fix: Pin release candidate to Source Fastlane track to prevent stale promotions

[AmyLGalles]

🎟️ Tracking

No Jira ticket — this comes from investigating recurring "Cannot find release with version code" failures observed in bitwarden/deploy's Android production-promotion workflow runs on 2026-09-03 (Authenticator) and 2026-08-20 (Password Manager).

📔 Objective

Promoting a build from Play Store internal → production intermittently fails because Google's Play API only returns the latest release per track, and continuous main-branch builds supersede the release candidate before someone runs the promotion workflow. There's an existing manual workaround (a second track named Source Fastlane) but nothing keeps it fresh, so it goes stale too.

This adds a new CI step — gated to release/* branch builds only, not every main push — that pins the just-uploaded internal release onto Source Fastlane immediately after upload, before any later build can supersede it. Reuses the existing promoteToProduction fastlane lane.

Also fixes a credentials-resolution gap: promoteToProduction's new serviceCredentialsFile override now falls back to the correct Authenticator credentials file by package name (matching the pattern already used by getLivePlayStoreVersion), so the real bitwarden/deploy caller — which never passes this override — authenticates correctly for com.bitwarden.authenticator instead of silently using the Password Manager's credentials.

Reviewed locally via /bitwarden-code-review:code-review-local. Addressed the important finding (pin was originally unscoped to release branches, which would have made it just as volatile as internal) and the suggested finding (credentials fallback) before opening this PR.

📸 Screenshots

N/A — CI workflow / Fastfile change only.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed a CI/release-tooling change that adds a "Pin release to Source Fastlane track" step to both build.yml and build-authenticator.yml, plus a json_key resolution fallback in the promoteToProduction Fastlane lane. Verified the step gating (matrix combination and env.PUBLISH_TO_PLAY_STORE) matches the adjacent publish steps, that needs.version.outputs.version_number/version_name are available in both publish_playstore jobs and use the same expression as the existing Increment version steps, and that the credentials files referenced by each step are downloaded earlier in the same job. Traced promoteToProduction through fastlane/patches/supply_custom_promote.rb: with rolloutPercentage:"1" the promotion resolves to a completed release matched by version code, the patch only calls update_track on the destination so the source internal track is left intact, and the new packageName-based fallback preserves existing behavior for com.x8bit.bitwarden/com.x8bit.bitwarden.beta via the Appfile default while fixing com.bitwarden.authenticator. The release/* gate lines up with release-branch.yml, which cuts release/<version>-rcN branches and dispatches both build workflows with --ref, so github.ref satisfies startsWith(github.ref, 'refs/heads/release/').

No findings at or above the reporting threshold.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.20%. Comparing base (dd99abf) to head (0dc2e2a).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7352   +/-   ##
=======================================
  Coverage   86.20%   86.20%           
=======================================
  Files         901      901           
  Lines       66257    66257           
  Branches    10170    10170           
=======================================
  Hits        57118    57118           
  Misses       5561     5561           
  Partials     3578     3578           

Flag	Coverage Δ
app-data	18.38% <ø> (ø)
app-ui-auth-tools	18.74% <ø> (ø)
app-ui-platform	16.30% <ø> (ø)
app-ui-vault	27.07% <ø> (ø)
authenticator	6.00% <ø> (ø)
lib-core-network-bridge	4.05% <ø> (ø)
lib-data-ui	1.19% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.