ci: fail closed if a pre-release tag would publish to Play production

[TimeToBuildBob]

Why

#243 reported a GitHub pre-release (v0.14.0b2) reaching production Play devices. Erik confirmed that was an intentional Play Console promotion from the internal track, not a CI mapping bug (comment).

The CI mapping itself is already correct after #182: X.Y.Z → production, anything else → internal. What was missing is a fail-closed assert at publish time, so a later regression (or copying the leftover test-job SUPPLY_TRACK: production env onto the publish job) cannot silently ship a pre-release tag to production.

This does not close #243. Play Console can still promote a track by hand; that is how b2 reached production. The remaining user-facing work on that issue is the bucket-migration path (aw-android-test-bucket-migration-merge / #244), not CI.

What changed

• scripts/assert-play-track.sh — resolve + assert + --self-test (stable v0.14.0 → production; v0.14.0b2 / dev / rc → internal; production + pre-release tag → hard fail).
• release-fastlane uses the script to set SUPPLY_TRACK, writes tag+track to the job summary, asserts after resolve, and asserts again immediately before fastlane supply run.
• Test job runs --self-test on every PR and drops the unused job-level SUPPLY_TRACK: production (it never reached fastlane).

Overlap

#212 also edits build.yml (signing hardening). Different hunks; rebase this if #212 lands first.

Test plan

• bash scripts/assert-play-track.sh --self-test
• resolve v0.14.0b2 → internal
• assert v0.14.0b2 production → exit 1
• CI: Test job Assert Play-track resolver green on this PR

[greptile-apps]

Greptile Summary

The PR adds a fail-closed Play-track resolver and validates the selected track at the publication boundary.

• Stable tags resolve to production, while pre-release tags resolve to internal.
• The workflow passes the validated track explicitly to Fastlane with --track.
• A self-test exercises the resolver and rejection cases on every PR.

Confidence Score: 5/5

The PR appears safe to merge.

The prior missing-track handoff is fixed because the value validated immediately before publication is now passed explicitly to Fastlane, and no blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/build.yml	Resolves and validates the Play track, then passes it explicitly to the Fastlane upload command.
scripts/assert-play-track.sh	Implements stable-tag classification, fail-closed track validation, and focused self-tests.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    Tag[Release tag] --> Resolve[Resolve Play track]
    Resolve --> Assert[Assert tag-track contract]
    Assert --> Secrets[Restore Play credentials]
    Secrets --> Reassert[Reassert at publish boundary]
    Reassert --> Fastlane[Fastlane supply with explicit track]
    Fastlane --> Play[Google Play selected track]

Loading

_{Reviews (2): Last reviewed commit: "ci: pass asserted Play track to fastlane..." | Re-trigger Greptile}

[TimeToBuildBob]

@greptileai review

[TimeToBuildBob]

CI-green and mergeable (Greptile 5/5) — waiting only on a maintainer click.

This PR is ready to merge, but the bot has pull-only access to this repo and can't self-merge — surfacing it here so it isn't lost. The monitoring loop will stop re-flagging it now that this note is posted.