feat: allow injecting env secrets into KMP/Gradle release builds

[PavelMesicek]

Problem

Reusable release workflows can only inject secrets via secrets.properties (Secrets Gradle plugin → BuildConfig) and .xcconfig. KMP projects that bake secrets into BuildKonfig/BuildConfig via System.getenv(...) — e.g. API gateway keys in a ProductFlavors definition — have no way to feed those secrets into the Gradle bundle… task or the KMP make build step.

Concrete case: the Kaktus / Mobil.cz KMP repo reads System.getenv("KAKTUS_API_GW_KEY") / MOBIL_API_GW_KEY at Gradle configuration time. It therefore can't migrate its hand-rolled release workflows to the reusable ones — doing so would silently ship a prod build with an empty API gateway key.

Change

Add an optional, backward-compatible env-passthrough exported to $GITHUB_ENV before the build step (mirrors how secret_properties already works):

• android-build-googlePlay action — new build_env input, appended to $GITHUB_ENV before the Gradle bundle build.
• android-cloud-release-googlePlay workflow — new optional BUILD_ENV secret forwarded to the action.
• ios-kmp-selfhosted-release workflow — new optional KMP_BUILD_ENV secret, exported to $GITHUB_ENV before the KMP framework build.

All three default to empty, so existing consumers are unaffected.

Usage (consumer side)

# Android
secrets:
  BUILD_ENV: KAKTUS_API_GW_KEY=${{ secrets.KAKTUS_API_GW_KEY }}

# iOS
secrets:
  KMP_BUILD_ENV: KAKTUS_API_GW_KEY=${{ secrets.KAKTUS_API_GW_KEY }}

Multiple keys: one KEY=VALUE per line.

Notes

• Secret values written to $GITHUB_ENV stay masked in logs.
• Suggest cutting a new tag (e.g. 2.5.0) since consumers pin to tags.

🤖 Generated with Claude Code

[PavelMesicek]

Zavírám — na consumer straně jdeme cestou secrets.properties (existující SECRET_PROPERTIES input) pro Android a iOS release necháváme in-repo s env klíčem (KMP framework se peče make buildem ještě před Xcode, takže xcconfig nepomůže). Tím odpadá potřeba tohoto env-passthrough. Díky!