Upload release AAB to Google Play internal track from CI

Co-Authored-By: Claude Code <noreply@anthropic.com>

.claude/context/standards.md

@@ -131,3 +131,16 @@ Networking is deliberately split: `package:http` for simple JSON/XML
 request-response calls, `package:dio` only where streaming/progress is
 needed (downloads). Don't introduce a third HTTP client — extend the
 existing split instead.
+
+## Play Store upload (CI)
+
+`.gitea/workflows/release.yml` (on `Release-*` tags) first checks the tag
+equals `Release-<pubspec version>`, builds the signed `.aab`, attaches it to a
+Gitea release, then uploads it with `r0adkll/upload-google-play` to the
+`internal` track as a **draft** (promote in Play Console, or edit
+`track`/`status` in the workflow). Requires the `PLAY_SERVICE_ACCOUNT_JSON`
+repo secret (service account with release permissions; the app's first
+release must be uploaded manually). Play rejects a repeated `versionCode`, so
+bump the `+N` in `pubspec.yaml` for every tag - re-tagging the same version
+will fail the upload. Release notes come from
+`distribution/whatsnew/whatsnew-en-US` (max 500 chars) - update per release.

.gitea/workflows/release.yml

@@ -39,6 +39,16 @@ jobs:
           # platform/build-tools versions it actually needs on its own.
           packages: "platform-tools"
 
+      - name: Check tag matches pubspec version
+        # Play rejects a repeated versionCode and a mismatched tag would
+        # publish the wrong version name, so fail fast before building.
+        run: |
+          VERSION=$(grep '^version:' pubspec.yaml | sed 's/version: //' | cut -d'+' -f1)
+          if [ "${GITHUB_REF_NAME}" != "Release-${VERSION}" ]; then
+            echo "Tag ${GITHUB_REF_NAME} does not match pubspec version ${VERSION}" >&2
+            exit 1
+          fi
+
       - name: Install dependencies
         run: flutter pub get
 
@@ -67,6 +77,7 @@ jobs:
           mkdir -p release
           cp build/app/outputs/bundle/release/app-release.aab "release/Noo-${VERSION}.aab"
           echo "AAB_PATH=release/Noo-${VERSION}.aab" >> "$GITHUB_ENV"
+          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
 
       - name: Publish Gitea release with App Bundle attached
         # Gitea-native release action (not GitHub's) - authenticates and
@@ -77,3 +88,18 @@ jobs:
         uses: akkuman/gitea-release-action@v1
         with:
           files: ${{ env.AAB_PATH }}
+
+      - name: Upload to Google Play (internal track, draft)
+        # Stages the build only; promote it in Play Console, or change
+        # `status` to "completed" (and/or `track`) to roll out automatically.
+        # Needs the PLAY_SERVICE_ACCOUNT_JSON repo secret, and the app's
+        # first release must already have been uploaded by hand.
+        uses: r0adkll/upload-google-play@v1
+        with:
+          serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+          packageName: dev.ayushya.noo
+          releaseFiles: ${{ env.AAB_PATH }}
+          releaseName: ${{ env.VERSION }}
+          track: internal
+          status: draft
+          whatsNewDirectory: distribution/whatsnew

distribution/whatsnew/whatsnew-en-US

@@ -0,0 +1 @@
+Redesigned Noo interface, multi-account support, app locks, offline sync, appearance customization, and a markdown viewer and editor.