use apksigner instead of signingConfig in build.gradle

build.gradle

// See https://developer.android.com/studio/publish/app-signing#secure-shared-keystore
def keystorePropertiesFile = rootProject.file("keystore.properties")
def keystoreProperties
def signedReleases = keystorePropertiesFile.exists()

if (signedReleases) {
    println("Using ${keystorePropertiesFile} for release signingConfig...")
    keystoreProperties = new Properties()
    keystoreProperties.load(new FileInputStream(keystorePropertiesFile))
}

android {
    signingConfigs {
        debug {
            // ...
        }
        if (signedReleases) {
            release {
                // NB: use values from keystore.properties
                storeFile file(keystoreProperties["storeFile"])
                storePassword keystoreProperties["storePassword"]
                keyAlias keystoreProperties["keyAlias"]
                keyPassword keystoreProperties["keyPassword"]
            }
        }
    }
    buildTypes {
        debug {
            // ...
        }
        release {
            // NB: make sure not to enable it here!
            // signingConfig signingConfigs.release
        }
    }

    if (signedReleases) {
        applicationVariants.all { variant ->
            if (variant.name == "release") {
                if (variant.signingConfig != null) {
                    throw new Exception("release signingConfig must not be enabled")
                }
                variant.outputs.each { output ->
                    output.outputFileName = output.outputFileName.replace("-unsigned", "")
                    variant.packageApplicationProvider.get().doLast {
                        // NB: use the existing release signingConfig w/ apksigner instead
                        def sc = signingConfigs.release
                        def tools = "${android.sdkDirectory}/build-tools/${android.buildToolsVersion}"
                        println("Signing ${output.outputFile} with apksigner...")
                        exec {
                            environment "KS_PASS", sc.storePassword
                            environment "KEY_PASS", sc.keyPassword
                            commandLine(
                                "${tools}/apksigner", "sign", "-v",
                                "--ks", sc.storeFile,
                                "--ks-pass", "env:KS_PASS",
                                "--ks-key-alias", sc.keyAlias,
                                "--key-pass", "env:KEY_PASS",
                                output.outputFile
                            )
                        }
                    }
                }
            }
        }
    }
}

keystore.properties

# NB: make sure not to commit a real keystore.properties to git!
storeFile=../../dummy-ks
storePassword=dummy-password
keyAlias=dummy
keyPassword=dummy-password