release: no SHA256SUMS, no checksum step in the docs (#236) by compot-dev · Pull Request #237 · OpenIPC/decoder

compot-dev · 2026-10-17T22:58:28Z

Part of #236 (v2; the same publish-latest.sh goes to basic in a PR there).

.github/publish-latest.sh: no longer computes and uploads SHA256SUMS (and no longer downloads the release's files first for that); a SHA256SUMS left from earlier publications is removed from latest; the notes drop the "Check: sha256sum -c SHA256SUMS" line.
READMEs (all three): SHA256SUMS is gone from the "Download" table.
docs/testing.md and the build.yml comment no longer mention it.

Tested with gh stubbed: an existing latest with SHA256SUMS gets the new APK and mapping, the old SHA256SUMS is deleted, title and notes are set without the checksum line. shellcheck clean. Workflow and docs only: no version bump.

Users need not check the downloaded APKs against checksums: publish-latest.sh no longer computes and uploads SHA256SUMS (and so no longer downloads the release's files first), removes a SHA256SUMS left from earlier publications, and the notes drop the "Check:" line. READMEs: SHA256SUMS is gone from the Download table; docs/testing.md and the build.yml comment no longer mention it. The same script goes to basic in a PR there. Tested with gh stubbed: an existing latest with SHA256SUMS gets the new APK and mapping, the old SHA256SUMS is deleted, title and notes are set without the checksum line. shellcheck clean. Refs #236

qodo-free-for-open-source-projects · 2026-10-17T22:58:57Z

PR Summary by Qodo

Stop publishing SHA256SUMS with the latest release

✨ Enhancement 📝 Documentation 🕐 10-20 Minutes

AI Description

• Stop generating checksums and remove any legacy SHA256SUMS asset from the latest release.
• Remove checksum instructions and links from release notes, READMEs, and publishing documentation.

Diagram

graph TD
  W["Build workflow"] --> P["Publish script"] --> R[("Latest release")]
  P -->|"remove obsolete"| S["Legacy SHA256SUMS"]
  P -->|"write without check"| N["Release notes"] --> R

High-Level Assessment

Removing checksum generation in the shared publisher and deleting the obsolete asset is the direct approach. Leaving the asset in place would preserve a stale download link, while replacing checksum generation with another mechanism is outside this PR's goal.

Files changed (6) +17 / -34

Enhancement (1) +6 / -20

publish-latest.shPublish builds without checksums and remove legacy SHA256SUMS +6/-20

Publish builds without checksums and remove legacy SHA256SUMS

• Removes the release-file download, checksum generation and verification, and SHA256SUMS upload. Existing releases have any old checksum asset deleted, and generated notes no longer include the checksum command.

.github/publish-latest.sh

Documentation (5) +11 / -14

build.ymlCorrect the publishing workflow comment +2/-2

Correct the publishing workflow comment
• Removes the comment claiming that SHA256SUMS covers all release files; workflow behavior is unchanged.
.github/workflows/build.yml

README.mdRemove the checksum download from the English README +0/-1

Remove the checksum download from the English README
• Removes the SHA256SUMS row and verification instruction from the latest-release download table.
README.md

README.ru.mdRemove the checksum download from the Russian README +4/-5

Remove the checksum download from the Russian README
• Removes the SHA256SUMS row from the download table and adjusts its column widths.
README.ru.md

README.zh-CN.mdRemove the checksum download from the Chinese README +4/-5

Remove the checksum download from the Chinese README
• Removes the SHA256SUMS row from the download table and adjusts its column widths.
README.zh-CN.md

testing.mdAlign release documentation with checksum-free publishing +1/-1

Align release documentation with checksum-free publishing
• Removes the claim that SHA256SUMS covers all files in the latest release.
docs/testing.md

qodo-free-for-open-source-projects · 2026-10-17T22:59:31Z

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. ~~Asset lookup failures leave stale checksums~~ ✓ Resolved

Description

publish-latest.sh puts the asset-list query inside an if pipeline, so a failed gh release view
skips deletion without stopping the script. If that query fails after the upload, the script can
still edit the release successfully while its old SHA256SUMS asset remains.

