Aktualisiere Footer-Stile und verbessere Zugänglichkeit; erhöhe die Version auf 1.8.8

Emails korrigiert

.gitea/workflows/code-analysis.yml

@@ -6,13 +6,23 @@ on:
 
 jobs:
   analyze:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           clean: true
-          fetch-depth: 0
+          # Der Analyse-Workflow benötigt keine Historie. Ein flacher Checkout
+          # verhindert, dass der Runner das große Repository-Pack vollständig lädt.
+          fetch-depth: 1
+          # Der Web-Workflow braucht keine Android-Artefakte. Insbesondere liegt
+          # dort ein großer Heap-Dump im aktuellen Commit, der auch bei einem
+          # flachen Checkout übertragen würde und den Runner-Checkout abbricht.
+          sparse-checkout: |
+            /*
+            !/android-app/
+          sparse-checkout-cone-mode: false
 
       - name: Ensure clean workspace
         run: |
@@ -28,7 +38,7 @@ jobs:
           echo "eslint entries in package.json:" && rg '"eslint"' package.json || true
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: 22
           cache: npm
@@ -115,12 +125,11 @@ jobs:
           chmod +x osv-scanner
           ./osv-scanner --version
           test -f ./package-lock.json
-          ./osv-scanner --lockfile ./package-lock.json
+          ./osv-scanner scan -L ./package-lock.json --config ./.osv-scanner.toml
 
   deploy-production:
-    needs: analyze
     runs-on: ubuntu-latest
-    if: success() && github.event_name == 'push' && github.ref == 'refs/heads/main'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
       - name: Prepare SSH
         run: |
@@ -146,7 +155,7 @@ jobs:
             -o BatchMode=yes \
             -p "${{ vars.PROD_PORT }}" \
             "${{ vars.PROD_USER }}@${{ vars.PROD_HOST }}" \
-            "bash -lc 'cd /var/www/harheimertc && git fetch origin main && git checkout -B main origin/main && git reset --hard origin/main && ./deploy-production.sh'"
+            "bash -lc 'cd /var/www/harheimertc && git reset --hard HEAD && git fetch origin main && git checkout -B main origin/main && git reset --hard origin/main && ./deploy-production.sh'"
 
   deploy-test:
     needs: analyze
@@ -177,4 +186,4 @@ jobs:
             -o BatchMode=yes \
             -p "${{ vars.PROD_PORT }}" \
             "${{ vars.PROD_USER }}@${{ vars.PROD_HOST }}" \
-            "bash -lc 'cd /var/www/harheimertc.test && git fetch origin dev && git checkout -B dev origin/dev && git reset --hard origin/dev && ./deploy-test.sh'"
+            "bash -lc 'cd /var/www/harheimertc.test && git reset --hard HEAD && git fetch origin dev && git checkout -B dev origin/dev && git reset --hard origin/dev && ./deploy-test.sh'"

.github/workflows/android-ci.yml

@@ -10,14 +10,14 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9
         with:
           distribution: 'temurin'
           java-version: '17'
       - name: Cache Gradle
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
         with:
           path: |
             ~/.gradle/caches

.gitignore

@@ -93,6 +93,9 @@ dist
 /android-app/.kotlin/
 /android-app/**/build/
 /android-app/local.properties
+/android-app/gradle-local.properties
+# JVM Heap-Dumps sind lokale Diagnoseartefakte und dürfen nie ins Repository.
+*.hprof
 
 # Build output (but keep production data!)
 .output

.gitleaks.toml

@@ -0,0 +1,7 @@
+[[allowlists]]
+description = "generated/imported non-secret data"
+paths = [
+  '''server/data/spielplan-import/harheimer_tc_spielplan\.(html|json)$''',
+  '''android-app/app/build/.*''',
+  '''android-app/\.idea/planningMode\.xml$''',
+]

.gitleaksignore

@@ -0,0 +1,3 @@
+google-services.json:gcp-api-key:18
+google-services.json:gcp-api-key:37
+google-services.json:gcp-api-key:56

