ci: roll every android release out to the internal and closed testing tracks on google play

.github/workflows/release-android.yml

@@ -441,6 +441,7 @@ jobs:
           cp android/app/build/outputs/mapping/playRelease/mapping.txt "$MAPPING"
           echo "aab=$AAB" >> "$GITHUB_OUTPUT"
           echo "mapping=$MAPPING" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - uses: actions/upload-artifact@v4
         with:
@@ -450,11 +451,11 @@ jobs:
             ${{ steps.artifact.outputs.mapping }}
           if-no-files-found: error
 
-      # Runs once PLAY_SERVICE_ACCOUNT_JSON is set. Play only accepts API
-      # uploads after the first bundle was uploaded by hand in the Console, and
-      # releases of an app that was never published must be drafts; switch
-      # `status` to `completed` after the first production release.
-      - name: Upload to Google Play (internal testing, draft)
+      # Runs once PLAY_SERVICE_ACCOUNT_JSON is set (Play only accepts API
+      # uploads after the first bundle was uploaded by hand in the Console).
+      # Every release goes out to the internal and closed (beta) testers right
+      # away; closed testing may wait for Google's review first.
+      - name: Upload to Google Play (internal and closed testing)
         if: env.PLAY_SERVICE_ACCOUNT_JSON != ''
         uses: r0adkll/upload-google-play@v1
         with:
@@ -462,5 +463,6 @@ jobs:
           packageName: org.bulwarkmail.mobile
           releaseFiles: ${{ steps.artifact.outputs.aab }}
           mappingFile: ${{ steps.artifact.outputs.mapping }}
-          track: internal
-          status: draft
+          releaseName: ${{ steps.artifact.outputs.version }}
+          tracks: internal,beta
+          status: completed

docs/android-release.md

@@ -228,9 +228,11 @@ The `play-bundle` job builds `bundlePlayRelease` for arm64-v8a, armeabi-v7a and
 x86_64 (Play splits the bundle per ABI), checks the signer, the package name and
 the permissions, and keeps the AAB and its R8 mapping as a workflow artifact.
 With the `PLAY_SERVICE_ACCOUNT_JSON` secret set (vault: "Google Play – service
-account bulwark-google-play-api") it also uploads the bundle to the internal
-testing track as a draft. Play only accepts API uploads once a first bundle has
-been uploaded by hand in the Play Console.
+account bulwark-google-play-api") it also uploads the bundle and rolls it out
+on the internal and closed (beta) testing tracks, so testers get every release
+without a step in the Play Console; closed testing may wait for Google's
+review. Play only accepts API uploads once a first bundle has been uploaded by
+hand in the Play Console.
 
 The `github` flavor stays on the old Firebase project until the app registers
 its new FCM token with the relay when the token changes; moving it before that