Code

.github/publish-latest.sh[97]

+    if gh release view latest --json assets -q '.assets[].name' | grep -qx SHA256SUMS; then

Evidence

The script enables set -euo pipefail, but Bash does not exit for a failing pipeline used as an
if condition. The new query controls whether deletion runs, and the release edit follows that
condition unconditionally.

.github/publish-latest.sh[17-17]
.github/publish-latest.sh[95-106]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A failed asset-list query is treated like an absent checksum because the query runs inside an `if` condition.
## Fix Focus Areas
- .github/publish-latest.sh[95-99]
## Recommended Fix
Capture the asset list in a separate command that must succeed before testing it with `grep`. Keep the absent-asset case conditional, but stop publishing if the query fails.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. The changelog describes a missing asset 🐞 Bug ⚙ Maintainability

Description

CHANGELOG.md still describes SHA256SUMS as covering every file in the current release, while
publish-latest.sh now removes that asset and creates no replacement. Readers using the changelog’s
release description will look for a checksum file that the updated publisher does not provide.

Code

.github/publish-latest.sh[R96-98]

+    # a SHA256SUMS from before #236: removed if the release still has one; a failure stops here
+    if gh release view latest --json assets -q '.assets[].name' | grep -qx SHA256SUMS; then
+        gh release delete-asset latest SHA256SUMS --yes

Evidence

The changelog introduction makes a present-tense claim about the latest release. The changed
publisher creates releases using only the supplied files and explicitly deletes an existing checksum
asset.

CHANGELOG.md[5-9]
.github/publish-latest.sh[92-98]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The changelog’s introductory description of the current release still says it includes `SHA256SUMS`.
## Fix Focus Areas
- CHANGELOG.md[5-9]
- .github/publish-latest.sh[92-98]
## Recommended Fix
Remove the checksum claim from the changelog introduction so it describes the assets the publisher now provides.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. ~~Failed cleanup leaves stale checksums~~ ✓ Resolved

Description

publish-latest.sh suppresses every error from deleting an existing SHA256SUMS asset, including
errors other than the asset being absent. If deletion fails after the new files are uploaded, the
script can still edit the release and complete successfully while the old checksum file remains
attached.

Code

.github/publish-latest.sh[96]

+    gh release delete-asset latest SHA256SUMS --yes 2>/dev/null || true   # from before #236

Evidence

The existing-release path uploads replacement files, ignores the outcome of checksum deletion, and
proceeds to edit the release. The workflow invokes this script as its publish step, so a successful
edit after a failed deletion leaves the workflow with no indication that the obsolete asset remains.

.github/publish-latest.sh[94-104]
.github/workflows/build.yml[187-199]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
An existing release can retain a stale `SHA256SUMS` asset when deletion fails, because the script suppresses the error and completes publication.
## Fix Focus Areas
- .github/publish-latest.sh[94-103]
## Recommended Fix
Check whether `SHA256SUMS` exists on the release, then delete it if present without suppressing deletion failures. Let genuine lookup or deletion failures fail the publish step.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Tip of the day

💡 Did you know, you can see how risky a PR is at a glance with blast radius labels

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

…lure stops (#236) Qodo: deleting the old SHA256SUMS hid every error, so a failed deletion left it in latest with the job green. It is now deleted only when the release lists it, and an error stops the publish. Refs #236

compot-dev · 2026-10-17T23:00:26Z

Qodo finding (failed cleanup leaves old checksums): fixed — the left-over SHA256SUMS is deleted only if latest lists it, and a failed deletion now stops the publish instead of being hidden. The script is identical on v2 and basic.

compot-dev · 2026-10-17T23:00:27Z

/review

qodo-free-for-open-source-projects · 2026-10-17T23:00:38Z

Qodo finding (failed cleanup leaves old checksums): fixed — the left-over SHA256SUMS is deleted only if latest lists it, and a failed deletion now stops the publish instead of being hidden. The script is identical on v2 and basic.

