* ci(release): smoke-test the release APK on an emulator, drop the BrowserStack trigger
The release workflow ended by triggering BrowserStack tests in
appium-mobile-tests with a personal token. The token expired on 2026-10-17, so
every release build since is red, and the BrowserStack run behind it had never
produced a result (it fails uploading the app, KeyError 'app_url', since
2026-08-03). Its tests mostly asserted nothing.
In its place, every release build now installs the APK on an x86_64 API 34
emulator on a GitHub-hosted runner, launches it, and fails unless the
first-run welcome screen appears with both its create and restore buttons and
the app has neither crashed nor exited. The screen is matched by view id, so
it holds in any locale. A screenshot, the view tree and logcat are kept as an
artifact. It needs no account and no stored secret, and it can be run by hand
against the APK of an earlier run.
* ci: run the emulator smoke test on pull requests that change it, against main's latest release APK
* TEMP: nail check, expect red
* Revert "TEMP: nail check, expect red"
This reverts commit 7f804317b4.
* build(rust): bump vulnerable crates in native binding lockfiles
- rand 0.8.5 -> 0.8.6 (GHSA-cq8v-f236-94qc) in hydra-dx-math and sr25519-bizinikiwi
- keccak 0.1.5 -> 0.1.6 (GHSA-3288-p39f-rqpv) in hydra-dx-math and sr25519-bizinikiwi
- bytes -> 1.11.1 (GHSA-434x-w66g-qw3r) in hydra-dx-math and metadata_shortener
- time 0.3.41 -> 0.3.47 (GHSA-r6v5-fh4h-64xc) in hydra-dx-math
- tracing-subscriber 0.3.19 -> 0.3.20 (GHSA-xwfj-jgwm-7wp5) in hydra-dx-math
Lockfile-only updates via cargo update --precise; Cargo.toml requirements
are unchanged. time 0.3.47 pulls serde 1.0.229/serde_core and requires
rustc 1.88, which the stable toolchain used by CI satisfies.
* ci: restrict default GITHUB_TOKEN permissions to contents: read
None of these workflows write through GITHUB_TOKEN: artifact upload,
Firebase, S3, Play Store, gh-pages and the Appium dispatch all use their
own credentials. Reusable workflows they call inherit the same cap.
* fix(dapp): send only fixed, JSON-quoted error messages to dApp pages
The polkadot.js responder forwarded Throwable.message of any rejection
error to the page and both responders interpolated the message into
JavaScript without escaping. Map polkadot.js rejections to a fixed public
message (unknown errors become "Request failed"), give MetamaskError an
explicit publicMessage, and quote both with JSONObject.quote so a message
can no longer break out of the string literal.
* ci: stop installing the removed legacy SDK 'tools' package
android-actions/setup-android installs 'tools platform-tools' by default.
sdkmanager now fails with "Failed to find package 'tools'", which aborts
dependency installation for every build and lint job. Only platform-tools
is needed; nothing in the workflows uses the legacy tools directory.
SatoshiQaziMuhammed