fix: address runtime crash risks found during review

Agent-Logs-Url: https://github.com/winnerspiros/osu/sessions/df8487e1-1028-44d9-adc9-42e5e885e5a3

Co-authored-by: winnerspiros <1675249+winnerspiros@users.noreply.github.com>

Author: Copilot

.github/workflows/generate-keystore.yml

@@ -22,7 +22,12 @@ jobs:
   generate:
     name: Generate Keystore
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
+      # Mask the password so it is never printed in logs.
+      - name: Mask password
+        run: echo "::add-mask::${{ inputs.key_password }}"
+
       - name: Validate inputs
         run: |
           if [ ${#KEY_PASSWORD} -lt 6 ]; then
@@ -54,7 +59,6 @@ jobs:
         id: encode
         run: |
           B64=$(base64 -w 0 osu-release.keystore)
-          # Write to a file for the summary (avoid exposing in logs)
           echo "$B64" > keystore-base64.txt
           echo "encoded=true" >> "$GITHUB_OUTPUT"
 
@@ -96,9 +100,12 @@ jobs:
           echo "  4. ANDROID_SIGNING_STORE_PASSWORD"
           echo "     → Value: the password you entered when triggering this workflow"
           echo ""
-          echo "  IMPORTANT: Keep a backup of the keystore file! If you lose it,"
-          echo "  you will never be able to update your installed APK — you would"
-          echo "  have to uninstall and reinstall (losing all local data)."
+          echo "  IMPORTANT:"
+          echo "  • Keep a backup of the keystore file! If you lose it, you will"
+          echo "    never be able to update your installed APK — you would have to"
+          echo "    uninstall and reinstall (losing all local data)."
+          echo "  • After saving the secrets, DELETE this workflow run to remove"
+          echo "    the keystore artifact (Settings → Actions → this run → Delete)."
           echo ""
           echo "  After saving the secrets, run the 'Build Android APK' workflow."
           echo "==================================================================="

.github/workflows/release.yml

@@ -146,13 +146,9 @@ jobs:
           if [ -z "$APK" ]; then
             APK=$(find "osu.Android/bin/Release" -name "*-Signed.apk" | head -1)
           fi
-          if [ -z "$APK" ]; then
-            # Fall back to any APK if -Signed variant isn't produced
-            APK=$(find "osu.Android/bin/Release/net10.0-android/publish" -maxdepth 1 -name "*.apk" 2>/dev/null | head -1)
-          fi
 
           if [ -z "$APK" ]; then
-            echo "::error::Failed to locate APK. Listing bin directory:"
+            echo "::error::Failed to locate signed APK. Listing bin directory:"
             find osu.Android/bin -name "*.apk" -o -name "*.aab" 2>/dev/null || true
             exit 1
           fi