feat(telemetry): ship Firebase Analytics and Crashlytics in the Play build only

Adds a `distribution` flavor dimension to :app. `opensource` — the default, and
what the GitHub release APK is built from — carries no Google Play Services
libraries at all; `play` adds Analytics and Crashlytics for the Play Store AAB.
Everything else about the two is identical.

The `play` variants only exist when app/src/play/google-services.json is there.
Without it the Firebase plugins are never applied and the task list is exactly
what it was before this dimension existed, so a fresh clone builds unchanged and
a Play task fails with "task not found" rather than quietly producing a Play
build with Firebase missing. The file is gitignored — including at the module
root, where the plugin would apply it to *every* flavor and leak the config into
the open-source APK.

Code under src/main only ever calls `Telemetry`; each flavor binds it to
Firebase or to nothing. Events hang off BaseInstallController, where all five
install backends converge: install_started and install_result, with a failure
kind spelled out per case so R8 renaming can't change what a metric means.
Timber warnings become Crashlytics breadcrumbs and Timber.e(throwable) a
non-fatal. Nothing reports what the user installed — no package names, app
names, file names or URIs.

Verified by build: the opensource APK contains zero Crashlytics and measurement
classes and none of the Firebase config strings, the play APK contains both, and
the mapping-file upload task is wired into playRelease only.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: nqmgaming

.github/workflows/build-debug.yml

@@ -29,13 +29,13 @@ jobs:
         run: chmod +x gradlew
 
       - name: Run Gradle Build
-        run: ./gradlew assembleDebug
+        run: ./gradlew :app:assembleOpensourceDebug :tv:assembleDebug
 
       - name: Upload debug APKs
         uses: actions/upload-artifact@v4
         with:
           name: debug-apks
           path: |
-            app/build/outputs/apk/debug/*.apk
+            app/build/outputs/apk/opensource/debug/*.apk
             tv/build/outputs/apk/debug/*.apk
           retention-days: 14

.github/workflows/publish-release.yml

@@ -62,6 +62,13 @@ jobs:
       - name: Decode Play Store key
         run: echo "${{ secrets.PLAY_STORE_CONFIG_JSON }}" | base64 --decode > fastlane/play-store-key.json
 
+      # Enables the `play` flavor. Without this file :app has no play variants at all and every
+      # bundlePlayRelease below fails with "task not found" — see docs/FIREBASE.md.
+      - name: Decode Firebase config
+        run: |
+          mkdir -p app/src/play
+          echo "${{ secrets.GOOGLE_SERVICES_JSON }}" | base64 --decode > app/src/play/google-services.json
+
       # Build & Deploy
       - name: Grant execute permission
         run: chmod +x gradlew
@@ -86,19 +93,20 @@ jobs:
         continue-on-error: true
         run: bundle exec fastlane beta --fastlane_dir=fastlane_tv
 
-      # Both Play and GitHub now get the same artifact — Play gets the AAB built above
-      # via fastlane, GitHub gets a side-loadable APK from the same single build.
+      # Play got its AAB from the fastlane lanes above, built from the `play` flavor. GitHub
+      # gets the `opensource` flavor instead: same app, minus Firebase Analytics and
+      # Crashlytics, which is the build we distribute as open source.
       - name: Build release APK & AAB
-        run: ./gradlew assembleRelease bundleRelease
+        run: ./gradlew :app:assembleOpensourceRelease :app:bundleOpensourceRelease :tv:assembleRelease :tv:bundleRelease
 