.osv-scanner.toml

@@ -0,0 +1,4 @@
+[[IgnoredVulns]]
+id = "GHSA-v3m3-f69x-jf25"
+ignoreUntil = 2026-12-31
+reason = "Temporary exception: Quill 2.0.3 is required by the current RichTextEditor implementation, and OSV currently reports no fixed version. Track upstream fix and remove this ignore once a patched release is available."

android-app/PLAYSTORE_ASSETS.md

@@ -36,13 +36,12 @@ Ausgabe in:
 
 ## 3) Screenshots (anonymisiert)
 
-### Grobe Anforderungen (Telefon)
+### Zielgroessen fuer Store-Upload
-- Mindestens 2 Screenshots
+- Telefon (Portrait): 1080 x 1920
-- PNG oder JPEG
+- Medium 7" Tablet (Portrait): 1200 x 1920
-- Seitenlaenge je Seite zwischen 320 px und 3840 px
+- 10" Tablet (Portrait): 1600 x 2560
 
-Empfehlung fuer Android-Phone:
+Alle Dateien als PNG oder JPEG.
-- 1080 x 1920 (Portrait)
 
 ### Anonymisierung
 
@@ -61,10 +60,33 @@ Beispiel:
   '68,118,520,72;70,706,560,98'
 ```
 
+### Zielprofile erzeugen (Telefon, 7", 10")
+
+Aus allen Dateien in `android-app/playstore-assets/anon` werden die drei Profile erzeugt:
+
+```bash
+./scripts/playstore-screenshot-sizes.sh
+```
+
+Optional mit eigenen Ordnern:
+
+```bash
+./scripts/playstore-screenshot-sizes.sh \
+  --input-dir android-app/playstore-assets/anon \
+  --output-dir android-app/playstore-assets/final
+```
+
+Output:
+- android-app/playstore-assets/final/phone
+- android-app/playstore-assets/final/tablet-7
+- android-app/playstore-assets/final/tablet-10
+
 ## 4) Upload in Play Console
 
 - Datenschutzerklaerung: URL eintragen
 - Konto-Loeschung: URL eintragen
 - App-Icon: playstore-icon-512.png
 - Feature Graphic: playstore-feature-graphic-1024x500.png
-- Screenshots: anonymisierte PNG/JPEG hochladen
+- Screenshots Telefon: Dateien aus `.../final/phone`
+- Screenshots 7" Tablet: Dateien aus `.../final/tablet-7`
+- Screenshots 10" Tablet: Dateien aus `.../final/tablet-10`

android-app/app/build.gradle.kts

@@ -1,3 +1,5 @@
+import java.util.Properties
+
 plugins {
     id("com.android.application")
     id("com.google.devtools.ksp")
@@ -5,12 +7,17 @@ plugins {
     id("com.google.dagger.hilt.android")
 }
 
+if (file("google-services.json").exists()) {
+    apply(plugin = "com.google.gms.google-services")
+}
+
 val localApiBaseUrl = providers.gradleProperty("LOCAL_API_BASE_URL")
     .orElse("https://harheimertc.tsschulz.de/")
     .get()
 val productionApiBaseUrl = providers.gradleProperty("PRODUCTION_API_BASE_URL")
     .orElse("https://harheimertc.de/")
     .get()
+val expectedProductionApiBaseUrl = "https://harheimertc.de/"
 val sentryDsn = providers.gradleProperty("SENTRY_DSN")
     .orElse("")
     .get()
@@ -25,27 +32,69 @@ val releaseMinifyEnabled = providers.gradleProperty("RELEASE_MINIFY_ENABLED")
     .orElse("true")
     .get()
     .toBoolean()
-val releaseStoreFile = providers.gradleProperty("RELEASE_STORE_FILE").orNull
+
-val releaseStorePassword = providers.gradleProperty("RELEASE_STORE_PASSWORD").orNull
+val localSigningProperties = Properties().apply {
-val releaseKeyAlias = providers.gradleProperty("RELEASE_KEY_ALIAS").orNull
+    val localSigningFile = rootProject.file("gradle-local.properties")
-val releaseKeyPassword = providers.gradleProperty("RELEASE_KEY_PASSWORD").orNull
+    if (localSigningFile.exists()) {
+        localSigningFile.inputStream().use { load(it) }
+    }
+}
+
+fun signingProperty(name: String): String? =
+    providers.gradleProperty(name).orNull
+        ?: providers.environmentVariable(name).orNull
+        ?: localSigningProperties.getProperty(name)
+
+val releaseStoreFile = signingProperty("RELEASE_STORE_FILE")
