ci: run checks on push to master, schedule CodeQL

The check workflow only triggered on pull requests, so direct pushes to
master were never built or tested. Trigger it on push to master as well
and rename it to CI. Run CodeQL weekly instead of manual-only.

Remove draft_new_release.yml, which is built around upstream's develop
and release-X.Y branch model, and upstream's encrypted signing keystore
and properties, which only upstream can decrypt. Release signing needs
a keystore of our own before deploy_github_releases.yml can run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

5 files changed, 6 insertions, 91 deletions

diff --git a/.github/workflows/codeql_analysis.yml b/.github/workflows/codeql_analysis.yml
index 61e11fdd..8928d64e 100644
--- a/.github/workflows/codeql_analysis.yml
+++ b/.github/workflows/codeql_analysis.yml
@@ -2,12 +2,8 @@ name: "CodeQL"
 
 on:
   workflow_dispatch:
-  # push:
-    # branches:
-      # - master
-  # pull_request:
-    # branches:
-      # - master
+  schedule:
+    - cron: '0 6 * * 1'
 
 env:
   SENTRY_DSN: 'https://public_key@example.com/project_id'
diff --git a/.github/workflows/draft_new_release.yml b/.github/workflows/draft_new_release.yml
deleted file mode 100644
index 6d358497..00000000
--- a/.github/workflows/draft_new_release.yml
+++ /dev/null
@@ -1,84 +0,0 @@
-name: Draft new release
-
-on:
-  milestone:
-    types: [closed]
-
-jobs:
-  draft-new-release:
-    name: Draft a new release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Extract version from milestone
-        shell: bash
-        run: |
-          VERSION="${{ github.event.milestone.title }}"
-          RELEASE_VERSION="${VERSION/v/}"
-          # Transforms 1.13.2 to 1.13 so that we can re-use the same
-          # branch for patch releases.
-          BRANCH_VERSION="${RELEASE_VERSION:$i:-2}"
-          if [[ "${RELEASE_VERSION: -1}" == "0" ]]; then
-            CHECKOUT_REF="develop"
-          else
-            CHECKOUT_REF="release-${BRANCH_VERSION}"
-          fi
-
-          # Export variables separately so the scripting above is more legible,
-          # and we can actually use them within this block. Changes to $GITHUB_ENV
-          # only affect the next step, not the current one.
-          echo "RELEASE_VERSION=${RELEASE_VERSION}" >> $GITHUB_ENV
-          echo "CHECKOUT_REF=${CHECKOUT_REF}" >> $GITHUB_ENV
-          echo "BRANCH_VERSION=${BRANCH_VERSION}" >> $GITHUB_ENV
-          echo "PR_BASE=release-${BRANCH_VERSION}" >> $GITHUB_ENV
-          echo "PR_HEAD=release-prep" >> $GITHUB_ENV
-
-      - name: Setup build environment
-        uses: android-password-store/android-password-store/.github/reusable-workflows/setup-gradle@develop
-        with:
-          ref: ${{ env.CHECKOUT_REF }}
-
-      - name: Update changelog
-        uses: thomaseizinger/keep-a-changelog-new-release@f62c3c390716df5af712ba5d94f4f4a8efc1306d # 3.1.0
-        with:
-          version: ${{ github.event.milestone.title }}
-
-      - name: Initialize git config and commit changes
-        shell: bash
-        run: |
-          # Configure name and email for Actions user
-          git config user.name "GitHub Actions"
-          git config user.email noreply@github.com
-
-          # It is necessary to create the $PR_BASE branch if it doesn't
-          # already exist because we want to start a PR against it.
-          if [[ "${CHECKOUT_REF}" == "develop" ]]; then
-            git branch -c develop "${PR_BASE}"
-            git push origin "${PR_BASE}"
-          fi
-
-          # Stage and commit changes to the changelog
-          git add CHANGELOG.md
-          git commit -m "CHANGELOG: bump for ${{ github.event.milestone.title }}"
-
-          # Increment the version as necessary. If we checked out develop it means
-          # that the version number is already correct, and we only need to drop the
-          # -SNAPSHOT suffix.
-          if [[ "${CHECKOUT_REF}" == "develop" ]]; then
-            ./gradlew --no-daemon clearPreRelease
-          else
-            ./gradlew --no-daemon bumpPatch
-          fi
-
-          # Commit changes to the versioning
-          git add **/version.properties
-          git commit -m "build: bump version"
-
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
-        with:
-          author: GitHub Actions <noreply@github.com>
-          body: This is an automated pull request to bump the changelog for the ${{ github.event.milestone.title }} release.
-          base: ${{ env.PR_BASE }}
-          branch: ${{ env.PR_HEAD }}
-          title: Release v${{ env.RELEASE_VERSION }}
-          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 1522b1d4..b61a5320 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -1,8 +1,11 @@
 on:
+  push:
+    branches:
+      - master
   pull_request:
   merge_group:
 
-name: Check pull request
+name: CI
 
 concurrency:
   group: ${{ github.head_ref || github.ref_name }}
diff --git a/secrets/keystore.cipher b/secrets/keystore.cipher
deleted file mode 100644
index 900e3685..00000000
--- a/secrets/keystore.cipher
+++ /dev/null
diff --git a/secrets/props.cipher b/secrets/props.cipher
deleted file mode 100644
index 4ea92b1b..00000000
--- a/secrets/props.cipher
+++ /dev/null