F6.1 · cierre de presentación y barrera de release (#34)

Cierra F6.1 como candidata verificable de presentación: metadata WEB alineada, contratos transversales de aceptación, Android CI/RC endurecida con lint/tests/builds/checksum, correcciones de carreras de permisos GPS y cámara opcional, auditoría de dependencias productivas y parches de runtime, más documentación de release y recorrido de demo.

.github/workflows/android.yml

@@ -1,39 +1,36 @@
-name: Android APK
-# F6.1: genera una APK debug verificable contra la API productiva F6.1.
+name: Android CI / RC
+# F6.1 presentation barrier: lint + real tests + debug artifact + release compile.
 
 on:
   push:
     branches:
       - 'main'
-      - 'release/f5-android-test'
-      - 'feature/f2-2*'
-      - 'feature/f2-3*'
-      - 'feature/f2-4*'
-      - 'feature/f3-1*'
-      - 'feature/f3-2*'
-      - 'feature/f6-1*'
+      - 'release/f6-1*'
     paths:
       - 'android-app/**'
+      - 'api-v3/src/**'
       - '.github/workflows/android.yml'
   pull_request:
+    branches:
+      - 'main'
     paths:
       - 'android-app/**'
-      - 'api-v3/src/auth/**'
-      - 'api-v3/src/asset-master/**'
-      - 'api-v3/src/inspection-visits/**'
-      - 'api-v3/src/inspection-acts/**'
-      - 'api-v3/src/inspection-findings/**'
-      - 'api-v3/src/inspection-verifications/**'
+      - 'api-v3/src/**'
       - '.github/workflows/android.yml'
   workflow_dispatch:
 
 permissions:
   contents: read
 
+concurrency:
+  group: dhv2-android-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  build-debug-apk:
+  android:
+    name: Android · lint, tests, debug APK, release compile
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 35
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -55,18 +52,92 @@ jobs:
         with:
           gradle-version: '8.13'
 
-      - name: Assemble debug
-        working-directory: android-app
-        run: gradle --no-daemon :app:assembleDebug
+      - name: Validate mobile security and identity contract
+        run: |
+          set -Eeuo pipefail
+          grep -Fq 'applicationId = "com.korexlabs.dhinspeccion"' android-app/app/build.gradle.kts
+          grep -Fq 'applicationIdSuffix = ".debug"' android-app/app/build.gradle.kts
+          grep -Fq 'buildConfigField("String", "API_BASE_URL", "\"https://dhv2.korexlabs.com/api/v3/\"")' android-app/app/build.gradle.kts
+          grep -Fq 'android:allowBackup="false"' android-app/app/src/main/AndroidManifest.xml
+          grep -Fq 'android:usesCleartextTraffic="false"' android-app/app/src/main/AndroidManifest.xml
 
-      - name: Unit tests
+      - name: Android lint
+        working-directory: android-app
+        run: gradle --no-daemon :app:lintDebug
+
+      - name: Print complete lint failures
+        if: failure()
+        run: |
+          report="android-app/app/build/intermediates/lint_intermediate_text_report/debug/lintReportDebug/lint-results-debug.txt"
+          if [ -f "$report" ]; then
+            echo '========== ANDROID LINT =========='
+            cat "$report"
+          fi
+
+      - name: Android unit tests
         working-directory: android-app
         run: gradle --no-daemon :app:testDebugUnitTest
 
-      - name: Upload APK
+      - name: Require real unit-test results
+        run: |
+          set -Eeuo pipefail
+          test_dir="android-app/app/build/test-results/testDebugUnitTest"
+          test -d "$test_dir"
+          total="$(grep -h -oE '<testsuite[^>]+tests="[0-9]+"' "$test_dir"/TEST-*.xml 2>/dev/null | sed -E 's/.*tests="([0-9]+)"/\1/' | awk '{sum += $1} END {print sum + 0}')"
+          test "$total" -gt 0
+          echo "Android unit tests discovered: $total"
+
+      - name: Assemble debug APK
+        working-directory: android-app
+        run: gradle --no-daemon :app:assembleDebug
+
+      - name: Compile unsigned release variant
+        working-directory: android-app
+        run: gradle --no-daemon :app:assembleRelease
+
+      - name: Package RC artifact and checksum
+        id: package
+        run: |
+          set -Eeuo pipefail
+          version="$(sed -n 's/^[[:space:]]*versionName = "\([^"]*\)"/\1/p' android-app/app/build.gradle.kts | head -n1)"
+          code="$(sed -n 's/^[[:space:]]*versionCode = \([0-9][0-9]*\)/\1/p' android-app/app/build.gradle.kts | head -n1)"
+          test -n "$version"
+          test -n "$code"
+          short_sha="${GITHUB_SHA::12}"
+          mkdir -p android-app/dist
+          apk="android-app/dist/DH-Inspeccion-${version}-vc${code}-${short_sha}-debug.apk"
+          cp android-app/app/build/outputs/apk/debug/app-debug.apk "$apk"
+          sha256sum "$apk" > "${apk}.sha256"
+          {
+            echo "phase=F6.1"
+            echo "version=$version"
+            echo "versionCode=$code"
+            echo "commit=$GITHUB_SHA"
+            echo "artifact=$(basename "$apk")"
+            echo "applicationId=com.korexlabs.dhinspeccion.debug"
+            echo "apiBaseUrl=https://dhv2.korexlabs.com/api/v3/"
+            echo "channel=DEBUG_RC"
+          } > android-app/dist/release-metadata.txt
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "version_code=$code" >> "$GITHUB_OUTPUT"
+          echo "short_sha=$short_sha" >> "$GITHUB_OUTPUT"
+
+      - name: Upload debug RC
         uses: actions/upload-artifact@v4
         with:
-          name: DH-Inspeccion-F6.1-0.15.0-debug
-          path: android-app/app/build/outputs/apk/debug/app-debug.apk
+          name: DH-Inspeccion-${{ steps.package.outputs.version }}-vc${{ steps.package.outputs.version_code }}-${{ steps.package.outputs.short_sha }}-debug
+          path: android-app/dist/*
           if-no-files-found: error
           retention-days: 30
+
+      - name: Upload Android diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: android-diagnostics-${{ github.sha }}
+          path: |
+            android-app/app/build/reports/lint-results-debug.html
+            android-app/app/build/reports/tests/testDebugUnitTest/**
+            android-app/app/build/test-results/testDebugUnitTest/**
+          if-no-files-found: ignore
+          retention-days: 14

.github/workflows/security-audit.yml

@@ -0,0 +1,48 @@
+name: Production dependency audit
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dhv2-production-audit-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  api:
+    name: API · production dependencies
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: api-v3
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: api-v3/package-lock.json
+      - name: Reject high/critical runtime advisories
+        run: npm audit --omit=dev --audit-level=high
+
+  web:
+    name: WEB · production dependencies
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web-v2
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: web-v2/package-lock.json
+      - name: Reject high/critical runtime advisories
+        run: npm audit --omit=dev --audit-level=high