Install and self-update via GitHub Releases

[maxBRT]

Summary

Adds the cross-platform install/update path for Ship: GoReleaser publishes multi-platform archives with embedded version on v* tags, ship update downloads/verifies/replaces the running binary via an Updater port, and install.sh installs checksum-verified release assets into a user PATH bin. README now leads with curl install and ship update so users do not need Go for the primary path.

Linked issues

• Release pipeline: GoReleaser publishes multi-platform binaries with embedded version #59: Release pipeline: GoReleaser publishes multi-platform binaries with embedded version
• ship update: Updater port downloads, verifies, and replaces the running binary #61: ship update: Updater port downloads, verifies, and replaces the running binary
• Curl install script: detect platform, verify checksums, install ship to PATH #62: Curl install script: detect platform, verify checksums, install ship to PATH
• Docs: README leads with curl install and ship update #63: Docs: README leads with curl install and ship update

RISK

• First real v* tag is the live integration test. GoReleaser defaults (ship-cli_${version}_${os}_${arch}.tar.gz + ship-cli_${version}_checksums.txt) are hardcoded in both install.sh and internal/update. If archive or checksum naming diverges from those defaults, curl install and ship update both fail for every user until a follow-up ships. Likelihood: medium on first release if config drifts; low afterward if CI goreleaser check stays green.
• Broken or incomplete GitHub Release assets break new installs and updates. Missing platform archive, wrong checksums file, or a draft/pre-release selected as latest leaves existing binaries intact for update but blocks new curl installs. Likelihood: low if the release workflow succeeds; high impact when it happens.
• Install script JSON parsing is shell/awk against the Releases API shape. Real GitHub assets nest an uploader object between name and browser_download_url; tests now mirror that. A future API shape change could make the one-liner fail to resolve assets. Likelihood: low; impact: all curl installs until fixed.
• Ticket Run behavior is intentionally unchanged, but CLI routing now special-cases update / --version. A regression in that branch would mis-route ship update into a Run or break bare ship. Likelihood: low (covered by CLI tests).

QA — stress-test plan for a human

1. Happy path

1. On a clean machine (or empty temp PATH bin), run:
   curl -fsSL https://raw.githubusercontent.com/maxBRT/ship-cli/feature/installer/install.sh | bash
   (or the PR branch raw URL / a tagged release once published). Confirm ship lands in ~/.local/bin (or a writable system bin) and ship --version prints a non-dev version after a real release build.
2. From a checkout of this branch: go test ./..., staticcheck ./..., and goreleaser check.
3. Build a local binary with a version ldflag, install it somewhere writable, then run ship update against a real or fixture Releases API and confirm it prints old → new and replaces the binary in place.
4. Run bare ship --help and confirm update/version are documented; run bare ship with Run flags in a normal project checkout and confirm a Ticket Run still starts (no accidental update path).

2. Edges / failure cases

1. Force an unsupported platform (SHIP_OS/SHIP_ARCH if using the script’s test hooks, or a fake uname) and confirm a clear unsupported-platform error, not a cryptic download failure.
2. Point the install script at a release JSON whose asset URL is http://example.com/... and confirm HTTPS rejection; confirm checksum mismatch leaves no binary installed.
3. Install into a directory not on PATH and confirm the script warns clearly.
4. For ship update: already-current release → success, no replace; non-writable binary path → permission error, binary unchanged; network / 404 / bad checksum → non-zero exit, existing binary intact.
5. On Windows (or via the published assets list), confirm amd64/arm64 .tar.gz assets exist even though the shell installer is Unix-first.

3. Out of scope

• Full Ticket Run orchestration, Agent adapters, throbber, picker, or GitHub Ticket port behavior beyond “bare ship still starts a Run.”
• Publishing a production v* tag from this PR review (do that after merge, then re-check install/update against the live Release).
• Reworking GoReleaser beyond the checked config, or adding Windows shell install.

Made with Cursor