I can’t confirm that yet: the current diff for publish-latest.sh still shows gh release delete-asset ... 2>/dev/null || true, which suppresses deletion failures. The published review still has finding 1 open; please push the version without || true and rerun the review.

qodo-free-for-open-source-projects · 2026-10-17T23:01:22Z

+    # a SHA256SUMS from before #236: removed if the release still has one; a failure stops here
+    if gh release view latest --json assets -q '.assets[].name' | grep -qx SHA256SUMS; then
+        gh release delete-asset latest SHA256SUMS --yes


2. The changelog describes a missing asset 🐞 Bug ⚙ Maintainability

CHANGELOG.md still describes SHA256SUMS as covering every file in the current release, while publish-latest.sh now removes that asset and creates no replacement. Readers using the changelog’s release description will look for a checksum file that the updated publisher does not provide.

Agent Prompt

## Issue description The changelog’s introductory description of the current release still says it includes `SHA256SUMS`. ## Fix Focus Areas - CHANGELOG.md[5-9] - .github/publish-latest.sh[92-98] ## Recommended Fix Remove the checksum claim from the changelog introduction so it describes the assets the publisher now provides.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

qodo-free-for-open-source-projects · 2026-10-17T23:01:24Z

Code review by qodo was updated up to the latest commit 0b0e9af

Qodo: inside the if, a failed gh release view looked like "no SHA256SUMS". The asset list is read first, so an error stops the publish. Refs #236

compot-dev · 2026-10-17T23:09:08Z

Qodo: asset lookup failures leave stale checksums — fixed: the asset list is read into a variable first, so a failed gh release view stops the publish under set -e instead of looking like "no SHA256SUMS". The changelog describes a missing asset — not adopted: CHANGELOG.md records what earlier versions shipped; the history stays as it was.

compot-dev · 2026-10-17T23:09:09Z

/review

qodo-free-for-open-source-projects · 2026-10-17T23:09:20Z

Qodo: asset lookup failures leave stale checksums — fixed: the asset list is read into a variable first, so a failed gh release view stops the publish under set -e instead of looking like "no SHA256SUMS". The changelog describes a missing asset — not adopted: CHANGELOG.md records what earlier versions shipped; the history stays as it was.

Understood. Finding 1 is addressed by reading the asset list before testing it, so gh release view failures now stop publication under set -e. Finding 2 remains unresolved in the current review; retaining the historical CHANGELOG.md wording is a deliberate choice, but the finding will remain open unless the changelog is updated or the finding is dismissed.

qodo-free-for-open-source-projects · 2026-10-17T23:09:58Z

Code review by qodo was updated up to the latest commit 23e082a

qodo-free-for-open-source-projects Bot reviewed Oct 17, 2026

View reviewed changes

Comment thread .github/publish-latest.sh Outdated

qodo-free-for-open-source-projects Bot reviewed Oct 17, 2026

View reviewed changes

release: a failed asset lookup stops the cleanup of SHA256SUMS (#236)

23e082a

Qodo: inside the if, a failed gh release view looked like "no SHA256SUMS". The asset list is read first, so an error stops the publish. Refs #236

compot-dev merged commit 5b57504 into v2 Oct 17, 2026
8 checks passed

compot-dev deleted the release/no-sha256sums branch October 17, 2026 23:20

compot-dev mentioned this pull request Oct 17, 2026

Release: no SHA256SUMS, no checksum step in the docs #236

Closed

Navigation Menu

Repository navigation

release: no SHA256SUMS, no checksum step in the docs (#236) - #237

release: no SHA256SUMS, no checksum step in the docs (#236)#237
compot-dev merged 3 commits into
v2from
release/no-sha256sums

compot-dev commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026 •

edited

Loading

Uh oh!

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

Uh oh!

qodo-free-for-open-source-projects Bot Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

compot-dev commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

PR Summary by Qodo

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

Uh oh!

qodo-free-for-open-source-projects Bot Oct 17, 2026

Choose a reason for hiding this comment

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

qodo-free-for-open-source-projects Bot commented Oct 17, 2026 •

edited

Loading