jwlawson/actions-setup-cmake@v1
+        with:
+          cmake-version: '3.31.1'
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+          bundler-cache: true
+
+      - name: Verify Ruby
+        run: ruby -v
+
+      - name: Decode google-services.json
+        run: |
+          echo "${{ secrets.GOOGLE_SERVICES_JSON_GENERIC }}" | base64 --decode > app/google-services.json
+
+      - name: Decode debug keystore
+        if: inputs.build_type == 'debug'
+        run: |
+          echo "${{ secrets.DEBUG_KEYSTORE_FILE }}" | base64 --decode > debug-keystore.jks
+          echo "Keystore file size: $(stat --format=%s debug-keystore.jks) bytes"
+          keytool -list -keystore debug-keystore.jks -storepass android -alias debugkey 2>&1 | head -5
+
+      - name: Decode Firebase credentials
+        if: inputs.build_type == 'debug'
+        run: |
+          echo "${{ secrets.FIREBASE_CREDENTIALS_JSON }}" | base64 --decode > firebase_credentials.json
+
+      - name: Decode Google Play JSON key
+        if: inputs.build_type == 'release'
+        run: |
+          echo "${{ secrets.GOOGLE_PLAY_JSON_KEY }}" | base64 --decode > fastlane/google_play_service_account.json
+
+      - name: Decode keystore
+        if: inputs.build_type == 'release'
+        run: |
+          echo "${{ secrets.KEYSTORE_FILE }}" | base64 --decode > keystore.jks
+
+      - name: Create local.properties
+        run: echo "sdk.dir=$ANDROID_SDK_ROOT" > local.properties
+
+      - name: Build and Distribute
+        env:
+          # Inputs as env vars to avoid shell injection (inputs.version is free-text)
+          INPUT_FLAVOR: ${{ inputs.flavor }}
+          INPUT_VERSION: ${{ inputs.version }}
+          INPUT_VERSION_CODE: ${{ inputs.version_code }}
+          INPUT_BUILD_TYPE: ${{ inputs.build_type }}
+          # Native build env vars (must match CMakeLists.txt)
+          ENCRYPTED_PASS_KEY: ${{ secrets.ENCRYPTED_PASS_KEY }}
+          ABHA_CLIENT_SECRET: ${{ secrets.ABHA_CLIENT_SECRET }}
+          ABHA_CLIENT_ID: ${{ secrets.ABHA_CLIENT_ID }}
+          BASE_TMC_URL: ${{ vars.BASE_TMC_URL }}
+          BASE_ABHA_URL: ${{ vars.BASE_ABHA_URL }}
+          ABHA_TOKEN_URL: ${{ vars.ABHA_TOKEN_URL }}
+          ABHA_AUTH_URL: ${{ vars.ABHA_AUTH_URL }}
+          CHAT_URL: ${{ vars.CHAT_URL }}
+          # Signing env vars (used by Fastlane for release builds)
+          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+          # Firebase env vars
+          FIREBASE_APP_ID: ${{ secrets.FIREBASE_APP_ID }}
+        run: |
+          if [ "$INPUT_BUILD_TYPE" = "debug" ]; then
+            bundle exec fastlane build_and_distribute_debug flavor:"$INPUT_FLAVOR" version_name:"$INPUT_VERSION" version_code:"$INPUT_VERSION_CODE"
+          else
+            bundle exec fastlane build_and_distribute_release flavor:"$INPUT_FLAVOR" version_name:"$INPUT_VERSION" version_code:"$INPUT_VERSION_CODE"
+          fi