       # Artifacts
       - name: Upload release AAB & APK
         uses: actions/upload-artifact@v4
         with:
           name: release-build
           path: |
-            app/build/outputs/bundle/release/app-release.aab
-            app/build/outputs/apk/release/app-release.apk
+            app/build/outputs/bundle/opensourceRelease/app-opensource-release.aab
+            app/build/outputs/apk/opensource/release/app-opensource-release.apk
             tv/build/outputs/bundle/release/tv-release.aab
             tv/build/outputs/apk/release/tv-release.apk
           retention-days: 30
@@ -111,8 +119,8 @@ jobs:
           draft: false
           prerelease: false
           files: |
-            app/build/outputs/apk/release/app-release.apk
-            app/build/outputs/bundle/release/app-release.aab
+            app/build/outputs/apk/opensource/release/app-opensource-release.apk
+            app/build/outputs/bundle/opensourceRelease/app-opensource-release.aab
             tv/build/outputs/apk/release/tv-release.apk
             tv/build/outputs/bundle/release/tv-release.aab
           token: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -31,3 +31,12 @@ vendor/downloads/
 InstallerX-Revived-main
 # android-re: decompiled APKs and analysis output (large, regenerable)
 android-re-workspace/
+
+# Firebase config for the `play` flavor — carries our project's API key and app id, and its
+# presence is what enables the play variants at all. Kept out of the public repo; CI writes it
+# from the GOOGLE_SERVICES_JSON secret. See docs/FIREBASE.md.
+app/src/play/google-services.json
+# The module root is also on the plugin's search path, and a file there applies to *every*
+# flavor — which would put the config into the open-source build too. Ignored so it can't be
+# committed by accident; the only supported location is app/src/play/ above.
+app/google-services.json

README.md

@@ -153,8 +153,19 @@ The project is a multi-module Gradle build:
 | `:tv`     | application | The Android TV (10-foot, D-pad) app                                   |
 | `:core`   | library     | Shared, UI-agnostic install/manage engine consumed by `:app`/`:tv` |
 
-> A single distribution ships Shizuku, Root (libsu), and the default system
-> installer together — the old `store` / `full` product flavors were removed.
+> Shizuku, Root (libsu), and the default system installer ship together in every
+> build — the old `store` / `full` product flavors were removed.
+
+`:app` has two flavors on a `distribution` dimension, differing only in telemetry:
+
+| Flavor       | Firebase Analytics + Crashlytics | Ships as                             |
+|--------------|----------------------------------|--------------------------------------|
+| `opensource` | no                               | GitHub release APK — and the default |
+| `play`       | yes                              | Play Store AAB                       |
+
+The `play` flavor needs `app/src/play/google-services.json`, which is not in the
+repository. Without it those variants don't exist and everything below builds the
+`opensource` flavor. See [docs/FIREBASE.md](docs/FIREBASE.md).
 
 ### Steps
 
@@ -170,17 +181,17 @@ The project is a multi-module Gradle build:
 ### Gradle
 
 ```bash
-# Phone app
-./gradlew :app:assembleDebug
-./gradlew :app:assembleRelease
+# Phone app (open-source flavor)
+./gradlew :app:assembleOpensourceDebug
+./gradlew :app:assembleOpensourceRelease
+
+# Phone app (Play flavor — needs app/src/play/google-services.json)
+./gradlew :app:bundlePlayRelease
 
 # Android TV app
 ./gradlew :tv:assembleDebug
 ./gradlew :tv:assembleRelease
 
-# Release App Bundle (phone + TV)
-./gradlew assembleBundleRelease
-
 # Everything at once
 ./gradlew assembleDebug
 ```
@@ -197,7 +208,7 @@ bundle exec fastlane build_debug
 # Build release APK
 bundle exec fastlane build_release
 
-# Deploy beta to Firebase App Distribution
+# Deploy to Play Store closed testing track
 bundle exec fastlane beta
 
 # Deploy to Play Store internal track

app/build.gradle.kts

@@ -1,3 +1,7 @@
+import com.google.firebase.crashlytics.buildtools.gradle.CrashlyticsExtension
+import com.google.gms.googleservices.GoogleServicesPlugin.GoogleServicesPluginConfig
+import com.google.gms.googleservices.GoogleServicesPlugin.MissingGoogleServicesStrategy
+import org.gradle.api.plugins.ExtensionAware
 import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 import java.util.Properties
 