+val releaseStorePassword = signingProperty("RELEASE_STORE_PASSWORD")
+val releaseKeyAlias = signingProperty("RELEASE_KEY_ALIAS")
+val releaseKeyPassword = signingProperty("RELEASE_KEY_PASSWORD")
 val hasReleaseSigning = !releaseStoreFile.isNullOrBlank() &&
     !releaseStorePassword.isNullOrBlank() &&
     !releaseKeyAlias.isNullOrBlank() &&
     !releaseKeyPassword.isNullOrBlank()
 
+val ensureReleaseSigning = tasks.register("ensureReleaseSigning") {
+    doFirst {
+        if (!hasReleaseSigning) {
+            throw GradleException(
+                "Production release signing is not configured. " +
+                    "Set RELEASE_STORE_FILE, RELEASE_STORE_PASSWORD, RELEASE_KEY_ALIAS and RELEASE_KEY_PASSWORD " +
+                    "(e.g. via ~/.gradle/gradle.properties, environment variables, or android-app/gradle-local.properties)."
+            )
+        }
+    }
+}
+
+val ensureProductionApiBaseUrl = tasks.register("ensureProductionApiBaseUrl") {
+    doFirst {
+        if (productionApiBaseUrl != expectedProductionApiBaseUrl) {
+            throw GradleException(
+                "Production Play Store builds must use $expectedProductionApiBaseUrl, but PRODUCTION_API_BASE_URL is $productionApiBaseUrl."
+            )
+        }
+    }
+}
+
 android {
     namespace = "de.harheimertc"
-    compileSdk = 35
+    compileSdk = 36
 
     defaultConfig {
         applicationId = "de.harheimertc"
         minSdk = 24
-        targetSdk = 35
+        targetSdk = 36
         versionCode = androidVersionCode
         versionName = androidVersionName
     }
 
+    lint {
+        disable += setOf(
+            "AutoboxingStateCreation",
+            "MutableCollectionMutableState",
+        )
+    }
+
     signingConfigs {
         create("release") {
             if (hasReleaseSigning) {
@@ -135,6 +184,8 @@ val packageNativeDebugSymbolsForProductionRelease = tasks.register<Zip>("package
 val collectPlayStoreArtifacts = tasks.register("collectPlayStoreArtifacts") {
     group = "distribution"
     description = "Builds production release artifacts and collects AAB, mapping, and native symbols for Play Console upload."
+    dependsOn(ensureReleaseSigning)
+    dependsOn(ensureProductionApiBaseUrl)
     dependsOn(":app:bundleProductionRelease")
     dependsOn(packageNativeDebugSymbolsForProductionRelease)
 
@@ -161,6 +212,13 @@ val collectPlayStoreArtifacts = tasks.register("collectPlayStoreArtifacts") {
     }
 }
 
+tasks.matching {
+    it.name in setOf("bundleProductionRelease", "assembleProductionRelease")
+}.configureEach {
+    dependsOn(ensureReleaseSigning)
+    dependsOn(ensureProductionApiBaseUrl)
+}
+
 kotlin {
     compilerOptions {
         jvmTarget.set(org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_17)
@@ -206,6 +264,9 @@ dependencies {
     // Crash reporting
     implementation("io.sentry:sentry-android:8.42.0")
 
+    // Push notifications
+    implementation("com.google.firebase:firebase-messaging:25.0.2")
+
     // Room
     implementation("androidx.room:room-runtime:2.6.1")
     ksp("androidx.room:room-compiler:2.6.1")
@@ -215,6 +276,7 @@ dependencies {
     implementation("androidx.work:work-runtime-ktx:2.8.1")
     implementation("androidx.datastore:datastore-preferences:1.0.0")
     implementation("androidx.security:security-crypto:1.1.0-alpha06")
+    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-play-services:1.7.3")
 
     // Testing (skeleton)
     testImplementation("junit:junit:4.13.2")

android-app/app/google-services.json

@@ -0,0 +1 @@