Merge remote-tracking branch 'origin/stage' into feat/ADFA-3253-skip-llama-assets-ci

# Conflicts:
#	app/build.gradle.kts

Author: jatezzz

.github/workflows/release.yml

@@ -582,60 +582,16 @@ jobs:
 
           echo "FIREBASE_CONSOLE_URL=$FIREBASE_URL" >> $GITHUB_OUTPUT
 
-      - name: Set up SSH key
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Upload APK to Cloudflare R2
         env:
-          GREENGEEKS_HOST: ${{ vars.GREENGEEKS_SSH_HOST }}
-          GREENGEEKS_KEY: ${{ secrets.GREENGEEKS_SSH_PRIVATE_KEY }}
-          GREENGEEKS_USER: ${{ vars.GREENGEEKS_SSH_USER }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_KEY_ID: ${{ vars.CLOUDFLARE_KEY_ID }}
+          CLOUDFLARE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_SECRET_ACCESS_KEY }}
         run: |
-          mkdir -p ~/.ssh
-          if [ -z "$GREENGEEKS_HOST" ]; then
-            echo "Error: SSH_HOST variable is not set"
-            exit 1
-          fi
-          # Write the SSH key, ensuring proper formatting
-          echo "$GREENGEEKS_KEY" > ~/.ssh/id_rsa
-          # Remove any trailing newlines and ensure proper key format
-          sed -i '' -e '$ { /^$/ d; }' ~/.ssh/id_rsa 2>/dev/null || sed -i '$ { /^$/ d; }' ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          # Verify key format
-          if ! grep -q "BEGIN.*PRIVATE KEY" ~/.ssh/id_rsa; then
-            echo "Error: SSH key does not appear to be in correct format"
-            exit 1
-          fi
-          # Configure SSH to use only the key file and disable other auth methods
-          cat > ~/.ssh/config <<EOF
-          Host *
-            IdentitiesOnly yes
-            PreferredAuthentications publickey
-            StrictHostKeyChecking no
-            UserKnownHostsFile ~/.ssh/known_hosts
-            PubkeyAuthentication yes
-            PasswordAuthentication no
-            ChallengeResponseAuthentication no
-            GSSAPIAuthentication no
-            GSSAPIKeyExchange no
-            GSSAPIDelegateCredentials no
-          Host $GREENGEEKS_HOST
-            User $GREENGEEKS_USER
-            IdentityFile ~/.ssh/id_rsa
-            IdentitiesOnly yes
-            PreferredAuthentications publickey
-            PubkeyAuthentication yes
-            PasswordAuthentication no
-            ChallengeResponseAuthentication no
-            GSSAPIAuthentication no
-            GSSAPIKeyExchange no
-            GSSAPIDelegateCredentials no
-            NumberOfPasswordPrompts 0
-          EOF
-          chmod 600 ~/.ssh/config
-          # Disable SSH agent completely
-          unset SSH_AUTH_SOCK
-          unset SSH_AGENT_PID
-          # Remove any default SSH keys that might interfere
-          rm -f ~/.ssh/id_ed25519 ~/.ssh/id_ecdsa ~/.ssh/id_dsa ~/.ssh/id_rsa.pub 2>/dev/null
-          ssh-keyscan -H "$GREENGEEKS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+          uv run --with boto3 scripts/cloudflare-r2-upload.py "${{ steps.find_apk.outputs.APK_PATH }}" "${{ matrix.variant }}"
 
