fix(playscan): close Android scanning gaps from review, and tag Revyl links for attribution - #21
Merged
Merged
Conversation
Follow-up to #20, which merged before these landed. Every Revyl link in the README was bare, so traffic off the repo arrived unattributed. Now tagged with utm_medium=readme and a campaign per placement (badge, intro, verify, static-ceiling, footer, easter-egg), matching the pattern #13 set for the CLI signup link. - Reframe the runtime tier. The intro led with "it needs an account and it is opt-in", which sells against it. It now leads with what verify catches and discloses the requirement after. - Add "Where a static scan stops": the honest ceiling of text matching, with three flows that ship GREENLIT and get rejected anyway. Lands on verify --dry-run, which needs no account and works with the revyl CLI absent (tested with it off PATH). - Two-minute setup block in the verify section, and a --verify CI example. - Badge row and a footer with a real next action. - One month of Revyl (ng32jDS9) as an easter egg on the last line.
ethanzhoucool
changed the title
ethanzhoucool
added a commit
that referenced
this pull request
Jul 28, 2026
Adds --apk/--aab to preflight, scans AAB feature-module native code, adds the 64-bit ABI parity rule, reports the Gradle-only coverage gap on artifact scans, respects Play's per-form-factor target API schedules (honouring android:required), and makes preflight --verify follow the project platform instead of hardcoding iOS. Also decodes uses-feature and android:required on the compiled-manifest paths, where they were silently dropped, and stops a failed archive scan from discarding source findings. The code intended for #21, which merged with only its README commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two things landed together here: the README attribution work stranded by #20's squash-merge, and fixes for a review of the Android support.
Android / playscan fixes
Five findings from a review of the Play support, all reproduced before fixing.
--ipaexisted,--apk/--aabdid not. Both added, and preflight now runs the source and archive scans together since they see different things.ScanArchivepasses an emptyGradleInfo, so Play Billing version, ads-SDK detection, and auth-SDK detection could not fire. Their absence read as a pass. The scan now reports the gap and names the three checks it skipped.base/lib/, so a misaligned library in a feature module passed the 16 KB check. Every module is scanned now. Added the missing 64-bit parity rule: a 32-bit ABI without its 64-bit counterpart is CRITICAL, skipped on config splits (which legitimately carry one ABI).android:required="false"is honoured, so a phone app that also ships to TV keeps its CRITICAL.preflight --verifyhardcoded iOS. An Android-only project ran its flows against the wrong store and had its.apkrejected. Platform now follows the artifact extension, then the project layout.Two bugs found in review of the first pass, plus one I found chasing my own doubt:
applyElementhad nouses-featurecase, so compiled manifests never populated it.frameworkAttrIDshad no entry forandroid:required, and aapt2 emits empty string-pool names for framework attrs, so the attribute was dropped on both compiled paths.0x0101028ewas read back fromaapt2 dump xmltreeon android-34, -35 and -36 rather than recalled, per the rule that table.Verified end to end against real aapt2-linked APKs: a watch app at targetSdk 33 reports WARN naming Wear OS; a phone app declaring
leanback required="false"still reports CRITICAL.Every fix has a regression test, and each test was confirmed to fail with its fix reverted. Full suite,
-race,vet, andgofmtall pass.Known follow-ups, deliberately not in this PR:
BundleConfig.pbPAGE_ALIGNMENT_16K, per-library (rather than per-ABI) 64-bit parity, and cutting a release soplayscanactually ships — v0.1.0 predates it, so Homebrew andgo installusers still get an Apple-only binary.README attribution
Every Revyl link was bare, so traffic off the repo arrived unattributed. All links now carry
utm_medium=readmewith a per-placement campaign, following the pattern #13 set for the CLI. Also reframes the runtime tier to lead with what it catches, adds a "Where a static scan stops" section, a badge row, and a one-month code on the last line. The "every check runs against the artifact" claim was wrong and is corrected to match the coverage-gap behaviour above.