.github/workflows/flw-android-build.yml

@@ -0,0 +1,117 @@
+name: FLW Android Build
+
+on:
+  workflow_dispatch:
+    inputs:
+      project:
+        description: "Project to build"
+        required: true
+        type: choice
+        options:
+          - sakshamStag
+          - sakshamUat
+          - saksham
+          - xushrukha
+          - niramay
+          - mitaninStag
+          - mitaninUat
+          - mitanin
+
+      branch:
+        description: "Git branch to build"
+        required: true
+        default: main
+        type: string
+
+      version:
+        description: "Version name (example: 2.5.0)"
+        required: true
+        type: string
+
+      versionCode:
+        description: "Version code (example: 16)"
+        required: true
+        type: string
+
+jobs:
+  resolve-config:
+    runs-on: ubuntu-latest
+    permissions: {}
+    outputs:
+      flavor: ${{ steps.resolve.outputs.flavor }}
+      environment: ${{ steps.resolve.outputs.environment }}
+      build_type: ${{ steps.resolve.outputs.build_type }}
+    steps:
+      - name: Resolve project configuration
+        id: resolve
+        run: |
+          case "${{ inputs.project }}" in
+            sakshamStag)
+              echo "flavor=SakshamStag" >> $GITHUB_OUTPUT
+              echo "environment=SAKSHAM_STAG" >> $GITHUB_OUTPUT
+              echo "build_type=debug" >> $GITHUB_OUTPUT
+              ;;
+            sakshamUat)
+              echo "flavor=SakshamUat" >> $GITHUB_OUTPUT
+              echo "environment=SAKSHAM_UAT" >> $GITHUB_OUTPUT
+              echo "build_type=debug" >> $GITHUB_OUTPUT
+              ;;
+            saksham)
+              echo "flavor=Saksham" >> $GITHUB_OUTPUT
+              echo "environment=SAKSHAM_PRODUCTION" >> $GITHUB_OUTPUT
+              echo "build_type=release" >> $GITHUB_OUTPUT
+              ;;
+            xushrukha)
+              echo "flavor=Xushrukha" >> $GITHUB_OUTPUT
+              echo "environment=XUSHRUKHA_PRODUCTION" >> $GITHUB_OUTPUT
+              echo "build_type=release" >> $GITHUB_OUTPUT
+              ;;
+            niramay)
+              echo "flavor=Niramay" >> $GITHUB_OUTPUT
+              echo "environment=NIRAMAY_PRODUCTION" >> $GITHUB_OUTPUT
+              echo "build_type=release" >> $GITHUB_OUTPUT
+              ;;
+            mitaninStag)
+              echo "flavor=MitaninStag" >> $GITHUB_OUTPUT
+              echo "environment=MITANIN_STAG" >> $GITHUB_OUTPUT
+              echo "build_type=debug" >> $GITHUB_OUTPUT
+              ;;
+            mitaninUat)
+              echo "flavor=MitaninUat" >> $GITHUB_OUTPUT
+              echo "environment=MITANIN_UAT" >> $GITHUB_OUTPUT
+              echo "build_type=debug" >> $GITHUB_OUTPUT
+              ;;
+            mitanin)
+              echo "flavor=Mitanin" >> $GITHUB_OUTPUT
+              echo "environment=MITANIN_PRODUCTION" >> $GITHUB_OUTPUT
+              echo "build_type=release" >> $GITHUB_OUTPUT
+              ;;
+            *)
+              echo "::error::Unknown project: ${{ inputs.project }}"
+              exit 1
+              ;;
+          esac
+
+      - name: Display resolved configuration
+        run: |
+          echo "Project: ${{ inputs.project }}"
+          echo "Flavor: ${{ steps.resolve.outputs.flavor }}"
+          echo "Environment: ${{ steps.resolve.outputs.environment }}"
+          echo "Build Type: ${{ steps.resolve.outputs.build_type }}"
+          echo "Branch: ${{ inputs.branch }}"
+          echo "Version: ${{ inputs.version }}"
+          echo "Version Code: ${{ inputs.versionCode }}"
+
+  flw-build:
+    needs: resolve-config
+    permissions:
+      contents: read
+    uses: ./.github/workflows/build-distribute.yml
+    with:
+      branch: ${{ inputs.branch }}
+      environment: ${{ needs.resolve-config.outputs.environment }}
+      flavor: ${{ needs.resolve-config.outputs.flavor }}
+      build_type: ${{ needs.resolve-config.outputs.build_type }}
+      version: ${{ inputs.version }}
+      version_code: ${{ inputs.versionCode }}
+    secrets: inherit

.gitignore

@@ -3,5 +3,16 @@
 /.gradle/
 *.bin
 *.lock
+!Gemfile.lock
 /app/build/*
 /app/release/*
+/local.properties
+/secrets.properties
+**/google-services.json
+app/src/main/res/raw/wildcard.crt
+app/src/main/cpp/native-lib.cpp
+keystore.properties
+app/keystore/*
+keystore.properties
+debug-keystore.jks
+debug-keystore-base64.txt