feat(release): add a dev channel and ship a .sha256 with every release - #186
Merged
Conversation
Two additions to the shared packaging workflow, both driven by wanting to install work from development without shipping it to everyone. A `channel` input, defaulting to beta, so all seventeen existing callers behave exactly as before. With `channel: dev` the job packages the same way but publishes a GitHub prerelease only and skips the app store upload, which is the entire distinction between the two. The channel goes into the prerelease identifier (0.5.71-dev.20260806…), so a dev build sorts below the beta of the same patch and its origin is obvious in a version list. Sharing one packaging path is deliberate. The rsync excludes, the vendor verification and the version injection into the packaged info.xml are the parts that must not drift between channels, because a dev build that is packaged differently from a beta build tests the wrong thing. Every release now also carries a .tar.gz.sha256 sibling. The App Versions app looks for one next to the archive and verifies against it; without it the installer falls back to trusting whatever it downloaded the first time. No Conduction app published one until now. It holds the bare digest rather than the "digest filename" line sha256sum prints, because the archive is renamed on upload and the line would name the build file instead of the asset.
This was referenced Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lets work on
developmentbe installed without shipping it to everyone.channelinput, defaultbetaAll 17 existing callers keep their exact behaviour — the input is additive with a
betadefault. Withchannel: devthe job packages identically but publishes a GitHub prerelease only and skips the app-store upload, which is the whole distinction between the channels.The channel goes into the prerelease identifier (
0.5.71-dev.20260806…), so a dev build sorts below the beta of the same patch and its origin is obvious in a version list.Sharing one packaging path is deliberate: the rsync excludes, vendor verification and version injection into the packaged
info.xmlare exactly the parts that must not drift, because a dev build packaged differently from a beta build tests the wrong thing..sha256on every releaseThe App Versions app looks for a
.tar.gz.sha256sibling and verifies against it; without one it falls back to trust-on-first-use. No Conduction app published one until now.It holds the bare digest rather than the
digest filenamelinesha256sumprints, because the archive is renamed on upload and that line would name the build file instead of the asset.Why
App Versions reads a repo's releases straight from the forge API (
/repos/{owner}/{repo}/releases) and installs from the.tar.gz. Its trusted-source allowlist already defaults togithub:ConductionNL/*. So a prerelease is all that's needed to make a development build installable — the mechanism was already there, the artifact was not.