Ship guides/ in the Hex package; fix the keystore.properties.example reference (MOB-501)

CHANGELOG.md

@@ -1,5 +1,15 @@
 ## [Unreleased]
 
+### Fixed
+
+- **The Hex package ships `guides/` (MOB-501).** It shipped only the
+  default files, so an app had no `deps/mob_dev/guides/` and the publishing
+  and security-scan guides were only on hexdocs.
+- **`mix mob.release --android` no longer points at a missing
+  `android/keystore.properties.example` (MOB-501).** No generated app has
+  one. The task docs and `guides/publishing_to_google_play.md` now list the
+  file's four keys and name `mix mob.setup.google_play`, which writes it.
+
 ## [0.7.30] - 2026-10-23
 
 ### Security

guides/publishing_to_google_play.md

@@ -112,13 +112,9 @@ something real (it goes into the certificate, which Google sees).
 
 ### Fill in `android/keystore.properties`
 
-Copy from the example and fill in your passphrase:
-
-```bash
-cp android/keystore.properties.example android/keystore.properties
-```
-
-Edit `android/keystore.properties`:
+`mix mob.setup.google_play` writes this file when it creates the keystore.
+To write it by hand, create `android/keystore.properties` with your
+passphrase (`storeFile` is relative to `android/`):
 
 ```
 storeFile=upload_jks.keystore

lib/mix/tasks/mob.release.ex

@@ -49,9 +49,17 @@ defmodule Mix.Tasks.Mob.Release do
 
   ## --android prerequisites
 
-    1. `android/keystore.properties` filled in with your upload keystore
-       credentials. `android/upload_jks.keystore` must exist. See
-       `android/keystore.properties.example`.
+    1. `android/upload_jks.keystore` and `android/keystore.properties`.
+       `mix mob.setup.google_play` writes both when it generates the
+       keystore (it skips an existing one). By hand, the properties file is
+       (paths relative to `android/`):
+
+           storeFile=upload_jks.keystore
+           storePassword=<passphrase>
+           keyAlias=upload
+           keyPassword=<passphrase>
+
+       See guides/publishing_to_google_play.md.
 
   ## What --android does
 

mix.exs

@@ -173,7 +173,10 @@ defmodule MobDev.MixProject do
   defp package do
     [
       licenses: ["MIT"],
-      links: %{"GitHub" => "https://github.com/genericjam/mob_dev"}
+      links: %{"GitHub" => "https://github.com/genericjam/mob_dev"},
+      # Hex's default list plus guides/, so an app has the publishing and
+      # security-scan guides under deps/mob_dev/guides offline (MOB-501).
+      files: ~w(lib priv guides .formatter.exs mix.exs README.md CHANGELOG.md)
     ]
   end
 end

test/mob_dev/deployer_stale_ssl_test.exs

@@ -85,7 +85,9 @@ defmodule MobDev.DeployerStaleSslTest do
     end
   end
 
-  describe "remove_stale_host_ssl/1 (iOS simulator deploy and native build)" do
+  # The helper only; the iOS-simulator deploy and copy_app_beams fail on its
+  # {:error, _} but aren't exercised here.
+  describe "remove_stale_host_ssl/1" do
     test "files that aren't there are fine", %{tmp_dir: tmp} do
       assert Deployer.remove_stale_host_ssl(tmp) == :ok
     end

test/mob_dev/toolchain_package_test.exs

@@ -22,6 +22,12 @@ defmodule MobDev.ToolchainPackageTest do
 
     assert pack_status == 0, pack_output
     refute File.exists?(Path.join(package, ".tool-versions"))
+    # Apps read these offline under deps/mob_dev/guides (MOB-501); Hex's
+    # default file list leaves guides/ out.
+    for guide <- File.ls!(Path.join(root, "guides")) do
+      assert File.regular?(Path.join([package, "guides", guide])), "#{guide} not packaged"
+    end
+
     File.cp!(Path.join(root, "mix.lock"), Path.join(package, "mix.lock"))
     link_compiled_dependencies(root, build)