tonkeeper · achupin-top · Mar 11, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+
+  - package-ecosystem: "gradle"
+    directory: "/"
+    schedule:
+      interval: "monthly"
diff --git a/.github/workflows/baselineprofile.yml b/.github/workflows/baselineprofile.yml
@@ -6,7 +6,7 @@ on:
 jobs:
   baseline:
     name: generate-baselineprofile
-    runs-on: macOS-latest
+    runs-on: macos-latest-xlarge
 
     env:
       EMULATOR_API_LEVEL: '30'
@@ -15,28 +15,28 @@ jobs:
 
     steps:
       - name: Checkout to git repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           lfs: 'true'
 
       - name: Check LFS files
         uses: actionsdesk/lfs-warning@v3.3
 
       - name: Install JDK
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'
           java-version: '22'
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v5
 
       - name: Build benchmark
         id: gradle
         run: ./gradlew :apps:wallet:instance:main:generateReleaseBaselineProfile
 
       - name: AVD cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: avd-cache
         with:
           path: |

diff --git a/.github/workflows/beta.yml b/.github/workflows/beta.yml
@@ -0,0 +1,58 @@
+name: Android Beta Build
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  beta-build:
+    name: Build Beta APK
+    runs-on: macos-latest-xlarge
+
+    steps:
+      - name: Checkout to git repository
+        uses: actions/checkout@v6
+
+      - name: Get VERSION_CODE from commit timestamp
+        run: echo "VERSION_CODE=$(git log -1 --format=%ct)" >> $GITHUB_ENV
+
+      - name: Setup Java
+        uses: actions/setup-java@v5
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+
+      - name: Cache Gradle Wrapper
+        uses: actions/cache@v5
+        with:
+          path: ~/.gradle/wrapper
+          key: gradle-wrapper-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
+
+      - name: Accept Android SDK licenses
+        run: yes | $ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager --licenses
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v5
+
+      - name: Decode Keystore
+        run: echo "${{ secrets.ANDROID_DIST_SIGNING_KEY }}" | base64 -d > ${{ github.workspace }}/release.keystore
+
+      - name: Build Beta APK
+        run: |
+          ./gradlew :apps:wallet:instance:main:assembleDefaultRelease \
+            --no-daemon \
+            --no-build-cache \
+            --no-configuration-cache \
+            -Pandroid.injected.signing.store.file=${{ github.workspace }}/release.keystore \
+            -Pandroid.injected.signing.store.password=${{ secrets.TONKEEPER_UPLOAD_STORE_PASSWORD }} \
+            -Pandroid.injected.signing.key.alias=${{ secrets.TONKEEPER_UPLOAD_KEY_ALIAS }} \
+            -Pandroid.injected.signing.key.password=${{ secrets.TONKEEPER_UPLOAD_KEY_PASSWORD }}
+
+      - name: Upload Beta APK to artifacts
+        uses: actions/upload-artifact@v6
+        with:
+          name: tonkeeper-beta-${{ env.VERSION_CODE }}
+          path: apps/wallet/instance/main/build/outputs/apk/default/release/*.apk
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
@@ -0,0 +1,82 @@
+name: Claude PR Review
+
+on:
+  pull_request:
+    types: [ opened, reopened ]
+    branches:
+      - dev
+      - 'release/**'
+
+permissions:
+  pull-requests: write
+  contents: read
+  id-token: write
+
+jobs:
+  overview:
+    if: contains(github.event.pull_request.body, '/claude-overview') || contains(github.event.pull_request.body, '@claude')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Main changes summary
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          settings: '{"permissions":{"allow":["Bash(gh pr comment:*)","Bash(gh pr diff:*)","Bash(gh pr view:*)"]}}'
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            You are a senior software engineer reviewing a pull request.
+
+            Provide a concise summary of the main changes.
+            Group changes by area/module when possible.
+            Use bullet points. Be specific but brief.
+            Do NOT mention security concerns.
+
+            If commit messages or the diff contain task numbers (e.g. TK-123, TK-456),
+            list them at the top of your summary under a "Related Tasks" heading.
+
+            After composing your summary, post it as a single PR comment using:
+            gh pr comment <PR_NUMBER> --repo ${{ github.repository }} --body "<your summary>"
+          claude_args: |
+            --max-turns 8
+            --model claude-sonnet-4-5-20250929
+            --allowedTools "Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
+
+  review:
+    if: contains(github.event.pull_request.body, '/claude-review') || contains(github.event.pull_request.body, '@claude')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          settings: '{"permissions":{"allow":["Bash(gh pr comment:*)","Bash(gh pr diff:*)","Bash(gh pr view:*)"]}}'
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            You are a senior software engineer performing a thorough code review on an Android (Kotlin) project.
+
+            Provide actionable feedback. Focus on:
+            - Bugs and logic errors
+            - Performance issues
+            - Security issues
+            - Code readability and maintainability
+            - Kotlin/Android best practices
+            - Error handling gaps
+            - Potential race conditions or threading issues
+
+            For each issue found, reference the file name and provide a clear explanation.
+            Do NOT comment on things that are correct or well-written — only comment on actual problems.
+            If the code looks good and has no issues, post a single brief PR comment saying so.
+            Do not invent problems. Be constructive and concise.
+
+            Use inline comments for specific issues found in the code.
+          claude_args: |
+            --max-turns 25
+            --model claude-opus-4-6
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
diff --git a/.github/workflows/debug.yml b/.github/workflows/debug.yml
@@ -0,0 +1,64 @@
+name: Android Debug Build
+
+on:
+  push:
+    branches:
+      - 'dev'
+      - 'release/**'
+  pull_request:
+    types: [ opened, synchronize ]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  debug-build:
+    name: Build Debug APK
+    runs-on: macos-latest-xlarge
+
+    steps:
+      - name: Checkout to git repository
+        uses: actions/checkout@v6
+
+      - name: Get VERSION_CODE from commit timestamp
+        run: echo "VERSION_CODE=$(git log -1 --format=%ct)" >> $GITHUB_ENV
+
+      - name: Setup Java
+        uses: actions/setup-java@v5
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+
+      - name: Cache Gradle Wrapper
+        uses: actions/cache@v5
+        with:
+          path: ~/.gradle/wrapper
+          key: gradle-wrapper-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
+
+      - name: Accept Android SDK licenses
+        run: yes | $ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager --licenses
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v5
+
+      - name: Decode Keystore
+        run: echo "${{ secrets.TONKEEPER_DEBUG_STORE_FILE }}" | base64 -d > ${{ github.workspace }}/internal.keystore
+
+      - name: Build Debug APK
+        run: |
+          ./gradlew :apps:wallet:instance:main:assembleDefaultDebug \
+            --no-daemon \
+            --no-build-cache \
+            --no-configuration-cache \
+            -Pandroid.injected.signing.debug.file=${{ github.workspace }}/internal.keystore \
+            -Pandroid.injected.signing.debug.password=${{ secrets.TONKEEPER_DEBUG_STORE_PASSWORD }} \
+            -Pandroid.injected.signing.debug.key.alias=${{ secrets.TONKEEPER_DEBUG_KEY_ALIAS }} \
+            -Pandroid.injected.signing.debug.key.password=${{ secrets.TONKEEPER_DEBUG_KEY_PASSWORD }}
+
+      - name: Upload Debug APK to artifacts
+        uses: actions/upload-artifact@v6
+        with:
+          name: tonkeeper-debug-${{ env.VERSION_CODE }}
+          path: apps/wallet/instance/main/build/outputs/apk/default/debug/*.apk