       - name: Clean up build folder after upload
         run: |
@@ -735,6 +691,27 @@ jobs:
 
           rm -f payload.json
 
+      - name: Send Telegram message
+        env:
+          TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
+          TELEGRAM_EARLY_ACCESS_CHAT_ID: ${{ vars.TELEGRAM_EARLY_ACCESS_CHAT_ID }}
+          APK_PATH: ${{ steps.find_apk.outputs.APK_PATH }}
+          VARIANT: ${{ matrix.variant }}
+        run: |
+          GIT_LOG=$(git log --oneline --since "24 hours ago" || true)
+          if [ -z "$GIT_LOG" ]; then
+            GIT_LOG="(no commits in the last 24 hours)"
+          fi
+          APK_BASENAME=$(basename "$APK_PATH")
+          APK_FILENAME="${APK_BASENAME%.*}-${VARIANT}.${APK_BASENAME##*.}"
+          DOWNLOAD_URL="https://download.appdevforall.org/${APK_FILENAME}"
+          MESSAGE="${GIT_LOG}"$'\n\n'"Download: ${DOWNLOAD_URL}"
+          # Telegram message limit 4096; use first 4096 chars
+          MESSAGE="${MESSAGE:0:4096}"
+          curl -s -X POST -H "Content-Type: application/json" \
+            -d "$(jq -n --arg chat_id "$TELEGRAM_EARLY_ACCESS_CHAT_ID" --arg text "$MESSAGE" '{chat_id: $chat_id, text: $text}')" \
+            "https://api.telegram.org/bot${TELEGRAM_TOKEN}/sendMessage"
+
       - name: Cleanup google-services.json
         if: always()
         run: |

README.md

@@ -4,7 +4,7 @@
 
 <h2 align="center"><b>Code On The Go</b></h2>
 <p align="center">
- Code on the Go is an IDE that lets you build Android apps on Android phones, without needing a traditional computer or Internet access.</p>
+ Code on the Go is an IDE that lets you build Android apps on Android phones, without needing a traditional computer or Internet access. Code on the Go is a project of App Dev for All, a nonprofit organization committed to making computer science education and professional programming resources universally available.</p>
 <p><br>
 
 <p align="center">
@@ -104,3 +104,4 @@ along with Code On The Go.  If not, see <https://www.gnu.org/licenses/>.
 Any violations to the license can be reported either by opening an issue or writing a mail to us
 directly.
 
+

app/build.gradle.kts

@@ -302,7 +302,7 @@ dependencies {
 	implementation(projects.idetooltips)
 	implementation(projects.cvImageToXml)
 	implementation(projects.composePreview)
-  implementation(projects.gitCore)
+	implementation(projects.gitCore)
 
 	// This is to build the tooling-api-impl project before the app is built
 	// So we always copy the latest JAR file to assets
@@ -318,7 +318,7 @@ dependencies {
 	androidTestImplementation(libs.tests.junit.kts)
 	androidTestImplementation(libs.tests.androidx.test.runner)
 	androidTestUtil(libs.tests.orchestrator)
-    testImplementation(libs.tests.kotlinx.coroutines)
+	testImplementation(libs.tests.kotlinx.coroutines)
 
 	// brotli4j
 	implementation(libs.brotli4j)
@@ -503,6 +503,21 @@ fun createAssetsZip(arch: String) {
 
 			// 4. Set the full command line
 			commandLine(d8Command)
+
+			// Prepend JAVA_HOME/bin to PATH, so that `java` can be resolved
+			// on systems which don't already have `java` in PATH
+			val javaHome = System.getProperty("java.home")
+			if (javaHome.isNotBlank()) {
+				val javaHomeBin = javaHome + File.separator + "bin"
+				val currentPath = System.getenv("PATH") ?: ""
+				var finalPath = javaHomeBin
+				if (currentPath.isNotBlank()) {
+					finalPath += File.pathSeparator
+					finalPath += currentPath
+				}
+
+				environment("PATH", finalPath)
+			}
 		}.assertNormalExitValue()
 
