feat: add zsp Zapstore publish config and CI workflow

zapstore.yaml:
- Rewritten to use correct zsp fields (repository, tags, metadata_sources)
- Uses GitHub releases as APK source (auto-detected by zsp)
- Removed non-standard fields (pubkey, categories → tags)
- Added supported_nips list

.github/workflows/zapstore.yml:
- Triggers on version tags (v*.*.*)
- Builds web app with Node 22
- Syncs Capacitor Android project
- Builds signed release APK via Gradle
- Creates GitHub Release with APK attached
- Installs zsp and publishes to Zapstore relay

Required GitHub secrets:
  KEYSTORE_BASE64   – base64-encoded .jks keystore
  KEYSTORE_PASSWORD – keystore store password
  KEY_ALIAS         – key alias in keystore
  KEY_PASSWORD      – key password
  SIGN_WITH         – nsec or bunker:// for Nostr signing

Co-authored-by: shakespeare.diy <assistant@shakespeare.diy>

.github/workflows/zapstore.yml

@@ -0,0 +1,106 @@
+name: Build & Publish to Zapstore
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'   # e.g. v1.2.3
+
+  # Allow manual trigger from Actions tab
+  workflow_dispatch:
+
+permissions:
+  contents: write   # needed to create GitHub releases
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+
+    steps:
+      # ── 1. Checkout ────────────────────────────────────────────
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # ── 2. Node / web build ────────────────────────────────────
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+
+      - name: Install dependencies and build web app
+        run: |
+          npm install
+          npm run build
+
+      # ── 3. Java / Android toolchain ───────────────────────────
+      - name: Setup Java 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v3
+
+      # ── 4. Capacitor sync ─────────────────────────────────────
+      - name: Install Capacitor CLI and sync Android
+        run: |
+          npx cap sync android
+
+      # ── 5. Sign the APK ───────────────────────────────────────
+      # Secrets required in GitHub repo settings:
+      #   KEYSTORE_BASE64   – base64-encoded .jks keystore file
+      #   KEYSTORE_PASSWORD – keystore password
+      #   KEY_ALIAS         – key alias inside the keystore
+      #   KEY_PASSWORD      – key password
+      - name: Decode keystore
+        run: |
+          echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 --decode > android/app/release.jks
+
+      - name: Build signed release APK
+        working-directory: android
+        env:
+          KEYSTORE_PATH: app/release.jks
+          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+        run: |
+          ./gradlew assembleRelease \
+            -Pandroid.injected.signing.store.file=$KEYSTORE_PATH \
+            -Pandroid.injected.signing.store.password=$KEYSTORE_PASSWORD \
+            -Pandroid.injected.signing.key.alias=$KEY_ALIAS \
+            -Pandroid.injected.signing.key.password=$KEY_PASSWORD
+
+      # ── 6. Locate APK ─────────────────────────────────────────
+      - name: Locate APK
+        id: apk
+        run: |
+          APK=$(find android/app/build/outputs/apk/release -name "*.apk" | head -1)
+          echo "path=$APK" >> $GITHUB_OUTPUT
+          echo "Found APK: $APK"
+
+      # ── 7. Create GitHub Release with APK ─────────────────────
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: ${{ steps.apk.outputs.path }}
+          generate_release_notes: true
+
+      # ── 8. Install zsp ────────────────────────────────────────
+      - name: Install zsp
+        run: |
+          curl -sSL https://github.com/zapstore/zsp/releases/latest/download/zsp_linux_amd64 \
+            -o /usr/local/bin/zsp
+          chmod +x /usr/local/bin/zsp
+          zsp --version
+
+      # ── 9. Publish to Zapstore ────────────────────────────────
+      # Secrets required:
+      #   SIGN_WITH   – nsec or bunker:// URL for Nostr signing
+      - name: Publish to Zapstore
+        env:
+          SIGN_WITH: ${{ secrets.SIGN_WITH }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELAY_URLS: wss://relay.zapstore.dev
+        run: |
+          zsp publish -y zapstore.yaml

zapstore.yaml

@@ -1,33 +1,66 @@
 # Zapstore publish config for SkateSpots
-# https://zapstore.dev/docs/publish
+# https://zapstore.dev
 #
-# This file must be committed to the repository root.
+# Publish with: zsp publish zapstore.yaml
-# Zapstore's relay fetches it to verify the publisher's Nostr identity.
+# Or via CI: see .github/workflows/zapstore.yml
 
-repository: https://git.shakespeare.diy/skatespots/SkateSpots
+# ═══════════════════════════════════════════════════════════════════
-pubkey: npub1yrnuj56rnen08zp2h9h7p74ghgjx6ma39spmpj6w9hzxywutevsst7k5cx
+# SOURCE CONFIGURATION
+# ═══════════════════════════════════════════════════════════════════
+
+# Source code repository — zsp fetches APK from GitHub releases automatically
+repository: https://github.com/SkateSpots/SkateSpots
+
+# ═══════════════════════════════════════════════════════════════════
+# APP METADATA
+# ═══════════════════════════════════════════════════════════════════
 
-# App metadata
 name: SkateSpots
 summary: Decentralized skate map & community on Nostr
+
 description: |
   Discover skate spots worldwide, find coaches and filmers in The Lab,
-  join events, buy/sell gear, and connect with the skateboarding community.
+  join events, buy/sell gear, and connect with the global skateboarding community.
+
   Built on Nostr — decentralized, censorship-resistant, no ads, no tracking.
   Powered by Bitcoin Lightning zaps.
 
+  Features:
+  - Interactive map with skate spots worldwide
+  - The Lab: coaches, filmers & video editors
+  - Events calendar
+  - Buy/sell used skate gear
+  - Private encrypted gear stash
+  - NoGood Radio (24/7 lofi/synthwave)
+  - Lightning zaps to content creators
+  - Works offline (PWA)
+
 website: https://skate-spots.org
 license: custom
 
-# Categories (Zapstore uses F-Droid categories)
+# Category tags (used for Zapstore discovery)
-categories:
+tags:
-  - Sports & Health
+  - sports
-  - Navigation
+  - social
+  - nostr
+  - bitcoin
+  - maps
 
-# Where to find the APK once built
+# Nostr NIPs supported
-# Update this to your actual release APK path after building
+supported_nips:
-release_source: ./android/app/build/outputs/apk/release/app-release.apk
+  - "01"
+  - "07"
+  - "46"
+  - "47"
+  - "57"
+  - "65"
+  - "99"
 
-# Pull extra metadata from the GitHub/git repo
+# ═══════════════════════════════════════════════════════════════════
+# METADATA SOURCES
+# ═══════════════════════════════════════════════════════════════════
+
+# Pull description, icon, screenshots from Play Store + GitHub
 metadata_sources:
+  - playstore
   - github