From 12a437a858fe2bfe0bb8345eb19319794686d125 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 16 Mar 2026 19:22:59 +0000
Subject: [PATCH] Add workflow to check for INTERNET permission in offline
 build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Runs on every push/PR to master. Processes the merged manifest for
the offlineDebug variant and fails if android.permission.INTERNET is
present — catching any accidental re-introduction of network access
in the offline flavor.

https://claude.ai/code/session_01CrqXjZyMNnBkPtxjW9tTvR
---
 .../workflows/check-offline-permissions.yml   | 57 +++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 .github/workflows/check-offline-permissions.yml

diff --git a/.github/workflows/check-offline-permissions.yml b/.github/workflows/check-offline-permissions.yml
new file mode 100644
index 00000000..0a5295fb
--- /dev/null
+++ b/.github/workflows/check-offline-permissions.yml
@@ -0,0 +1,57 @@
+name: Check Offline Build Permissions
+
+on:
+  pull_request:
+    branches: [master]
+  push:
+    branches: [master]
+
+jobs:
+  check-offline-permissions:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: 21
+
+      - name: Cache Gradle
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
+
+      - name: Create keystore.properties
+        run: touch keystore.properties
+
+      - name: Generate merged manifest for offline build
+        run: ./gradlew processOfflineDebugManifest --no-daemon
+
+      - name: Check for INTERNET permission in offline merged manifest
+        run: |
+          MANIFEST=$(find app/build/intermediates/merged_manifests -name "AndroidManifest.xml" | grep -i offline | head -1)
+          if [ -z "$MANIFEST" ]; then
+            echo "ERROR: Could not find merged manifest for offline build"
+            exit 1
+          fi
+          echo "Checking: $MANIFEST"
+          if grep -q 'android.permission.INTERNET' "$MANIFEST"; then
+            echo ""
+            echo "ERROR: android.permission.INTERNET found in offline build manifest!"
+            echo "The offline flavor must not include INTERNET permission."
+            echo ""
+            echo "Offending lines:"
+            grep 'android.permission.INTERNET' "$MANIFEST"
+            exit 1
+          else
+            echo "OK: No INTERNET permission in offline build manifest"
+          fi