Android Release Pipeline: CLI build, sign, verify, ship APK

Summary

Three separate faults, none of them in the Kotlin source. The build succeeds because Gradle never validates the AGP / compileSdk / targetSdk triangle — it just compiles against a platform it was not told to support.

Real run of doctor.py -p ~/apps/shop-companion --require apk (paths shortened to ~ / $ANDROID_HOME; every [ OK ] / [WARN] / [FAIL] line is verbatim):

[ OK ] JDK                   21.0.2 ($JAVA_HOME, from scan of common directories)
[ OK ] Android SDK           $ANDROID_HOME (from scan of common directories)
[INFO] Platforms installed   35
[INFO] build-tools           34.0.0, 35.0.0
[ OK ] cmdline-tools         in place (sdkmanager / apkanalyzer available)
[ OK ] Gradle Wrapper        wrapper points at 8.2
[INFO] Mirror hint           The official source services.gradle.org easily times out or drops in China (a failed download leaves a *.part behind). You can switch to mirrors.cloud.tencent.com/gradle/.
[INFO] Main module           app
[ OK ] AGP                   8.1.0
[ OK ] Kotlin                1.9.0
[ OK ] AGP <-> Gradle        AGP 8.1.0 + Gradle 8.2 match
[WARN] compileSdk            compileSdk 35 is past the officially supported range of AGP 8.1.0 (<=34)
[ OK ] AGP <-> JDK           JDK 21 meets the floor of AGP 8.1.0 (>= 17)
[FAIL] targetSdk             targetSdk 35 is below the current Play floor 36 -> the submission or update is rejected outright by Play Console (the build stage gives no hint of it)
[ OK ] compileSdk platform   android-35 is installed
[FAIL] Signing               There is a signingConfigs block, but it does not read key.properties and no key file was found.
[FAIL] Target artifact       You asked for apk, but there is no key.properties -> generate a key with keytool first

Verdict: **cannot build** - 3 ERROR(s), 1 WARN(s). Fix the ERRORs first.
Project summary: com.example.shop  versionName=? versionCode=42  compileSdk=35 minSdk=24 targetSdk=35

Fix order (do not reorder these)

1. compileSdk 35 -> 34,

or bump AGP to a version that officially supports 35. Do not do both at once — you will not know which one fixed it.
2. Add key.properties with storeFile / storePassword / keyAlias / keyPassword, and read it from signingConfigs.release.
3. targetSdk 35 -> 36 (Play Console rejects below 36 outright; the build stage gives no hint).
4. Re-run doctor.py --require apk, then build, then verify_release.py to compare APK bytes vs release.json vs the SHA-256 you publish.

Next step

python scripts/doctor.py -p ~/apps/shop-companion --require apk   # must print Verdict: can build
./scripts/build_android.sh release
python scripts/verify_release.py --apk app/build/outputs/apk/release/app-release.apk --manifest release.json

verify_release.py is the one that answers your second question: it refuses to pass when the three-way consistency check (APK bytes vs release manifest vs published hash) disagrees, so the file on the CDN is the file you tested.