Auto-commit after successful build: improve build setup, update docs/config

Changed files:\n.gitignore
SetupBuildEnvironment.sh
app/build.gradle.kts
keystore.properties.example

SetupBuildEnvironment.sh

@@ -74,6 +74,13 @@ auto_commit_if_needed() {
 
   git -C "$PROJECT_DIR" add -A
 
+  # Defense in depth: never allow signing material or local signing config to be
+  # included in the automatic commit, even if a file was force-added manually.
+  git -C "$PROJECT_DIR" reset -q HEAD -- \
+    keystore.properties \
+    '*.keystore' \
+    '*.jks' 2>/dev/null || true
+
   if git -C "$PROJECT_DIR" diff --cached --quiet; then
     log "No source changes to commit after successful build"
     return
@@ -296,6 +303,12 @@ maybe_build() {
       artifact_source="$PROJECT_DIR/app/build/outputs/bundle/debug/app-debug.aab"
       artifact_target="$PROJECT_DIR/app/build/outputs/bundle/debug/githug-android-debug.aab"
       ;;
+    --build-release-aab)
+      gradle_task="bundleRelease"
+      artifact_label="release AAB"
+      artifact_source="$PROJECT_DIR/app/build/outputs/bundle/release/app-release.aab"
+      artifact_target="$PROJECT_DIR/app/build/outputs/bundle/release/githug-android-release.aab"
+      ;;
     *)
       return
       ;;
@@ -324,12 +337,13 @@ Usage: bash ./SetupBuildEnvironment.sh [--build | --build-aab]
 
   --build      Setup the environment and build the debug APK
   --build-aab  Setup the environment and build the debug Android App Bundle (AAB)
+  --build-release-aab  Setup the environment and build a release Android App Bundle (AAB)
 EOF_USAGE
 }
 
 validate_args() {
   case "${1:-}" in
-    ""|--build|--build-aab)
+    ""|--build|--build-aab|--build-release-aab)
       ;;
     *)
       echo "Unknown argument: $1" >&2
@@ -372,6 +386,7 @@ main() {
   log "To build without a background Gradle daemon: ./gradlew --no-daemon assembleDebug"
   log "To setup and build in one step: bash ./SetupBuildEnvironment.sh --build"
   log "To setup and build a debug AAB in one step: bash ./SetupBuildEnvironment.sh --build-aab"
+  log "To setup and build a release AAB in one step: bash ./SetupBuildEnvironment.sh --build-release-aab"
 }
 
 main "$@"