Merge pull request #136 from beNative/codex/fix-auto-update-checksum-mismatch-ocm9i3

Fix release automation to publish verified update manifests

Author: beNative

.github/workflows/release.yml

@@ -236,6 +236,9 @@ jobs:
         with:
           node-version: 20
 
+      - name: Install dependencies
+        run: npm ci
+
       - name: Generate release notes
         id: notes
         run: |
@@ -253,6 +256,37 @@ jobs:
         env:
           GITHUB_REPOSITORY: ${{ github.repository }}
 
+      - name: Verify auto-update manifests
+        run: |
+          set -euo pipefail
+          metadata_dirs=()
+          while IFS= read -r -d '' metadata_file; do
+            dir=$(dirname "$metadata_file")
+            if [[ "$metadata_file" == *"/builder-debug.yml" ]]; then
+              continue
+            fi
+            skip=0
+            for existing in "${metadata_dirs[@]}"; do
+              if [[ "$existing" == "$dir" ]]; then
+                skip=1
+                break
+              fi
+            done
+            if [[ $skip -eq 0 ]]; then
+              metadata_dirs+=("$dir")
+            fi
+          done < <(find release-artifacts -type f -name '*.yml' -print0)
+
+          if [[ ${#metadata_dirs[@]} -eq 0 ]]; then
+            echo "::error::No auto-update metadata (.yml) files were found in the release artifacts." >&2
+            exit 1
+          fi
+
+          for dir in "${metadata_dirs[@]}"; do
+            echo "Verifying auto-update metadata in ${dir}" >&2
+            node scripts/test-auto-update.mjs --local "$dir"
+          done
+
       - name: Display release notes
         run: |
           echo "Generated release notes:" >&2

scripts/generate-release-notes.mjs

@@ -118,6 +118,9 @@ function isReleaseAsset(filename) {
 }
 
 function isAutoUpdateSupportFile(filename) {
+  if (filename === 'builder-debug.yml') {
+    return false;
+  }
   if (filename.endsWith('.blockmap')) {
     return true;
   }
@@ -156,13 +159,28 @@ async function normaliseReleaseAsset(filePath) {
   const fileName = path.basename(filePath);
   const normalisedName = normaliseInstallerFileName(fileName);
   if (normalisedName === fileName) {
-    return { filePath, fileName };
+    return { filePath, fileName, originalFileName: fileName };
   }
 
   const targetPath = path.join(path.dirname(filePath), normalisedName);
   await fs.rename(filePath, targetPath);
   console.log(`Normalised release asset name: ${fileName} -> ${normalisedName}`);
-  return { filePath: targetPath, fileName: normalisedName };
+  return { filePath: targetPath, fileName: normalisedName, originalFileName: fileName };
+}
+
+async function computeSha512(filePath) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha512');
+    const stream = createReadStream(filePath);
+    stream.on('data', (chunk) => hash.update(chunk));
+    stream.on('error', reject);
+    stream.on('end', () => resolve(hash.digest('base64')));
+  });
+}
+
+async function getFileSize(filePath) {
+  const stats = await fs.stat(filePath);
+  return stats.size;
 }
 
 async function computeSha512(filePath) {
@@ -198,7 +216,7 @@ async function collectAssets(artifactRoot) {
     const arch = normaliseArch(parts.slice(1).join('-') || parts[0]);
     const files = await walkFiles(path.join(artifactRoot, dirName));
     for (const file of files) {
-      const { filePath: normalisedPath, fileName: normalisedName } = await normaliseReleaseAsset(file);
+      const { filePath: normalisedPath, fileName: normalisedName, originalFileName } = await normaliseReleaseAsset(file);
       const fileName = normalisedName;
       const filePath = normalisedPath;
       if (isAutoUpdateSupportFile(fileName)) {
@@ -220,6 +238,7 @@ async function collectAssets(artifactRoot) {
         arch,
         fileName,
         filePath,
+        originalFileName,
         format: detectFormat(fileName),
         sha512,
         size,

scripts/test-auto-update.mjs

@@ -413,7 +413,9 @@ async function runRemoteCheck({ owner, repo, tag, skipHttp, skipDownload }) {
 async function runLocalCheck({ directory, skipDownload }) {
   const resolvedDirectory = path.resolve(directory);
   const entries = await fs.readdir(resolvedDirectory);
-  const metadataFiles = entries.filter((entry) => entry.endsWith('.yml'));
+  const metadataFiles = entries.filter(
+    (entry) => entry.endsWith('.yml') && entry !== 'builder-debug.yml',
+  );
   if (metadataFiles.length === 0) {
     throw new Error(`No metadata files were found in ${resolvedDirectory}`);
   }