fix: Pin release candidate to Source Fastlane track to prevent stale promotions

.github/workflows/build-authenticator.yml

@@ -237,3 +237,24 @@ jobs:
         run: |
           bundle exec fastlane publishAuthenticatorReleaseToGooglePlayStore \
           serviceCredentialsFile:"$PLAY_STORE_CREDS_FILE" \
+
+      - name: Pin release to Source Fastlane track
+        # Gated to release/* branches only: main pushes build continuously and would
+        # otherwise overwrite this track just as often as "internal" does, reintroducing
+        # the exact staleness bug this step exists to fix. Release candidates are cut on
+        # dedicated release/<version>-rcN branches, so pinning only there keeps the
+        # candidate stable on Source Fastlane until the next RC is cut.
+        if: ${{ matrix.variant == 'aab' && env.PUBLISH_TO_PLAY_STORE == 'true' && startsWith(github.ref, 'refs/heads/release/') }}
+        env:
+          PLAY_STORE_CREDS_FILE: ${{ github.workspace }}/secrets/authenticator_play_store-creds.json
+          VERSION_CODE: ${{ needs.version.outputs.version_number || github.run_number }}
+          VERSION_NAME: ${{ needs.version.outputs.version_name }}
+        run: |
+          bundle exec fastlane promoteToProduction \
+          packageName:"com.bitwarden.authenticator" \
+          serviceCredentialsFile:"$PLAY_STORE_CREDS_FILE" \
+          track:"internal" \
+          trackPromoteTo:"Source Fastlane" \
+          versionCode:"$VERSION_CODE" \
+          versionName:"$VERSION_NAME" \
+          rolloutPercentage:"1"

.github/workflows/build.yml

@@ -334,6 +334,27 @@ jobs:
           bundle exec fastlane publishProdToPlayStore
           bundle exec fastlane publishBetaToPlayStore
 
+      - name: Pin release to Source Fastlane track
+        # Gated to release/* branches only: main pushes build continuously and would
+        # otherwise overwrite this track just as often as "internal" does, reintroducing
+        # the exact staleness bug this step exists to fix. Release candidates are cut on
+        # dedicated release/<version>-rcN branches, so pinning only there keeps the
+        # candidate stable on Source Fastlane until the next RC is cut.
+        if: ${{ matrix.variant == 'prod' && matrix.artifact == 'aab' && env.PUBLISH_TO_PLAY_STORE == 'true' && startsWith(github.ref, 'refs/heads/release/') }}
+        env:
+          PLAY_STORE_CREDS_FILE: ${{ github.workspace }}/secrets/play_creds.json
+          VERSION_CODE: ${{ needs.version.outputs.version_number || github.run_number }}
+          VERSION_NAME: ${{ needs.version.outputs.version_name }}
+        run: |
+          bundle exec fastlane promoteToProduction \
+          packageName:"com.x8bit.bitwarden" \
+          serviceCredentialsFile:"$PLAY_STORE_CREDS_FILE" \
+          track:"internal" \
+          trackPromoteTo:"Source Fastlane" \
+          versionCode:"$VERSION_CODE" \
+          versionName:"$VERSION_NAME" \
+          rolloutPercentage:"1"
+
   publish_fdroid:
     name: Publish F-Droid artifacts
     needs:

fastlane/Fastfile

@@ -570,6 +570,20 @@ platform :android do
       release_options[:version_name] = options[:versionName]
     end
 
+    # Resolve json_key the same way getLivePlayStoreVersion/getLatestPlayStoreVersion do:
+    # honor an explicit override, otherwise map from packageName. Needed so existing callers
+    # that never pass serviceCredentialsFile (e.g. bitwarden/deploy's production-promotion
+    # workflow) still authenticate with the right key for com.bitwarden.authenticator instead
+    # of silently falling through to the Appfile default (secrets/play_creds.json).
+    if options[:serviceCredentialsFile]
+      release_options[:json_key] = options[:serviceCredentialsFile]
+    else
+      case options[:packageName]
+      when "com.bitwarden.authenticator"
+        release_options[:json_key] = "secrets/authenticator_play_store-creds.json"
+      end
+    end
+
     if options[:releaseNotes].nil? or options[:releaseNotes].to_s.empty?
       release_options[:skip_upload_metadata] = true
     else