Skip to content

release: no SHA256SUMS, no checksum step in the docs (#236) #237

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
compot-dev merged 3 commits into from
Oct 17, 2026
Merged

release: no SHA256SUMS, no checksum step in the docs (#236) #237

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d7ef65b
release: no SHA256SUMS, no checksum step in the docs (#236)
compot-dev Oct 17, 2026
0b0e9af
release: a left-over SHA256SUMS is removed only if present, and a fai…
compot-dev Oct 17, 2026
23e082a
release: a failed asset lookup stops the cleanup of SHA256SUMS (#236)
compot-dev Oct 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 10 additions & 20 deletions .github/publish-latest.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
# "Decoder <version>"; basic keeps the tag and the title;
# - the notes hold one line per branch, "Decoder <v2 version> (...)" and
# "Legacy `basic` <version> (...)"; each build rewrites its own line;
# - SHA256SUMS is computed again over all the release's files.
# - a SHA256SUMS left from earlier releases is removed (no checksums, #236).
#
# Writes new=true to $GITHUB_OUTPUT when the branch's version differs from
# the one the release had, so only a new version goes to Telegram.
Expand Down Expand Up @@ -80,34 +80,24 @@ echo "previous $branch version: ${prev:-none}, now $ver"
{
[ -z "$v2line" ] || printf '%s\n' "$v2line"
[ -z "$basicline" ] || printf '%s\n' "$basicline"
printf '\nCheck: `sha256sum -c SHA256SUMS`. Changes: [CHANGELOG.md](%s/blob/v2/CHANGELOG.md); installation: [README](%s#readme).\n' "$url" "$url"
printf '\nChanges: [CHANGELOG.md](%s/blob/v2/CHANGELOG.md); installation: [README](%s#readme).\n' "$url" "$url"
} > notes.md

# SHA256SUMS before anything changes: the other branch's files as the
# release has them now, plus this build's files; a v2 build without a
# mapping drops the previous one.
sums=$(mktemp -d)
if [ "$exists" = 1 ]; then
gh release download latest --dir "$sums" # every file the release holds
fi
rm -f "$sums/SHA256SUMS"
[ "$branch" = v2 ] && [ "$mapping" = 0 ] && rm -f "$sums/decoder-v2-mapping.txt"
cp "$@" "$sums/"
(cd "$sums" && find . -maxdepth 1 -type f -printf '%f\n' | LC_ALL=C sort | xargs sha256sum) > "$sums.sums"
mv "$sums.sums" "$sums/SHA256SUMS"
(cd "$sums" && sha256sum -c SHA256SUMS)

if [ "$exists" = 0 ]; then
# a "latest" tag left without its release would keep its old commit under --target
if [ "$branch" = v2 ]; then
gh api -X PATCH "repos/${GITHUB_REPOSITORY}/git/refs/tags/latest" -f sha="$GITHUB_SHA" -F force=true \
>/dev/null 2>&1 || true
fi
gh release create latest "$@" "$sums/SHA256SUMS" --latest --target "$GITHUB_SHA" \
gh release create latest "$@" --latest --target "$GITHUB_SHA" \
--title "$title" --notes-file notes.md
else
# this build's files and the new SHA256SUMS in one upload
gh release upload latest "$@" "$sums/SHA256SUMS" --clobber
gh release upload latest "$@" --clobber
# a SHA256SUMS from before #236: removed if the release still has one; a failure stops here
assets=$(gh release view latest --json assets -q '.assets[].name') # a lookup error stops here
if printf '%s\n' "$assets" | grep -qx SHA256SUMS; then
gh release delete-asset latest SHA256SUMS --yes
Comment on lines +96 to +99

@qodo-free-for-open-source-projects qodo-free-for-open-source-projects Bot Oct 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

2. The changelog describes a missing asset 🐞 Bug ⚙ Maintainability

CHANGELOG.md still describes SHA256SUMS as covering every file in the current release, while
publish-latest.sh now removes that asset and creates no replacement. Readers using the changelog’s
release description will look for a checksum file that the updated publisher does not provide.
Agent Prompt 
## Issue description
The changelog’s introductory description of the current release still says it includes `SHA256SUMS`.

