Conversation
Merging a release PR now triggers a push run scoped to VERSION: the AppImage is built once and a publish_release job creates the GitHub Release (auto notes + assets) when the v<version> tag exists. The PR build stays skipped to avoid a duplicate run. Publishing in-run avoids relying on the release: published event, which GITHUB_TOKEN does not emit.
Stable releases are only produced by the merge-triggered push run, so remove the release: published trigger, the event-gated release_stable job, and the svenstaro upload action. The single release_stable job now publishes via softprops/action-gh-release.
Restore the release: published trigger so manually published v<version>+N releases build and attach assets via the existing flow, and add workflow_dispatch inputs (tag, publish) for manual overrides. A single release_stable job resolves the tag from the event: push uses v<VERSION> (requires the tag), release uses the published tag, and dispatch uses the optional tag input. Publishing uses softprops for create and asset upload, preserving the release body on the +1 path.
Resolve release tag now normalizes an optional 'v' prefix and fails unless the tag matches ^v<major>.<minor>.<patch>(\+<n>)?$, the same pattern used by all existing vX.Y.Z / vX.Y.Z+N release tags. Applies to the workflow_dispatch tag input and the event-derived tags.
- daily schedule detects upstream stable tags and opens release/<v> PRs; merge publishes the release with assets, no manual step - +N releases via release: published; workflow_dispatch tag/publish override with strict vX.Y.Z(+N) validation - move all release logic into bin/repo-management.sh verbs; ci.yaml is orchestration only, dropping softprops/svenstaro in favor of gh - enforce POSIX sh via shellcheck --severity=warning and add a PR-only lint job to ci.yaml - setup-env installs get-debloated-pkgs/quick-sharun when missing so local builds work - default GITHUB_REPOSITORY so local builds embed a valid UPINFO
psadi
changed the title
bundle-appimage.sh unconditionally embedded 'latest', so nightly AppImages tracked the newest stable release and never offered nightly updates. Pick the tag from the channel: 'latest' for a clean X.Y.Z VERSION (stable) and 'tip' for a snapshot version (X.Y.Z-main-+hash). Drop the dead 'tip' UPINFO from build-ghostty.sh, which ran in a separate step and was overwritten.
Add a validate-appimage verb and run it in the build job right after bundling. It asserts the embedded update info matches the expected channel tag (latest for stable X.Y.Z, tip for snapshot versions) and that the zsync SHA-1 matches the AppImage, logging both for auditing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fully automates the stable release flow and consolidates all release logic into
bin/repo-management.sh. The only manual action is merging the release PR.Flow
release/<version>PR that bumpsVERSIONand pushes thev<version>tag.**/VERSIONstays inpaths-ignore) — no duplicate run.main→ apushrun scoped toVERSION:build_appimagebuilds the stable version once,release_stablepublishes the GitHub Release (generated notes + both AppImages) if the tag exists.+Nreleases and manual overriderelease: publishedis restored: publishingv<version>+Nbuilds and uploads assets via the existing flow (preserves the release body).workflow_dispatchinputstagandpublishallow manual overrides. The tag is strictly validated against^v<major>.<minor>.<patch>(\+<n>)?$(the pattern used by all existing release tags); invalid input fails.Consolidation
All release/adhoc logic moved to
bin/repo-management.shverbs:tip-version,lint,validate-appimage,detect,validate-tag,resolve-tag,open-pr,publish,publish-tip,tag-tip.ci.yamlis orchestration only. Droppedsoftprops/action-gh-releaseandsvenstaro/upload-release-actionin favor ofgh.Lint / POSIX
--severity=warning --shell=sh, so POSIX violations (bashisms) fail the hook.lintjob inci.yaml, gated topull_request(inheritspaths-ignore, so schedule and VERSION-only PRs are excluded). Runs in parallel with the build.Local build parity / UPINFO
setup-env.shinstallsget-debloated-pkgs/quick-sharunif missing (previously only provided byanylinux-setup-action).build-ghostty.sh/bundle-appimage.shdefaultGITHUB_REPOSITORYtopkgforge-dev/ghostty-appimage, so local builds embed a validUPINFO.bundle-appimage.shpicks the update tag per channel:latestfor stable (cleanX.Y.ZinVERSION) andtipfor nightly (X.Y.Z-main-+hash). Previously nightly embeddedlatest, so it tracked stable and never offered nightly updates.Post-build validation (audit)
Validate AppImagestep in the build job runsrepo-management.sh validate-appimageafter bundling. It logs and asserts:SHA-1:matchessha1sumof the AppImage.tipbranch end-to-end, so the audit is visible in each Actions run.Validation
--appimage-updateinfoprintsgh-releases-zsync|pkgforge-dev|ghostty-appimage|latest|Ghostty-*x86_64.AppImage.zsync; zsync SHA-1 matches.validate-appimagetested positive (stable, exit 0) and negative (tipVERSIONvslatest-embedded, exit 1).actionlint,zizmor,shellcheck,shfmtpass.