@@ -10,6 +14,25 @@ plugins {
     id("kotlin-parcelize")
 }
 
+// Firebase (Analytics + Crashlytics) ships in the `play` flavor only. Its config file carries
+// our Firebase project's keys, so it is deliberately untracked — see docs/FIREBASE.md. Without
+// it the `play` variants are switched off entirely and the Firebase plugins are never applied,
+// which is what keeps a fresh open-source checkout building exactly as it did before.
+val firebaseConfig = file("src/play/google-services.json")
+val hasFirebaseConfig = firebaseConfig.exists()
+
+if (hasFirebaseConfig) {
+    apply(plugin = "com.google.gms.google-services")
+    apply(plugin = "com.google.firebase.crashlytics")
+
+    configure<GoogleServicesPluginConfig> {
+        // `opensource` variants have no google-services.json by design. The plugin's default is
+        // to fail the build when it can't find one for a variant, which would take the whole
+        // open-source build down with it.
+        missingGoogleServicesStrategy = MissingGoogleServicesStrategy.IGNORE
+    }
+}
+
 android {
     namespace = "app.pwhs.universalinstaller"
     compileSdk = 36
@@ -56,10 +79,32 @@ android {
         }
     }
 
-    // Single distribution: ships libsu for real Root install support alongside Shizuku
-    // and the default system installer. The previous store/full split was removed —
-    // apps in this category on Play routinely ship Root/Shizuku/Default together, so
-    // the static-analysis concern that drove the split didn't pan out.
+    // Both flavors ship the same installer backends — libsu for Root alongside Shizuku and the
+    // default system installer. The dimension exists purely to keep Google's proprietary
+    // Analytics/Crashlytics libraries out of the build we publish as open source. (An earlier
+    // store/full split over libsu was removed for unrelated reasons; this is not that split.)
+    flavorDimensions += "distribution"
+    productFlavors {
+        // What `assembleDebug` / `assembleRelease` and the IDE pick by default, and the build
+        // the GitHub release APK comes from. No Firebase, no Google Play Services.
+        create("opensource") {
+            dimension = "distribution"
+            isDefault = true
+            if (hasFirebaseConfig) {
+                // This flavor has no Firebase app id to upload a mapping file against, so the
+                // upload task would fail at the end of every `assembleOpensourceRelease`.
+                (this as ExtensionAware).extensions
+                    .configure<CrashlyticsExtension>("firebaseCrashlytics") {
+                        mappingFileUploadEnabled = false
+                    }
+            }
+        }
+        // The Play Store build: same app plus Firebase Analytics and Crashlytics.
+        create("play") {
+            dimension = "distribution"
+        }
+    }
+
     compileOptions {
         sourceCompatibility = JavaVersion.VERSION_11
         targetCompatibility = JavaVersion.VERSION_11
@@ -83,6 +128,16 @@ android {
     }
 }
 
+androidComponents {
+    // Drop the `play` variants when there is no google-services.json to build them against.
+    // A contributor cloning the repo then sees exactly the task list they saw before this
+    // dimension existed, and `assemblePlayRelease` fails with "task not found" rather than
+    // producing a Play build with Firebase silently missing.
+    beforeVariants(selector().withFlavor("distribution" to "play")) { variant ->
+        variant.enable = hasFirebaseConfig
+    }
+}
+
 dependencies {
     implementation(project(":core"))
     implementation(libs.androidx.core.ktx)
@@ -141,6 +196,12 @@ dependencies {
     implementation(libs.libsu.core)
     implementation(libs.libsu.service)
 
+    // Firebase, `play` flavor only. Quoted configuration names because type-safe accessors for
+    // flavor configurations aren't generated for the script that declares the flavor.
+    "playImplementation"(platform(libs.firebase.bom))
+    "playImplementation"(libs.firebase.analytics)
+    "playImplementation"(libs.firebase.crashlytics)
+
     implementation(libs.nanohttpd)
     implementation(libs.zxing.core)
     // Open-source QR scanner (Apache-2.0) for "Send to TV" — avoids proprietary ML Kit.

app/proguard-rules.pro

@@ -12,13 +12,11 @@
 #   public *;
 #}
 
-# Uncomment this to preserve the line number information for
-# debugging stack traces.
-#-keepattributes SourceFile,LineNumberTable
-
-# If you keep the line number information, uncomment this to
-# hide the original source file name.
-#-renamesourcefileattribute SourceFile
+# Line numbers survive R8 so Crashlytics can point at a line rather than a method. The mapping
+# file uploaded alongside the `play` build is what turns the renamed classes back into ours; the
+# renamed source file name is of no use to anyone, so it goes.
+-keepattributes SourceFile,LineNumberTable
+-renamesourcefileattribute SourceFile
 
