android-signing and trivy-fs-scan actions (android repo cleanup)

- android-signing: the keystore-restore step previously copy-pasted in
  habitude and ablage-android; no-op without the secret (unsigned build).
- trivy-fs-scan: lockfile-based dependency scan for artifact-building
  repos (APKs); non-blocking by default via enforce input.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

README.md

@@ -105,6 +105,34 @@ exist. Requires `skopeo` on the runner (`noctrl/gitea-runner` >= v10).
     registry-password: ${{ secrets.REGISTRY_PASSWORD }}
 ```
 
+### Android Signing
+
+Restores the Android release keystore (`<alias>-release.jks` + `keystore.properties`)
+from repo secrets; no-op when the secret is unset (build stays unsigned).
+
+**Location:** [`./android-signing`](./android-signing)
+
+```yaml
+- uses: https://gitea.noctrl.eu/public/actions/android-signing@v12
+  with:
+    keystore-b64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
+    keystore-password: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+    key-alias: habitude
+```
+
+### Trivy Filesystem Scan
+
+Scans the checked-out workspace for vulnerable dependencies (lockfile-based) —
+for repos that build artifacts (APKs) rather than images. Non-blocking by
+default (`enforce: "false"`); requires committed Gradle lockfiles and the
+trivy binary on the runner. Pin the job to `linux,build,amd64`.
+
+**Location:** [`./trivy-fs-scan`](./trivy-fs-scan)
+
+```yaml
+- uses: https://gitea.noctrl.eu/public/actions/trivy-fs-scan@v12
+```
+
 ### Deploy Prod
 
 Shared deploy body for the `*.podman` infrastructure repos: installs the SSH

android-signing/action.yaml

@@ -0,0 +1,45 @@
+name: Android Signing
+description: >
+  Restore an Android release-signing keystore from repo secrets so Gradle can
+  sign the release APK. Writes <key-alias>-release.jks plus keystore.properties
+  in the workspace. When the keystore secret is empty the step is a no-op and
+  the build stays unsigned — same optional-signing behavior the app repos had
+  with their copy-pasted versions of this step.
+
+inputs:
+  keystore-b64:
+    description: Base64-encoded release keystore (ANDROID_KEYSTORE_B64 secret).
+    required: false
+    default: ""
+  keystore-password:
+    description: Keystore/key password (ANDROID_KEYSTORE_PASSWORD secret).
+    required: false
+    default: ""
+  key-alias:
+    description: Key alias; also names the keystore file (<alias>-release.jks).
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - id: restore
+      shell: bash
+      env:
+        KEYSTORE_B64: ${{ inputs.keystore-b64 }}
+        KEYSTORE_PASSWORD: ${{ inputs.keystore-password }}
+        KEY_ALIAS: ${{ inputs.key-alias }}
+      run: |
+        set -euo pipefail
+        if [[ -z "${KEYSTORE_B64}" ]]; then
+          echo "No keystore secret configured; release build stays unsigned."
+          exit 0
+        fi
+        : "${KEYSTORE_PASSWORD:?keystore-b64 is set but keystore-password is empty}"
+        printf '%s' "${KEYSTORE_B64}" | base64 -d > "${KEY_ALIAS}-release.jks"
+        {
+          echo "storeFile=${PWD}/${KEY_ALIAS}-release.jks"
+          echo "storePassword=${KEYSTORE_PASSWORD}"
+          echo "keyAlias=${KEY_ALIAS}"
+          echo "keyPassword=${KEYSTORE_PASSWORD}"
+        } > keystore.properties
+        echo "Restored ${KEY_ALIAS}-release.jks and keystore.properties."

trivy-fs-scan/action.yaml

@@ -0,0 +1,51 @@
+name: Trivy Filesystem Scan
+description: >
+  Scan the checked-out workspace for vulnerable dependencies (lockfile-based:
+  gradle.lockfile, package-lock.json, etc.) with Trivy. For repos that build
+  artifacts rather than container images. Requires the trivy binary on the
+  runner (noctrl/gitea-runner >= v9) — pin the job to linux,build,amd64.
+  Gradle projects must have dependency locking enabled with committed
+  lockfiles, or trivy has nothing to read.
+
+inputs:
+  path:
+    description: Directory to scan.
+    required: false
+    default: "."
+  severity:
+    description: Comma-separated Trivy severities to report.
+    required: false
+    default: HIGH,CRITICAL
+  enforce:
+    description: >
+      "true" fails the job on findings with an available fix; "false" only
+      reports them (start non-blocking, flip once the noise level is known).
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - id: scan
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        if ! command -v trivy >/dev/null 2>&1; then
+          echo "ERROR: trivy not found on this runner (needs noctrl/gitea-runner >= v9)" >&2
+          exit 1
+        fi
+
+        exit_code=0
+        if [[ "${{ inputs.enforce }}" == "true" ]]; then
+          exit_code=1
+        fi
+
+        echo "Scanning ${{ inputs.path }} (severities: ${{ inputs.severity }}, enforce: ${{ inputs.enforce }})"
+        trivy fs \
+          --scanners vuln \
+          --severity "${{ inputs.severity }}" \
+          --ignore-unfixed \
+          --exit-code "${exit_code}" \
+          --no-progress \
+          "${{ inputs.path }}"