[manigandanparthasarathi-okta]

Android side of the pipeline fixes in auth0/Guardian.swift#189, from the first live releases. Pipeline and build tooling only: no SDK sources, Gradle build or published artifact change, so nothing changes for consumers. One commit per ticket. Guardian.swift#189 was approved and merged with no review changes, so the shared steps here are as reviewed there.

Changes

• NAPP-177 (Detect release): reads the release PR number from the squash title first, then falls back to the commit-to-PR lookup with 6 attempts 5 seconds apart, so a run that starts right after the merge no longer skips the release (seen on Guardian.swift 1.10.0). The step is identical to the iOS one.
• NAPP-186 (approval request): the publish job is now "Publish Guardian.Android X.Y.Z to Maven Central staging", shown in the review email and approval dialog. Validate version writes a job summary with the SDK, version, commit, release PR, how tests were covered, a reminder that approval only uploads to staging, and the full CHANGELOG entry. The supersede check matches the job by prefix.
• NAPP-183 (staging_dropped wording): the checkbox reads "Replace an unpublished upload: tick only after you clicked Drop on this version's earlier upload in the Maven Central Portal", the preflight error says exactly what to do, and a comment lists when to tick it and when not to. The input name and behaviour are unchanged.
• NAPP-182 (duplicate tests): Release skips its Test job when the merge commit's tree is identical to the release PR head and the PR's Test check passed there. Otherwise it runs as before. 0.11.3 would have qualified. The check step is identical to the iOS one.
• NAPP-185 (Validate release): new reusable workflow with two stages. Stage staged runs at the end of Release and checks the GitHub Release, its notes, drafts, Latest, the tag, master's versions and the Release run. Stage published is run by hand after clicking Publish in the Portal and also checks that Maven Central serves the POM, AAR and signatures and that the version resolves. The Portal staging deployment is not checked because that needs the release credentials.
• NAPP-179 (tooling, in step with Guardian.swift): Ruby 3.2 to 3.3, and fastlane 2.237.0 to 2.241.1 (the version Guardian.swift uses), which allows rubyzip 3 and clears the one open Dependabot alert (rubyzip, high).

Testing

• actionlint and shellcheck pass on all changed workflows and scripts.
• The Detect release and tree check steps are byte for byte the iOS ones, which were checked against real merges in Guardian.swift#189. For 0.11.3 the merge commit and PR head trees are identical and the PR's Test check passed.
• Validate release run locally: for 0.11.3, which was only a pipeline test run, it reports no Release, no tag and nothing on Maven Central; for the published 0.11.2 the Maven Central and POM rows pass.
• fastlane 2.241.1 loads and lists all five lanes with the new lock. This PR's checks are the first run on Ruby 3.3.
• Release and Validate release (published) get their first full run at the next Android release.

🤖 Generated with Claude Code