From 6c343109c0888cfb65781b96062da21df0e43ff8 Mon Sep 17 00:00:00 2001
From: Kyle Tse <hi@kylet.se>
Date: Fri, 30 Oct 2026 06:56:00 +0000
Subject: [PATCH] Use run-store for Firebase distribution input

---
 .../workflows/firebase-app-distribution.yml   | 37 ++++++++++++++++---
 README.md                                     |  7 +++-
 2 files changed, 37 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/firebase-app-distribution.yml b/.github/workflows/firebase-app-distribution.yml
index c1c38a3..159e0b3 100644
--- a/.github/workflows/firebase-app-distribution.yml
+++ b/.github/workflows/firebase-app-distribution.yml
@@ -1,16 +1,36 @@
 # Reusable Firebase App Distribution Workflow
 #
-# Uploads an Android APK/AAB to Firebase App Distribution for tester access.
+# Uploads an Android APK to Firebase App Distribution for tester access.
 # Requires FIREBASE_CREDENTIALS (service account JSON) and FIREBASE_APP_ID secrets.
 #
-# Usage in your repo's workflow:
+# Same-run caller: build the APK into build-output/ before these producer steps.
+# The job output retains the producing attempt when only distribution is rerun.
+#   permissions:
+#     contents: read
+#     id-token: write
 #   jobs:
+#     build:
+#       runs-on: sylphx-linux-standard
+#       outputs:
+#         distribution-entry: ${{ steps.distribution-entry.outputs.name }}
+#       steps:
+#         # Checkout and build the APK here.
+#         - name: Name this build's handoff
+#           id: distribution-entry
+#           run: echo "name=android-build-attempt-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT"
+#         - name: Store the APK directory
+#           uses: SylphxAI/.github/.github/actions/run-store@4dcc910606d7624150d2004f2dd970eb570de30e
+#           with:
+#             mode: put
+#             name: ${{ steps.distribution-entry.outputs.name }}
+#             path: ./build-output
+#             required: "true"
 #     distribute:
 #       needs: build
 #       uses: Cubeage/.github/.github/workflows/firebase-app-distribution.yml@main
 #       with:
-#         app-id: ${{ secrets.FIREBASE_APP_ID }}
-#         artifact-name: android-build
+#         app-id: ${{ vars.FIREBASE_APP_ID }}
+#         artifact-name: ${{ needs.build.outputs.distribution-entry }}
 #         release-notes: "SDK v3.1.68 update"
 #         groups: "qa-testers"
 #       secrets:
@@ -26,7 +46,7 @@ on:
         required: true
         type: string
       artifact-name:
-        description: "Name of the GitHub Actions artifact containing the APK"
+        description: "Same-run run-store entry containing the APK (seven-day availability)"
         required: true
         type: string
       release-notes:
@@ -45,13 +65,18 @@ on:
 
 jobs:
   distribute:
+    permissions:
+      contents: read
+      id-token: write
     runs-on: ${{ github.event.repository.private && 'sylphx-linux-standard' || 'ubuntu-latest' }}
     steps:
       - name: Download build artifact
-        uses: actions/download-artifact@v4
+        uses: SylphxAI/.github/.github/actions/run-store@4dcc910606d7624150d2004f2dd970eb570de30e # main
         with:
+          mode: get
           name: ${{ inputs.artifact-name }}
           path: ./build-output
+          required: "true"
 
       - name: Find APK
         id: find-apk
diff --git a/README.md b/README.md
index 74db99d..ca858ce 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,12 @@ Sylphx Runners.
 ## Other shared files
 
 - `.github/workflows/firebase-app-distribution.yml`: reusable workflow that
-  uploads an Android APK/AAB to Firebase App Distribution.
+  uploads an Android APK to Firebase App Distribution. The caller stores its
+  APK directory with the pinned run-store action in the same workflow run,
+  grants `id-token: write`, and passes that entry as `artifact-name`. The
+  workflow header includes a paired producer/caller example. Entries last seven
+  days; a missing or unreadable entry fails before Firebase authentication.
+  This is a transient handoff, with no historical-build durability promise.
 - `workflow-templates/ci-fast-path.yml`: the starter for a repository's CI -
   docs-only pull requests skip heavy jobs, superseded runs cancel, heavy jobs
   wait for the cheap gate, `ci-ok` is the required check. It calls the