ci: fall back to debug APK when Android secrets unset and verify release compose & node image

.github/workflows/ci.yml

@@ -153,7 +153,7 @@ jobs:
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5
 
-      - name: Validate and build Control Plane image
+      - name: Validate and build Control Plane and Node images
         run: |
           # compose.yaml interpolates the OpenCode basic-auth pair, the agent
           # MCP token, and the model credential with `:?`, so validation
@@ -165,9 +165,25 @@ jobs:
             OPENCODE_AGENT_MCP_TOKEN=ci-opencode-agent-mcp-token \
             OPENCODE_MODEL_API_KEY=ci-opencode-model-key \
             docker compose -f deploy/compose.yaml config --quiet
+          TERMFLOW_ADMIN_TOKEN=ci-admin-token-that-is-long-enough \
+            OPENCODE_SERVER_USERNAME=termflow \
+            OPENCODE_SERVER_PASSWORD=ci-opencode-password \
+            OPENCODE_AGENT_MCP_TOKEN=ci-opencode-agent-mcp-token \
+            DEEPSEEK_API_KEY=ci-deepseek-key \
+            TERMFLOW_RELEASE_IMAGE_TAG=ci \
+            TERMFLOW_AGENT_PROVIDER_DEEPSEEK_ENDPOINT_ORIGIN=https://api.deepseek.com \
+            TERMFLOW_AGENT_PROVIDER_DEEPSEEK_MODEL_IDS=deepseek-v4-flash \
+            TERMFLOW_AGENT_PROVIDER_DEEPSEEK_REGION=global \
+            TERMFLOW_AGENT_PROVIDER_DEEPSEEK_RETENTION_TERMS="account policy" \
+            TERMFLOW_AGENT_PROVIDER_DEEPSEEK_RETENTION_VERSION=policy-2026-09 \
+            TERMFLOW_AGENT_PROVIDER_DEEPSEEK_NO_TRAINING=true \
+            TERMFLOW_AGENT_PROVIDER_DEEPSEEK_POLICY_VERSION=policy-2026-09 \
+            docker compose -f deploy/compose.release.yaml config --quiet
           scripts/build-control-plane-image.sh termflow-control-plane:ci
           scripts/verify-control-plane-image.sh termflow-control-plane:ci
           scripts/release/verify_control_plane_release_image.sh termflow-control-plane:ci
+          scripts/build-node-image.sh termflow-node:ci
+          scripts/verify-node-image.sh termflow-node:ci
 
   tauri-desktop-unsigned:
     strategy:

.github/workflows/tauri-packages.yml

@@ -95,6 +95,11 @@ jobs:
           RELEASE_TAG: ${{ inputs.release_tag }}
           TERMFLOW_BUILD_VERSION: ${{ inputs.version || vars.TERMFLOW_BUILD_VERSION }}
           SIGNED_ANDROID_CANDIDATE: ${{ inputs.signed_android_candidate }}
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+          ANDROID_SIGNING_CERT_SHA256: ${{ secrets.ANDROID_SIGNING_CERT_SHA256 }}
         shell: bash
         run: |
           set -euo pipefail
@@ -110,6 +115,13 @@ jobs:
           fi
           if [[ -n "$release_tag" || "$SIGNED_ANDROID_CANDIDATE" == "true" ]]; then
             android_release_build=true
+            for name in ANDROID_KEYSTORE_BASE64 ANDROID_KEYSTORE_PASSWORD ANDROID_KEY_ALIAS ANDROID_KEY_PASSWORD ANDROID_SIGNING_CERT_SHA256; do
+              if [[ -z "${!name}" ]]; then
+                echo "::warning::Android signing secrets not configured; falling back to unsigned/debug APK build"
+                android_release_build=false
+                break
+              fi
+            done
           else
             android_release_build=false
           fi
@@ -330,8 +342,8 @@ jobs:
           set -euo pipefail
           for name in ANDROID_KEYSTORE_BASE64 ANDROID_KEYSTORE_PASSWORD ANDROID_KEY_ALIAS ANDROID_KEY_PASSWORD ANDROID_SIGNING_CERT_SHA256; do
             if [[ -z "${!name}" ]]; then
-              echo "Missing required Android release secret: $name" >&2
-              exit 1
+              echo "::warning::Android signing secrets not configured; falling back to unsigned/debug APK build"
+              exit 0
             fi
           done
           keystore="$RUNNER_TEMP/termflow-android-release.jks"

tests/release/test_packaging_workflow_contract.py

@@ -389,7 +389,10 @@ def test_android_release_is_signed_verified_and_iconized() -> None:
         "ANDROID_KEY_ALIAS",
         "ANDROID_KEY_PASSWORD",
         "ANDROID_SIGNING_CERT_SHA256",
-        "Missing required Android release secret: $name",
+        (
+            "::warning::Android signing secrets not configured; "
+            "falling back to unsigned/debug APK build"
+        ),
         "*-release.apk",
         "*-debug.apk",
         "TermFlow-${TERMFLOW_BUILD_VERSION}-android-arm64.apk",