 # libsu (com.topjohnwu.superuser) — full flavor only. Harmless on store (no-op when
 # the class is absent). Kept defensively because JitPack-built artifacts occasionally

app/src/main/java/app/pwhs/universalinstaller/Application.kt

@@ -7,6 +7,8 @@ import app.pwhs.universalinstaller.di.appModule
 import app.pwhs.universalinstaller.di.flavorModule
 import app.pwhs.universalinstaller.presentation.install.controller.BackendSelfHeal
 import app.pwhs.universalinstaller.presentation.install.controller.InstallerBackendFactory
+import app.pwhs.universalinstaller.telemetry.Telemetry
+import app.pwhs.universalinstaller.telemetry.createTelemetrySink
 import app.pwhs.universalinstaller.util.ApkFileIconFetcher
 import app.pwhs.universalinstaller.util.AppIconFetcher
 import app.pwhs.universalinstaller.util.CrashHandler
@@ -40,6 +42,25 @@ private class ReleaseTree : Timber.Tree() {
     }
 }
 
+/**
+ * Feeds the same warnings and errors [ReleaseTree] writes to logcat into the crash reporter,
+ * so a report arrives with the run-up to the failure attached rather than a bare stack trace.
+ *
+ * A no-op on `opensource`, where [Telemetry] has no sink. The WARN floor is the same one
+ * [ReleaseTree] uses and for the same reason: debug-level lines carry URIs and file names.
+ */
+private class TelemetryTree : Timber.Tree() {
+    override fun isLoggable(tag: String?, priority: Int): Boolean = priority >= Log.WARN
+
+    override fun log(priority: Int, tag: String?, message: String, t: Throwable?) {
+        Telemetry.breadcrumb("${tag ?: "UniversalInstaller"}: $message")
+        // Timber.e(throwable) is how this codebase reports a failure it recovered from. Those
+        // are exactly the non-fatals worth seeing; warnings stay breadcrumbs so a device that
+        // warns in a loop can't drown out the crash reports.
+        if (priority >= Log.ERROR && t != null) Telemetry.recordException(t)
+    }
+}
+
 class App : Application(), SingletonImageLoader.Factory {
 
     init {
@@ -61,12 +82,17 @@ class App : Application(), SingletonImageLoader.Factory {
 
     override fun onCreate() {
         super.onCreate()
+        // Before CrashHandler.install: that one chains to whatever handler is already default,
+        // which on `play` is Crashlytics'. Binding the sink first also means a crash during the
+        // rest of onCreate is still reported.
+        Telemetry.install(createTelemetrySink(this))
         CrashHandler.install(this)
         // Release builds used to plant nothing, so Settings -> Diagnostics collected a logcat
         // dump containing not one line from this app. Issues #92 and #100 both arrived with a
         // full report attached and no clue in it. Release now keeps warnings and errors — the
         // lines that explain a failure — while debug keeps everything.
         Timber.plant(if (BuildConfig.DEBUG) Timber.DebugTree() else ReleaseTree())
+        if (Telemetry.isCollecting) Timber.plant(TelemetryTree())
         startKoin{
             androidLogger()
             androidContext(this@App)

app/src/main/java/app/pwhs/universalinstaller/presentation/install/InstallErrorHelper.kt

@@ -119,4 +119,24 @@ object InstallErrorHelper {
         val info = getErrorInfo(context, failure)
         return "${info.title}: ${info.guidance}"
     }
+
+    /**
+     * A stable, non-localised name for a failure kind, for telemetry.
+     *
+     * Deliberately not `failure::class.simpleName`: R8 renames ackpine's classes, so release
+     * builds would report a different — and meaningless — name than debug ones. Never include
+     * `failure.message`; it carries package and file names.
+     */
+    fun failureKey(failure: InstallFailure): String = when (failure) {
+        is InstallFailure.Aborted -> "aborted"
+        is InstallFailure.Blocked -> "blocked"
+        is InstallFailure.Conflict -> "conflict"
+        is InstallFailure.Incompatible -> "incompatible"
+        is InstallFailure.Invalid -> "invalid"
+        is InstallFailure.Storage -> "storage"
+        is InstallFailure.Timeout -> "timeout"
+        is InstallFailure.Exceptional -> "exceptional"
+        is InstallFailure.Generic -> "generic"
+        else -> "unknown"
+    }
 }