## Fix Focus Areas
- CHANGELOG.md[5-9]
- .github/publish-latest.sh[92-98]

## Recommended Fix
Remove the checksum claim from the changelog introduction so it describes the assets the publisher now provides.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

fi
if [ "$branch" = v2 ] && [ "$mapping" = 0 ]; then
gh release delete-asset latest decoder-v2-mapping.txt --yes 2>/dev/null || true
fi
Expand All @@ -116,4 +106,4 @@ else
fi
gh release edit latest --title "$title" --notes-file notes.md --latest
fi
rm -rf "$sums" notes.md err.txt
rm -f notes.md err.txt
4 changes: 2 additions & 2 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,8 +154,8 @@ jobs:
path: ${{ steps.vars.outputs.name }}.apk

# The one release, "latest" (#194, #229): updated in place by v2 and basic, each with its
# own files; v2 moves the tag to its commit and sets the title "Decoder <version>";
# SHA256SUMS covers all files. A new version (not every build) goes to Telegram. The
# own files; v2 moves the tag to its commit and sets the title "Decoder <version>".
# A new version (not every build) goes to Telegram. The
# concurrency group is shared with basic's workflow: one publish at a time.
publish:
needs: build
Expand Down
1 change: 0 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,6 @@ Ready-to-install builds are in the one release, [**latest**](https://github.com/
|------------------|----------------------------------------|------------------------------------------------------------------------------|
| `decoder-v2.apk` | **Current version**, recommended | <https://github.com/OpenIPC/decoder/releases/latest/download/decoder-v2.apk> |
| `decoder.apk` | Legacy version from the `basic` branch | <https://github.com/OpenIPC/decoder/releases/latest/download/decoder.apk> |
| `SHA256SUMS` | Checksums: `sha256sum -c SHA256SUMS` | <https://github.com/OpenIPC/decoder/releases/latest/download/SHA256SUMS> |

Every build is replaced in `latest` by the next one. Development is continuous, so there are no releases per version; every new `v2` and `basic` version is also posted with its commit to the OpenIPC Telegram channel ([our channels](https://openipc.org/our-channels)).

Expand Down
9 changes: 4 additions & 5 deletions README.ru.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,11 +40,10 @@

Готовые сборки лежат в единственном релизе [**latest**](https://github.com/OpenIPC/decoder/releases/latest) с заголовком `Decoder <версия>`. В именах файлов нет версии, поэтому эти ссылки не меняются:

| Файл | Что это | Постоянная ссылка |
|------------------|----------------------------------------------|------------------------------------------------------------------------------|
| `decoder-v2.apk` | **Текущая версия**, рекомендуется | <https://github.com/OpenIPC/decoder/releases/latest/download/decoder-v2.apk> |
| `decoder.apk` | Старая версия из ветки `basic` | <https://github.com/OpenIPC/decoder/releases/latest/download/decoder.apk> |
| `SHA256SUMS` | Контрольные суммы: `sha256sum -c SHA256SUMS` | <https://github.com/OpenIPC/decoder/releases/latest/download/SHA256SUMS> |
| Файл | Что это | Постоянная ссылка |
|------------------|-----------------------------------|------------------------------------------------------------------------------|
| `decoder-v2.apk` | **Текущая версия**, рекомендуется | <https://github.com/OpenIPC/decoder/releases/latest/download/decoder-v2.apk> |
| `decoder.apk` | Старая версия из ветки `basic` | <https://github.com/OpenIPC/decoder/releases/latest/download/decoder.apk> |

Каждая новая сборка заменяет предыдущую в `latest`. Разработка идёт непрерывно, поэтому отдельных релизов по версиям нет; каждая новая версия веток `v2` и `basic` с коммитом публикуется в Telegram-канале OpenIPC ([наши каналы](https://openipc.org/our-channels)).