 	if (!dexOutputFile.exists()) {

scripts/cloudflare-r2-upload.py

@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Upload a file (e.g. APK) to Cloudflare R2. Credentials via env: CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_KEY_ID, CLOUDFLARE_SECRET_ACCESS_KEY."""
+import sys
+import os
+import boto3
+from botocore.config import Config
+
+REQUIRED_ENV = (
+    "CLOUDFLARE_ACCOUNT_ID",
+    "CLOUDFLARE_KEY_ID",
+    "CLOUDFLARE_SECRET_ACCESS_KEY",
+)
+
+for name in REQUIRED_ENV:
+    if not os.environ.get(name):
+        print(f"ERROR: {name} environment variable is not set.", file=sys.stderr)
+        sys.exit(1)
+
+CLOUDFLARE_ACCOUNT_ID = os.environ["CLOUDFLARE_ACCOUNT_ID"]
+CLOUDFLARE_KEY_ID = os.environ["CLOUDFLARE_KEY_ID"]
+CLOUDFLARE_SECRET_ACCESS_KEY = os.environ["CLOUDFLARE_SECRET_ACCESS_KEY"]
+BUCKET_NAME = "apk-repo"
+
+R2_ENDPOINT_URL = f"https://{CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com"
+
+config = Config(
+    read_timeout=300,
+    connect_timeout=60,
+    retries={"max_attempts": 10},
+)
+
+s3 = boto3.client(
+    service_name="s3",
+    endpoint_url=R2_ENDPOINT_URL,
+    aws_access_key_id=CLOUDFLARE_KEY_ID,
+    aws_secret_access_key=CLOUDFLARE_SECRET_ACCESS_KEY,
+    region_name="auto",
+    config=config,
+)
+
+if len(sys.argv) < 3:
+    print("Usage: cloudflare-r2-upload.py <file_path> <variant>", file=sys.stderr)
+    sys.exit(1)
+
+file_path = sys.argv[1]
+variant = sys.argv[2]
+file_size = os.path.getsize(file_path)
+base_name = os.path.basename(file_path)
+# Inject variant into filename before .apk so v7 and v8 upload to distinct R2 keys
+name_root, ext = os.path.splitext(base_name)
+file_name = f"{name_root}-{variant}{ext}"
+
+extra_args = {}
+if file_name.lower().endswith(".apk"):
+    extra_args["ContentType"] = "application/vnd.android.package-archive"
+
+# Progress callback: print new lines at 10% intervals for CI-friendly logs (bytes_amount is incremental per call)
+_seen_so_far = [0]
+_last_printed_pct = [-1]
+
+def progress_callback(bytes_amount):
+    _seen_so_far[0] += bytes_amount
+    if file_size <= 0:
+        return
+    pct = int(100 * _seen_so_far[0] / file_size)
+    if pct >= _last_printed_pct[0] + 10 or pct == 100:
+        _last_printed_pct[0] = pct
+        mb = _seen_so_far[0] / (1024 * 1024)
+        total_mb = file_size / (1024 * 1024)
+        print(f"Upload progress: {pct}% ({mb:.1f} MB / {total_mb:.1f} MB)", flush=True)
+
+
+upload_kwargs = {"Callback": progress_callback}
+if extra_args:
+    upload_kwargs["ExtraArgs"] = extra_args
+
+print(f"Uploading {file_name} ({file_size / (1024*1024):.1f} MB) to R2...", flush=True)
+s3.upload_file(file_path, BUCKET_NAME, file_name, **upload_kwargs)
+print("Upload complete.", flush=True)

subprojects/llama.cpp/README.md

@@ -53,6 +53,12 @@ llama-cli -hf ggml-org/gemma-3-1b-it-GGUF
 llama-server -hf ggml-org/gemma-3-1b-it-GGUF
 ```
 
+## Security note (local wasm test server)
+
+`scripts/serve-static.js` now constrains request paths to the wasm output directory and adds safer HTML response headers.
+- This prevents path traversal and reduces XSS risk in directory listings and served HTML.
+- How? Normalize/resolve paths under `build-wasm/bin`, return `403` on escapes, escape listing labels, and apply CSP + `nosniff` to HTML.
+
 ## Description
 
 The main goal of `llama.cpp` is to enable LLM inference with minimal setup and state-of-the-art performance on a wide