Skip to content

feat(release): ship a .sha256 with releases from release.yml too #193

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rubenvdlinde merged 1 commit into from
Aug 6, 2026
+24 −0
Merged

feat(release): ship a .sha256 with releases from release.yml too #193

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -331,12 +331,24 @@ jobs:
run: |
openssl dgst -sha512 -sign signing-key.key nextcloud-release.tar.gz | openssl base64 -out nextcloud-release.signature

# Sibling digest for installers that fetch the archive over plain HTTPS
# rather than through the app store. The App Versions app looks for a
# .sha256 next to the .tar.gz and verifies against it; without one it
# falls back to trusting whatever it downloaded the first time. The
# file holds the bare digest, because the archive is renamed on upload
# and a "digest filename" line would name the wrong file.
- name: Compute SHA-256 of tarball
run: |
sha256sum nextcloud-release.tar.gz | cut -d' ' -f1 > nextcloud-release.tar.gz.sha256
echo "SHA-256: $(cat nextcloud-release.tar.gz.sha256)"

- name: Upload tarball as artifact
uses: actions/upload-artifact@v4
with:
name: ${{ inputs.release-type }}-${{ inputs.app-name }}-${{ env.NEW_VERSION }}
path: |
nextcloud-release.tar.gz
nextcloud-release.tar.gz.sha256
nextcloud-release.signature
retention-days: ${{ inputs.release-type == 'stable' && 90 || (inputs.release-type == 'beta' && 30 || 7) }}

Expand All @@ -358,6 +370,18 @@ jobs:
tag: v${{ env.NEW_VERSION }}
overwrite: true

# Named to sit beside the tarball: <app>-<version>.tar.gz.sha256. The
# installer derives this name from the archive's own URL, so the suffix
# follows the renamed asset rather than the build file.
- name: Attach SHA-256 to release
uses: svenstaro/upload-release-action@v2
with:
repo_token: ${{ github.token }}
file: nextcloud-release.tar.gz.sha256
asset_name: ${{ inputs.app-name }}-${{ env.NEW_VERSION }}.tar.gz.sha256
tag: v${{ env.NEW_VERSION }}
overwrite: true

# ── App Store upload (beta and stable only) ──

- name: Register and upload to Nextcloud App Store
Expand Down
Loading