Add Android and Linux desktop SDK variants with matrix pipelines

Adds Dockerfile.android (Flutter + Android SDK/JDK 17) and
Dockerfile.linux (Flutter + clang/cmake/GTK3 for desktop builds).
Publish and Scout pipelines now use matrix strategy to build all
three variants in parallel. Registry secrets updated to
REGISTRY_USERNAME/REGISTRY_PASSWORD. Update-check adds explicit
stable channel filter.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/publish.yaml

@@ -7,12 +7,21 @@ on:
 permissions:
   contents: read
 
-env:
-  IMAGE_NAME: gpb-flutter-sdk-web
-
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - dockerfile: Dockerfile
+            image_name: gpb-flutter-sdk-web
+            description: Minimal Flutter SDK for Web/WASM CI builds
+          - dockerfile: Dockerfile.android
+            image_name: gpb-flutter-sdk-android
+            description: Flutter SDK for Android CI builds
+          - dockerfile: Dockerfile.linux
+            image_name: gpb-flutter-sdk-linux
+            description: Flutter SDK for Linux desktop CI builds
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
@@ -32,19 +41,20 @@ jobs:
       - name: Login to Docker Registry
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKERHUB_SVRNTY_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_SVRNTY_ACCESS_TOKEN }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build image for Scout analysis
         uses: docker/build-push-action@v5
         with:
           context: .
+          file: ${{ matrix.dockerfile }}
           platforms: linux/amd64
           push: false
           load: true
           build-args: |
             FLUTTER_VERSION=${{ github.event.release.tag_name }}
-          tags: ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }}
+          tags: ${{ vars.REGISTRY }}/${{ matrix.image_name }}:${{ github.event.release.tag_name }}
 
       - name: Install Docker Scout
         run: |
@@ -53,12 +63,13 @@ jobs:
 
       - name: Docker Scout CVE Scan
         run: |
-          docker scout cves ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }} --only-severity critical,high
+          docker scout cves ${{ vars.REGISTRY }}/${{ matrix.image_name }}:${{ github.event.release.tag_name }} --only-severity critical,high
 
       - name: Build and push with attestations
         uses: docker/build-push-action@v5
         with:
           context: .
+          file: ${{ matrix.dockerfile }}
           platforms: linux/amd64
           push: true
           sbom: true
@@ -66,10 +77,10 @@ jobs:
           build-args: |
             FLUTTER_VERSION=${{ github.event.release.tag_name }}
           tags: |
-            ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }}
-            ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag_type.outputs.tag }}
+            ${{ vars.REGISTRY }}/${{ matrix.image_name }}:${{ github.event.release.tag_name }}
+            ${{ vars.REGISTRY }}/${{ matrix.image_name }}:${{ steps.tag_type.outputs.tag }}
           labels: |
-            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
-            org.opencontainers.image.description=Minimal Flutter SDK for Web/WASM CI builds
+            org.opencontainers.image.title=${{ matrix.image_name }}
+            org.opencontainers.image.description=${{ matrix.description }}
             org.opencontainers.image.version=${{ github.event.release.tag_name }}
             org.opencontainers.image.revision=${{ github.sha }}

.gitea/workflows/scout.yaml

@@ -8,63 +8,62 @@ permissions:
   contents: read
   pull-requests: write
 
-env:
-  IMAGE_NAME: gpb-flutter-sdk-web
-
 jobs:
-  check-image:
+  scout:
     runs-on: ubuntu-latest
-    outputs:
-      image_exists: ${{ steps.check.outputs.exists }}
+    strategy:
+      matrix:
+        include:
+          - dockerfile: Dockerfile
+            image_name: gpb-flutter-sdk-web
+          - dockerfile: Dockerfile.android
+            image_name: gpb-flutter-sdk-android
+          - dockerfile: Dockerfile.linux
+            image_name: gpb-flutter-sdk-linux
     steps:
       - name: Log in to DockerHub
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKERHUB_SVRNTY_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_SVRNTY_ACCESS_TOKEN }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Check if latest image exists
-        id: check
+        id: should_run
         run: |
-          if docker manifest inspect ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:latest > /dev/null 2>&1; then
-            echo "exists=true" >> $GITHUB_OUTPUT
-            echo "Latest image found, Scout compare will run"
+          if docker manifest inspect ${{ vars.REGISTRY }}/${{ matrix.image_name }}:latest > /dev/null 2>&1; then
+            echo "run=true" >> $GITHUB_OUTPUT
+            echo "Latest ${{ matrix.image_name }} found, Scout compare will run"
           else
-            echo "exists=false" >> $GITHUB_OUTPUT
-            echo "No latest image found, skipping Scout compare (nothing to compare against)"
+            echo "run=false" >> $GITHUB_OUTPUT
+            echo "No latest ${{ matrix.image_name }} found, skipping (nothing to compare against)"
           fi
 
-  scout-amd64:
-    runs-on: ubuntu-latest
-    needs: check-image
-    if: needs.check-image.outputs.image_exists == 'true'
-    steps:
       - name: Checkout code
+        if: steps.should_run.outputs.run == 'true'
         uses: actions/checkout@v3
 
       - name: Set up Docker Buildx
+        if: steps.should_run.outputs.run == 'true'
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to DockerHub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_SVRNTY_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_SVRNTY_ACCESS_TOKEN }}
-
-      - name: Build amd64 image
+      - name: Build image
+        if: steps.should_run.outputs.run == 'true'
         uses: docker/build-push-action@v5
         with:
           context: .
+          file: ${{ matrix.dockerfile }}
           platforms: linux/amd64
           push: false
           load: true
-          tags: ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:pr-${{ github.event.pull_request.number }}-amd64
+          tags: ${{ vars.REGISTRY }}/${{ matrix.image_name }}:pr-${{ github.event.pull_request.number }}
 
       - name: Install Docker Scout
+        if: steps.should_run.outputs.run == 'true'
         run: |
           curl -fsSL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh -o install-scout.sh
           sh install-scout.sh
 
-      - name: Docker Scout Compare (amd64)
+      - name: Docker Scout Compare
+        if: steps.should_run.outputs.run == 'true'
         run: |
-          docker scout compare ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:pr-${{ github.event.pull_request.number }}-amd64 --to ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:latest --ignore-unchanged --only-severity critical,high
+          docker scout compare ${{ vars.REGISTRY }}/${{ matrix.image_name }}:pr-${{ github.event.pull_request.number }} --to ${{ vars.REGISTRY }}/${{ matrix.image_name }}:latest --ignore-unchanged --only-severity critical,high

.gitea/workflows/update-check.yaml

@@ -12,8 +12,8 @@ jobs:
       - name: Get latest Flutter stable version
         id: flutter
         run: |
-          LATEST=$(curl -fsSL https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json \
-            | jq -r '.current_release.stable as $hash | .releases[] | select(.hash == $hash) | .version')
+          RESPONSE=$(curl -fsSL https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json)
+          LATEST=$(echo "$RESPONSE" | jq -r '.current_release.stable as $hash | .releases[] | select(.hash == $hash and .channel == "stable") | .version')
           echo "version=${LATEST}" >> $GITHUB_OUTPUT
           echo "Latest Flutter stable: ${LATEST}"