[tools] Replace APK utilities with skill file apps

[simonrozsival]

Summary

• replace the standalone assembly-store reader and decompressor executable projects with .NET file-based apps owned by repository skills
• expand read-assembly-store to invoke its bundled app directly
• add an extract-android-assemblies skill for customer APK/AAB investigation and decompilation preparation
• remove the obsolete legacy reader project, launch wrappers, and solution entries while retaining the shared compatibility parser
• build both file apps in CI

Stack

This PR is stacked on #12104, which provides the shared v1/v2/v3 and LZ4/Zstd compatibility layer. Review this PR as the single commit on top of that branch. It can be retargeted to main after #12104 merges.

File apps

dotnet run --file .github/skills/read-assembly-store/scripts/read-assembly-store.cs -- <input>

dotnet run --file .github/skills/extract-android-assemblies/scripts/extract-android-assemblies.cs -- --output <directory> <input>

The extractor handles:

• APK, AAB, raw store, manifest, store base-name, and DLL inputs
• legacy and current assembly stores
• raw, ELF payload, and _assembly_store wrappers
• historical and current individually packaged assemblies
• LZ4 and Zstd compression
• multiple ABIs and satellite assemblies

Customer inputs remain local. Extraction rejects path traversal, output-name collisions, and overwrites.

Validation

• both skills pass skill-creator validation and package successfully
• both file apps build and run through their CI commands
• shared parser builds for .NET 10 and .NET 11
• 10 assembly-store compatibility tests pass
• byte-for-byte extraction exercised for:
  • current store APKs
  • standalone stores
  • ELF-wrapped individual assemblies
  • current and historical satellite names
  • modern loose individual assemblies

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.

[jonathanpeppers]

/review

[github-actions]

✅ Android PR Reviewer completed successfully!

[github-actions]

Code Review — ⚠️ Needs minor changes

Reviewed the top commit ([tools] Replace APK utilities with skill file apps) on top of the stacked base #12104. The refactor cleanly consolidates the standalone reader/decompressor executables into two skill-owned dotnet run --file apps plus a shared AssemblyStorePayload helper, and wires both apps into Windows CI via --help smoke runs. The path-traversal guard (GetSafeOutputFile), overwrite refusal, and unique-output checks are good defensive touches.

Findings

• ⚠️ 2 error-handling issues (inline): InvalidDataException from the path-traversal guard is not in Main’s catch list in the extractor, and ParseArchList throws an uncaught InvalidOperationException on bad --arch input in the reader. Both surface as stack traces instead of clean messages.
• 💡 1 cleanup: empty unused ShowHelp () in the reader.

None are blockers, but the two error-handling items are worth addressing so malformed input/malicious archives fail gracefully.

Notes

• CI status is currently pending (checks not yet reported) — verify the two new file-app build steps go green before merge.
• Reviewed as the single commit atop #12104 per the PR description; retarget to main once #12104 lands.

Automated review; verify suggestions against full context.

Generated by Android PR Reviewer for #12108 · 106.2 AIC · ⌖ 18.8 AIC · ⊞ 6.8K
_{Comment /review to run again}

[jonathanpeppers]

Otherwise this looks good. 👍

[jonathanpeppers]

/review

[github-actions]

✅ Android PR Reviewer completed successfully!

[github-actions]

🤖 Android PR Review — ⚠️ Minor suggestions (no blocking issues)

Reviewed as the single commit stacked on #12104: replacing the tools/assembly-store-reader* / decompress-assemblies executables with two dotnet run --file skill apps and moving the shared AssemblyStore parser + tests under .github/skills/read-assembly-store/.

Verdict

No bugs or correctness issues found. This is a clean, well-executed refactor. Two 💡 non-blocking suggestions posted inline.

Positive callouts

• Path-traversal defense is solid. GetSafeOutputFile normalizes with Path.GetFullPath + Path.GetRelativePath and rejects rooted / ..-escaping paths, and writes use FileMode.CreateNew to refuse overwrites — good defense-in-depth for untrusted customer packages. HaveUniqueOutputs also prevents output-name collisions up front.
• Improved arch parsing. TryParseArchList now validates against the supported set and returns a graceful error instead of the old ParseArchList throwing an uncaught InvalidOperationException.
• New AssemblyStorePayload.TryExtractELFPayload validates stream capabilities, guards offset/size > Int64.MaxValue, pools its copy buffer via ArrayPool, and restores stream position on the not-ELF path.
• Relative #:project paths verified correct for both file apps, and CI now smoke-builds both via dotnet run --file ... -- --help.

CI

Status is currently pending / no checks reported for 197d0cb. Not mergeable until the dotnet-android pipeline reports green — please confirm the two new "Build ... file app" steps and AssemblyStore.Tests pass.

Notes

• This PR is stacked on #12104 and should be retargeted to main after that merges, per the description.

Prioritized: bugs > safety > performance > tests > duplication > consistency > docs. Suggestions are optional.

Generated by Android PR Reviewer for #12108 · 148.4 AIC · ⌖ 18.8 AIC · ⊞ 6.8K
_{Comment /review to run again}