dewemoji/apk-direct-release-guide.md

APK Direct Release Guide (Local Build + Cloudflare R2)

This is the Dewemoji direct APK release flow.

1) One-time setup

Required tools (local machine)

brew install awscli
brew install --cask android-platform-tools

Required environment variables

export R2_ACCOUNT_ID="..."
export R2_ACCESS_KEY_ID="..."
export R2_SECRET_ACCESS_KEY="..."
export R2_BUCKET="dewemoji-downloads"
export R2_PUBLIC_BASE_URL="https://downloads.dewemoji.com"

Optional:

export DEWEMOJI_APK_URL="https://dewemoji.com/downloads/dewemoji-latest.apk"

Optional signing environment (recommended)

export ANDROID_KEYSTORE_PATH="/absolute/path/release.jks"
export ANDROID_KEYSTORE_PASSWORD="..."
export ANDROID_KEY_ALIAS="..."
export ANDROID_KEY_PASSWORD="..."

---

2) Canonical URLs used by app updater

• https://dewemoji.com/downloads/version.json
• https://dewemoji.com/downloads/dewemoji-latest.apk

These endpoints redirect to R2 objects.

---

3) Release steps

Run from repo root.

A. Build APK

./scripts/apk/build-release.sh

Output APK:

• dewemoji-capacitor/dist/apk/dewemoji-v{versionName}-{versionCode}.apk

B. Publish APK + metadata to R2

./scripts/apk/publish-r2.sh \
  --apk dewemoji-capacitor/dist/apk/dewemoji-v1.1.2-112.apk \
  --version-name 1.1.2 \
  --version-code 112 \
  --min-supported-version-code 100 \
  --notes "Bug fixes and update UX improvements" \
  --force false

C. Verify published release

./scripts/apk/verify-release.sh --base-url https://dewemoji.com/downloads

---

4) Versioning rules

1. Site-only deploy: do not bump APK version and do not publish new version.json.
2. Runtime/app-shell change: bump versionCode + versionName, then publish.
3. versionCode must always increase.
4. App update prompt appears only when remote versionCode is higher.

---

5) Rollback

1. Keep all versioned APK objects immutable (never overwrite).
2. Re-upload previous good APK to apk/dewemoji-latest.apk.
3. Re-publish apk/version.json with matching checksum/version fields.
4. Re-run verify script.

---

6) Notes

• Direct APK update is user-confirmed install (Android policy), not silent.
• Never embed R2 credentials in app.
• Keep app update payload over HTTPS only.