Add workflow permissions, standardize outputs, and implement PR-based scaffolding

.github/workflows/scaffold-build-release.yml

@@ -5,6 +5,11 @@ on:
   push:
     branches: [ main ]
 
+permissions:
+  contents: write
+  id-token: write
+  actions: read
+
 jobs:
   scaffold-build-release:
     runs-on: ubuntu-latest
@@ -80,21 +85,61 @@ jobs:
         REQ
           mkdir -p assets/fonts assets/themes src/ui src/copilot src/auth src/filesystem src/executor
           echo "Replace with real PNG" > assets/placeholder_icon.txt
+
+          # Create a new branch for scaffolded changes
+          BRANCH_NAME="scaffold/auto-generated-$(date +%Y%m%d-%H%M%S)"
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$BRANCH_NAME"
           git add main.py buildozer.spec requirements.txt assets || true
           git commit -m "scaffold: add minimal Kivy app and buildozer.spec" || true
-          echo "Scaffolded=1" >> $GITHUB_OUTPUT
+
+          # Push branch with error handling
+          if git push origin "$BRANCH_NAME"; then
+            echo "Successfully pushed branch $BRANCH_NAME"
+            # Save branch name for PR creation
+            echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
+            echo "scaffolded=1" >> $GITHUB_OUTPUT
+          else
+            echo "Failed to push branch. Scaffolding aborted."
+            exit 1
+          fi
         else
-          echo "Scaffolded=0" >> $GITHUB_OUTPUT
+          echo "scaffolded=0" >> $GITHUB_OUTPUT
         fi
 
+    - name: Create Pull Request for scaffolded files
+      if: steps.scaffold.outputs.scaffolded == '1'
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        cat > ${{ runner.temp }}/pr_body.md <<'EOFBODY'
+        This PR was automatically created by the scaffold workflow.
+
+        ## Changes
+        - Added main.py with minimal Kivy app structure
+        - Added buildozer.spec for Android build configuration  
+        - Added requirements.txt with Python dependencies
+        - Created initial directory structure for assets and source code
+
+        Please review and merge to proceed with the build process.
+        EOFBODY
+        gh pr create \
+          --title "Auto-scaffold: Add minimal Kivy app and buildozer config" \
+          --body-file ${{ runner.temp }}/pr_body.md \
+          --label "automated" \
+          --label "scaffold" \
+          --head "${{ steps.scaffold.outputs.branch_name }}" \
+          --base main
+
     - name: Install OS packages
+      if: steps.scaffold.outputs.scaffolded != '1'
       run: |
         sudo apt-get update -y
         sudo apt-get install -y openjdk-11-jdk unzip wget libc6-i386 lib32stdc++6 lib32gcc1
 
     - name: Install Android tools & SDK packages
+      if: steps.scaffold.outputs.scaffolded != '1'
       run: |
         set -e
         mkdir -p "$ANDROID_SDK_ROOT/cmdline-tools"
@@ -108,34 +153,40 @@ jobs:
         echo "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin" >> $GITHUB_PATH
 
     - name: Accept Android SDK licenses
+      if: steps.scaffold.outputs.scaffolded != '1'
       run: |
         yes | "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager" --licenses || true
 
     - name: Setup Python
+      if: steps.scaffold.outputs.scaffolded != '1'
       uses: actions/setup-python@v4
       with:
         python-version: '3.9'
 
     - name: Install Buildozer, Cython and requirements
+      if: steps.scaffold.outputs.scaffolded != '1'
       run: |
         python -m pip install --upgrade pip wheel setuptools
         pip install buildozer==1.4.2 cython==0.29.36
         pip install -r requirements.txt || true
 
     - name: Build APK with Buildozer
+      if: steps.scaffold.outputs.scaffolded != '1'
       run: |
         set -e
         buildozer android clean || true
         buildozer -v android debug
         ls -la bin || true
 
     - name: Upload APK artifact
+      if: steps.scaffold.outputs.scaffolded != '1'
       uses: actions/upload-artifact@v3
       with:
         name: mobileide-apk
         path: bin/*.apk
 
     - name: Create Release and upload APK
+      if: steps.scaffold.outputs.scaffolded != '1'
       uses: softprops/action-gh-release@v1
       with:
         files: bin/*.apk
@@ -145,6 +196,7 @@ jobs:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Output install link
+      if: steps.scaffold.outputs.scaffolded != '1'
       run: |
         APK_FILE=$(basename bin/*.apk)
         INSTALL_URL="https://github.com/${GITHUB_REPOSITORY}/releases/latest/download/${APK_FILE}"

BUILD_AND_RELEASE.md

@@ -18,6 +18,8 @@ Save as BUILD_AND_RELEASE.md in the repo root (or paste into an agent). This sin
 ## 3) Minimal/Scaffold GitHub Actions workflow
 - Create .github/workflows/scaffold-build-release.yml with the exact contents below. This workflow will:
   - Scaffold a minimal Kivy app if main.py/buildozer.spec missing
+  - Create a pull request with the scaffolded files (does NOT push directly to main)
+  - After PR is merged, subsequent runs will build the APK
   - Install Android SDK tools, Buildozer, build the APK
   - Create a GitHub Release and upload the APK
   - Emit a direct download URL for the APK
@@ -30,6 +32,7 @@ See `.github/workflows/scaffold-build-release.yml` for the complete workflow.
   git add . && git commit -m "Add workflow" && git push origin main
   ```
 - Or run Actions → Scaffold, Build & Release APK → Run workflow (workflow_dispatch).
+- **Note**: If the workflow needs to scaffold files (first run), it will create a pull request instead of building immediately. Review and merge the PR, then trigger the workflow again to build the APK.
 
 ## 5) After the workflow completes
 - Open the workflow run; view step "Output install link" or check the job summary for: