Simplify release DX: local manifest, optional hash, slimmer publish

release.sh writes updates/manifest.json at release time (predictable
asset URL) — no CI commit-back, no push-token problem, no detached
checkout dance. release_publish.sh is create-release + upload only.
Manifest sha256 now optional; updater skips verification with a note
when absent (HTTPS + gzip CRC cover the realistic cases). Fixed the
repo-URL sed keeping a .git suffix (caught by a worktree dry run).
Updater tests: 8 (sha-less manifest flow added).

.gitea/workflows/release.yml

@@ -34,7 +34,7 @@ jobs:
           name: linux-tarball
           path: dist/*.tar.gz
 
-      - name: Publish release + manifest
+      - name: Publish release
         if: startsWith(github.ref, 'refs/tags/v')
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

AGENTS.md

@@ -27,8 +27,8 @@ pre-commit check. Tests run only when the code under test changed.
 Release flow: `tool/release.sh [patch|minor|major]` derives the
 version (no typing), bumps all pubspecs, commits, tags → review →
 `git push --follow-tags` → `.gitea/workflows/release.yml`
-builds, publishes the Forgejo release, commits
+builds and publishes the Forgejo release (manifest already written
-`updates/manifest.json` back. `tool/release_publish.sh` is the same
+by release.sh — predictable asset URL, no CI roundtrip). `tool/release_publish.sh` is the same
 flow by hand. Workflows live in `.gitea/workflows` (this forge reads
 `.gitea` first, `.github` is ignored when it exists).
 Never commit secrets: tokens arrive via env (`DISCORD_WEBHOOK_URL`,

HANDOFF.md

@@ -289,8 +289,10 @@ remain in session_screen.dart.
     (wired in `tool/package_linux.sh`; dev runs report
     `0.0.0-dev`). Publishing is CI-driven: tag `vX.Y.Z` →
     `.gitea/workflows/release.yml` builds, creates the Forgejo
-    release, uploads the tarball, commits the manifest back
+    release, uploads the tarball. Manifest is written locally by
-    (`tool/release_publish.sh` does the same by hand).
+    `release.sh` (predictable asset URL, no CI roundtrip);
+    sha256 is optional — skipped with a note when absent
+    (HTTPS + gzip CRC cover the realistic cases).
     Manual trigger only: bump desktop pubspec in a release commit
     first (script enforces tag == pubspec). No silent
     proto jumps: updater warns when manifest protocol != local.

apps/desktop/lib/src/update/updater.dart

@@ -24,34 +24,32 @@ class UpdateManifest {
   final String version;
   final int protocol;
   final String url;
-  final String sha256;
+  final String? sha256;
   final String notes;
   const UpdateManifest(
       {required this.version,
       required this.protocol,
       required this.url,
-      required this.sha256,
+      this.sha256,
       required this.notes});
 
   factory UpdateManifest.fromJson(Map<String, Object?> json) {
     final version = json['version'];
     final protocol = json['protocol'];
     final url = json['url'];
-    final sha = json['sha256'];
     if (version is! String ||
         version.isEmpty ||
         protocol is! int ||
         url is! String ||
-        url.isEmpty ||
+        url.isEmpty) {
-        sha is! String ||
+      throw const FormatException('update manifest missing version/protocol/url');
-        sha.isEmpty) {
-      throw const FormatException('update manifest missing version/protocol/url/sha256');
     }
+    final sha = json['sha256'];
     return UpdateManifest(
         version: version,
         protocol: protocol,
         url: url,
-        sha256: sha,
+        sha256: sha is String && sha.isNotEmpty ? sha : null,
         notes: (json['notes'] as String?) ?? '');
   }
 }
@@ -220,7 +218,12 @@ Future<int> runUpgrade(
     final file = File('${tmp.path}/update.tar.gz');
     stdout.writeln('downloading ${manifest.url} ...');
     await downloadFile(manifest.url, file, http: http);
-    await verifySha256(file, manifest.sha256);
+    if (manifest.sha256 != null) {
+      await verifySha256(file, manifest.sha256!);
+    } else {
+      stdout.writeln('no checksum in manifest — skipping verification '
+          '(HTTPS transit + gzip CRC still apply).');
+    }
     stdout.writeln('verified, applying over ${root.path} ...');
     await applyTarball(file, root);
   } catch (e) {

apps/desktop/test/updater_test.dart

@@ -16,15 +16,20 @@ void main() {
     expect(isNewerVersion('0.2.0', '0.1.9'), isFalse);
   });
 
