Fix release workflows silently skipping version pin updates

.cursor/rules/rc-release-pipeline.mdc

@@ -46,6 +46,19 @@ A healthy RC PR has all of these green before promotion:
 
 This is a plugin-level tightening of the contract in `appsflyer-mobile-plugin-tooling/contracts/rc-release-contract.md`, which only requires E2E as the publish gate. Adding `Lint, Test & Build` to the gate is allowed (stricter than the contract floor).
 
+## Native version inputs
+
+Since SDK 7 the plugin pins the RPC layer, not the native Android SDK:
+
+| Version | How it is set |
+|---------|---------------|
+| `af-android-plugin-bridge` | `android_bridge_version` input (empty = leave pin unchanged) |
+| Android AppsFlyer SDK | **Derived** — [`scripts/resolve-android-sdk-version.sh`](../../scripts/resolve-android-sdk-version.sh) reads it from the bridge POM. There is no `android_sdk_version` input. |
+| `AppsFlyerRPC` | Pinned in `ios/appsflyer_sdk.podspec`, read back for reporting |
+| iOS `AppsFlyerFramework` | `ios_sdk_version` input; must match what the pinned `AppsFlyerRPC` requires |
+
+Do not reintroduce a hand-entered input for a transitively resolved version — see the `RC-PREP` required-inputs rule in the contract. Every version rewrite must fail loudly when its pattern does not match, so a renamed dependency cannot turn a `sed` into a silent no-op.
+
 ## When smoke runs vs when it doesn't
 
 - **Auto** after RC-release succeeds with `dry_run=false`.

.github/workflows/production-release.yml

@@ -372,8 +372,13 @@ jobs:
         run: |
           VERSION="${{ needs.validate-release.outputs.version }}"
 
-          # Get SDK versions from files
-          ANDROID_SDK_VERSION=$(grep "implementation 'com.appsflyer:af-android-sdk:" android/build.gradle | sed -n "s/.*af-android-sdk:\([^']*\).*/\1/p" | head -1)
+          # Android has no local pin to read — it resolves through the bridge
+          # POM. This step runs after the publish, so a failed lookup must not
+          # leave a shipped version without a GitHub release.
+          ANDROID_SDK_VERSION=$(bash scripts/resolve-android-sdk-version.sh) || {
+            echo "::warning::Could not resolve the Android SDK version from the bridge POM; release notes will say unknown"
+            ANDROID_SDK_VERSION="unknown"
+          }
           IOS_SDK_VERSION=$(grep "s.ios.dependency 'AppsFlyerFramework'" ios/appsflyer_sdk.podspec | sed -n "s/.*AppsFlyerFramework',.*'\([^']*\)'.*/\1/p" | head -1)
 
           # Create enhanced release notes
@@ -476,8 +481,13 @@ jobs:
         run: |
           VERSION="${{ needs.validate-release.outputs.version }}"
 
-          # Extract Android SDK version
-          ANDROID_SDK_VERSION=$(grep "implementation 'com.appsflyer:af-android-sdk:" android/build.gradle | sed -n "s/.*af-android-sdk:\([^']*\).*/\1/p" | head -1)
+          # Android has no local pin to read — it resolves through the bridge
+          # POM. This job runs after the publish and only feeds a notification,
+          # so a failed lookup must not fail the release.
+          ANDROID_SDK_VERSION=$(bash scripts/resolve-android-sdk-version.sh) || {
+            echo "::warning::Could not resolve the Android SDK version from the bridge POM; reporting it as unknown"
+            ANDROID_SDK_VERSION="unknown"
+          }
           echo "android_sdk=$ANDROID_SDK_VERSION" >> $GITHUB_OUTPUT
 
           # Extract iOS SDK version from podspec