In the code column — the app/build.gradle.kts release configuration. Honest note: the real Pica (a course app) leaves the release with optimization { enable = false } and no signing — fine for the course. Shown here is what you add to actually ship.

Three parts:

• Versioning. versionCode (an integer) is bumped on every upload to Play — Google rejects a repeated number. versionName is what the user sees ("1.0").
• signingConfigs. Points at the release keystore. Take passwords from environment variables (System.getenv), never write them into build.gradle.kts (it goes into git!).
• buildTypes.release. Attaches signing, enables optimization { enable = true } (R8) and points at proguard-rules.pro.

The release keystore is created once (keytool):

keytool -genkeypair -v -keystore pica-release.jks \
  -keyalg RSA -keysize 2048 -validity 10000 -alias pica

Gotcha (AGP 9). Most older examples show:

release {
    isMinifyEnabled = true       // ❌ AGP 9 — gone
    isShrinkResources = true     // ❌ AGP 9 — gone
}

AGP 9 replaced these flags with an optimization { } block:

release {
    optimization { enable = true }   // ✅ AGP 9
}

Copy an old sample and you get Unresolved reference: isMinifyEnabled. The new block is one of those things AGP 9 changed quietly.