-  test('manifest rejects missing fields', () {
+  test('manifest rejects missing fields, sha256 is optional', () {
     expect(() => UpdateManifest.fromJson({}), throwsFormatException);
     expect(
         () => UpdateManifest.fromJson({
               'version': '0.2.0',
               'protocol': 4,
-              'url': 'https://x/y.tar.gz',
             }),
         throwsFormatException);
+    final noSha = UpdateManifest.fromJson({
+      'version': '0.2.0',
+      'protocol': 4,
+      'url': 'https://x/y.tar.gz',
+    });
+    expect(noSha.sha256, isNull);
   });
 
   test('findInstallRoot honors bundle layout', () async {
@@ -162,6 +167,37 @@ void main() {
           'binary-v1');
     });
 
+    test('manifest without sha256 still applies', () async {
+      await server.close(force: true);
+      server = await HttpServer.bind(InternetAddress.loopbackIPv4, 0);
+      server.listen((req) async {
+        if (req.uri.path == '/manifest.json') {
+          req.response
+            ..statusCode = 200
+            ..write(jsonEncode({
+              'version': '0.2.0',
+              'protocol': 4,
+              'url':
+                  'http://127.0.0.1:${server.port}/watch-together-0.2.0.tar.gz',
+              'notes': '',
+            }));
+        } else {
+          req.response
+            ..statusCode = 200
+            ..add(tarball);
+        }
+        await req.response.close();
+      });
+      final root = await fakeRoot();
+      final rc = await runUpgrade(
+          currentVersion: '0.1.0',
+          manifestUrl: manifestUrl(),
+          installRoot: root);
+      expect(rc, 0);
+      expect(await File('${root.path}/watch_together').readAsString(),
+          'binary-v2');
+    });
+
     test('unknown layout asks for manual update', () async {
       final rc = await runUpgrade(
           currentVersion: '0.1.0',

docs/ROADMAP.md

@@ -25,9 +25,9 @@ desktop 17 + 7 updater.
 ## Backlog (priority order, each one sitting-sized)
 
 1. First real release: `tool/release.sh` (derives the version,
-   no typing) → review → `git push --follow-tags` → CI
+   writes the manifest, no typing) → review →
-   (`release.yml`) builds the tarball, publishes the Forgejo
+   `git push --follow-tags` → CI (`release.yml`) builds the
-   release, and commits the manifest back. Verifies the whole
+   tarball and publishes the Forgejo release. Verifies the whole
    `--upgrade` chain end to end. Manual fallback is
    `tool/package_linux.sh` + `tool/release_publish.sh <tag>`.
 2. Jumpy seek: live repro with timeline log first, then fix the

tool/release.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 # Cut a release without typing a version anywhere: derives the next
 # version (patch by default), bumps all three pubspecs in lockstep,
-# commits, and tags. Review, then `git push --follow-tags` — CI takes
+# writes updates/manifest.json (predictable asset URL — no CI roundtrip
-# it from there (build, Forgejo release, manifest commit-back).
+# needed), commits, and tags. Review, then `git push --follow-tags` —
+# CI takes it from there (build, Forgejo release, asset upload).
 # Usage: tool/release.sh [patch|minor|major] [--dry-run]
 set -euo pipefail
 