Expand Down
9 changes: 4 additions & 5 deletions README.zh-CN.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,11 +40,10 @@

可直接安装的版本位于唯一的发布 [**latest**](https://github.com/OpenIPC/decoder/releases/latest)，标题为 `Decoder <版本>`。文件名不含版本号，因此以下链接始终不变：

| 文件 | 说明 | 永久链接 |
|------------------|-----------------------------------|------------------------------------------------------------------------------|
| `decoder-v2.apk` | **当前版本**，推荐使用 | <https://github.com/OpenIPC/decoder/releases/latest/download/decoder-v2.apk> |
| `decoder.apk` | `basic` 分支的旧版本 | <https://github.com/OpenIPC/decoder/releases/latest/download/decoder.apk> |
| `SHA256SUMS` | 校验和：`sha256sum -c SHA256SUMS` | <https://github.com/OpenIPC/decoder/releases/latest/download/SHA256SUMS> |
| 文件 | 说明 | 永久链接 |
|------------------|------------------------|------------------------------------------------------------------------------|
| `decoder-v2.apk` | **当前版本**，推荐使用 | <https://github.com/OpenIPC/decoder/releases/latest/download/decoder-v2.apk> |
| `decoder.apk` | `basic` 分支的旧版本 | <https://github.com/OpenIPC/decoder/releases/latest/download/decoder.apk> |

每次新构建都会替换 `latest` 中的上一个构建。开发是持续进行的，因此不再按版本单独发布；`v2` 和 `basic` 分支的每个新版本连同提交都会发布到 OpenIPC 的 Telegram 频道（[我们的频道](https://openipc.org/our-channels)）。

Expand Down
2 changes: 1 addition & 1 deletion docs/testing.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ CI is the reference: the project does not depend on local builds.
- Versions are **`MAJOR.MINOR.PATCH`** (`versionName` in `android/app/build.gradle`): PATCH for fixes and small changes, MINOR for a new feature, MAJOR for an incompatible change or a large update, only when the maintainer decides. Every pull request that changes the app or its build (`android/`, except the unit tests) bumps the version as its last commit before the merge: `versionName` by that rule and `versionCode` +1. Docs-only, test-only and CI-only pull requests do not. Numbers are not reserved for open pull requests: each one takes the next number when it is merged. CI checks this on every pull request (`.github/check-version.sh`): a new number must be canonical (no leading zeros), greater than the base one, and come with its own `CHANGELOG.md` section.
- Until 2.17 `v2` counted **2.xx** (+0.01 per pull request); 2.17 is followed by 2.17.1 or 2.18.0. `basic` keeps its 1.7.x line (1.07.1 is 1.7.1).
- **`CHANGELOG.md`** is the change history: the version bump commit of a pull request that changes the app adds the version's section (`## <version> — <date>`, newest first) in the same pull request.
- Development is continuous, so there is **no release per version** (#194). The one release, [`latest`](https://github.com/OpenIPC/decoder/releases/latest), holds the newest `v2` and `basic` builds and is updated in place by both (`.github/publish-latest.sh`, #229): each branch replaces only its own files; a `v2` build moves the `latest` tag to the commit it built and sets the title `Decoder <version>`; the notes have one line per branch with its version and commit; `SHA256SUMS` covers all files. Every **new version** (not every build) of `v2` and `basic` is posted to the OpenIPC Telegram channel, where the older builds can be found. Builds of other branches are only workflow artifacts of their runs (90 days).
- Development is continuous, so there is **no release per version** (#194). The one release, [`latest`](https://github.com/OpenIPC/decoder/releases/latest), holds the newest `v2` and `basic` builds and is updated in place by both (`.github/publish-latest.sh`, #229): each branch replaces only its own files; a `v2` build moves the `latest` tag to the commit it built and sets the title `Decoder <version>`; the notes have one line per branch with its version and commit. Every **new version** (not every build) of `v2` and `basic` is posted to the OpenIPC Telegram channel, where the older builds can be found. Builds of other branches are only workflow artifacts of their runs (90 days).
- **Test pre-releases**: to let a reporter test a branch, a pre-release named after the issue is made by hand from the branch's CI artifact (never from a local build), e.g. [`toys-187-test2`](https://github.com/OpenIPC/decoder/releases/tag/toys-187-test2) for #187. It is deleted when the test is over, or replaced by the next one.

```sh
Expand Down
Loading