[forkline-bot]

Release 1.28.1

Patch release with autofill fixes for external OpenPGP provider usage.

Fixed

• Autofill with external OpenPGP provider no longer prompts twice for decryption
• Autofill with external OpenPGP provider correctly fills passwords instead of empty values

Fork infrastructure

• Updated dependencies: Gradle 9.9.1, gradle plugins, and GitHub Actions

---

This PR was generated by Forkline — AI-powered code contributions.
The agent analyzed the issue and implemented this fix autonomously.

[forkline-bot]

Maintainability Review: Release 1.28.1

Initial expected implementation: ✓ matched

Initial reason: The PR description specifies two autofill fixes for external OpenPGP provider usage and dependency updates. Both fixes are correctly implemented in commits f6b011b1 and 1994b5f9, which are merged into this release branch. The release commit a1e2a290 correctly updates the version and changelog.

Applied maintenance work: none

Final implementation: matches

Validation:

• Verified version code calculation: 1.28.1 → 12801 (formula: major×10000 + minor×100 + patch) ✓
• Verified CHANGELOG.md accurately reflects the two autofill fixes and dependency updates ✓
• Verified link references in CHANGELOG.md are correctly updated ✓
• Reviewed AutofillDecryptActivity.kt implementation:
  • Fix 1: Moved decryption from onStart() to onCreate() to prevent double-prompting when OpenPGP provider's interaction activity stops/restarts this activity ✓
  • Fix 2: Removed entry.clear() after setResult() to prevent NUL characters from being filled (dataset's AutofillValues wrap the same CharArrays) ✓
• Compared with DecryptActivity.kt pattern: both now use onCreate() consistently ✓
• Verified passphrase decryption path already had correct behavior (no entry.clear() after setResult()) ✓

---

Findings

Priority: low
Category: performance / resource management
Decision: recommend, but defer
Location: AutofillDecryptActivity.kt lines 87, 264, 268
Problem: Three ScheduledExecutorService instances are created for one-shot delayed tasks but never shut down. While they become idle after completing their 4-second tasks, the executor threads remain alive until the process exits.
Action: Store these executors in instance variables and shut them down in onDestroy(), or use a shared singleton executor for delayed finish tasks.
Why it is worth it: Prevents minor resource leaks and follows Android best practices for executor lifecycle management.
Risk / scope: Low risk, contained scope. However, these are one-shot tasks with minimal impact, so this can be deferred to a future maintenance release.

---

Priority: low
Category: test coverage
Decision: do not pursue
Location: AutofillDecryptActivityTest.kt
Problem: Only one test exists, verifying intent creation. No tests cover the actual decryption flow or the lifecycle fixes.
Action: No action recommended.
Why it is worth it: Testing Android Activity lifecycle issues (onStart vs onCreate, CharArray sharing with Dataset) would require complex instrumentation tests with minimal ROI. The fixes are straightforward and the manual testing burden is low.
Risk / scope: N/A

---

Summary

This is a clean, well-executed patch release. The two autofill fixes are minimal, targeted, and correctly address the reported issues:

1. Double-prompt fix: Moving decryption to onCreate() prevents re-execution when the activity restarts after an OpenPGP provider interaction, matching the pattern already used in DecryptActivity.

2. Empty password fix: Removing entry.clear() prevents the dataset's wrapped CharArrays from being zeroed before parceling, ensuring the browser receives the actual password instead of NUL characters.

The version bump and changelog are correct. No implementation mismatches or critical maintainability issues found. The executor lifecycle issue is minor and can be addressed in a future maintenance cycle if desired.

Recommendation: Approve for merge.