@@ -46,11 +47,45 @@ fi
 for f in $PUBSPECS; do
   sed -i -E "s/^version: .*/version: $VER/" "$ROOT/$f"
 done
-git -C "$ROOT" add $PUBSPECS
+
-if git -C "$ROOT" diff --cached --quiet; then
+ORIGIN="$(git -C "$ROOT" remote get-url origin)"
-  echo "pubspecs already at $VER — tagging only"
+SERVER="$(echo "$ORIGIN" | sed -E 's#(https?://[^/]+)/.*#\1#')"
+REPO="$(echo "${ORIGIN%.git}" | sed -E 's#.*[:/]([^/]+/[^/]+)$#\1#')"
+PROTO="$(sed -n 's/.*protoVersion = \([0-9]*\).*/\1/p' "$ROOT/packages/core/lib/src/constants.dart")"
+ASSET="watch-together-$VER-linux-x64.tar.gz"
+if [[ -n "$LATEST" && "$LATEST" != "v$VER" ]]; then
+  NOTES="$(git -C "$ROOT" log "$LATEST..HEAD" --format='- %s' | head -n 20)"
 else
-  git -C "$ROOT" commit -m "Release v$VER" -- $PUBSPECS
+  NOTES="Watch together $VER."
+fi
+export MANIFEST_FILE="$ROOT/updates/manifest.json" MANIFEST_VER="$VER" \
+  MANIFEST_PROTO="$PROTO" MANIFEST_NOTES="$NOTES" \
+  MANIFEST_URL="$SERVER/$REPO/releases/download/v$VER/$ASSET"
+python3 - <<'EOF'
+import json, os
+path = os.environ['MANIFEST_FILE']
+try:
+    with open(path) as f:
+        manifest = json.load(f)
+except (FileNotFoundError, ValueError):
+    manifest = {}
+manifest.update({
+    'version': os.environ['MANIFEST_VER'],
+    'protocol': int(os.environ['MANIFEST_PROTO']),
+    'url': os.environ['MANIFEST_URL'],
+    'notes': os.environ['MANIFEST_NOTES'].splitlines()[0] if os.environ['MANIFEST_NOTES'] else '',
+})
+manifest.pop('sha256', None)
+with open(path, 'w') as f:
+    json.dump(manifest, f, indent=2)
+    f.write('\n')
+EOF
+
+git -C "$ROOT" add $PUBSPECS updates/manifest.json
+if git -C "$ROOT" diff --cached --quiet; then
+  echo "everything already at $VER — tagging only"
+else
+  git -C "$ROOT" commit -m "Release v$VER" -- $PUBSPECS updates/manifest.json
 fi
 git -C "$ROOT" tag -a -m "Release v$VER" "v$VER"
 echo "review with: git show v$VER — then: git push --follow-tags"

tool/release_publish.sh

@@ -1,12 +1,12 @@
 #!/usr/bin/env bash
-# Publish a release to Forgejo: create the release, upload the Linux
+# Publish a release to Gitea: create the release and upload the Linux
-# tarball built by tool/package_linux.sh, and commit the updated
+# tarball built by tool/package_linux.sh. The manifest is written by
-# updates/manifest.json back to main so --upgrade clients see the new
+# tool/release.sh at release time (predictable asset URL), so this
-# version at the stable raw URL.
+# script never touches git — no push-back, no write-token problem
+# beyond the release API itself.
 # Usage: tool/release_publish.sh vX.Y.Z   (run after package_linux.sh)
 # Env: RELEASE_TOKEN (preferred) or the Actions-provided GITHUB_TOKEN /
-# GITEA_TOKEN (needs repo write or the final push is denied — then set a
+# GITEA_TOKEN.
-# RELEASE_TOKEN secret with write access).
 set -euo pipefail
 
 TAG="${1:?usage: tool/release_publish.sh vX.Y.Z}"
@@ -18,16 +18,14 @@ TARBALL="$ROOT/dist/watch-together-$VER-linux-x64.tar.gz"
 [[ -f "$TARBALL" ]] || { echo "error: run tool/package_linux.sh first ($TARBALL missing)" >&2; exit 1; }
 
 PUB="$(sed -n 's/^version: \([0-9.]*\).*/\1/p' "$ROOT/apps/desktop/pubspec.yaml")"
-[[ "$PUB" == "$VER" ]] || { echo "error: tag $TAG != desktop pubspec $PUB (bump it in a release commit first)" >&2; exit 1; }
+[[ "$PUB" == "$VER" ]] || { echo "error: tag $TAG != desktop pubspec $PUB (run tool/release.sh first)" >&2; exit 1; }
 
 ORIGIN="$(git -C "$ROOT" remote get-url origin)"
 SERVER="$(echo "$ORIGIN" | sed -E 's#(https?://[^/]+)/.*#\1#')"
-REPO="$(echo "$ORIGIN" | sed -E 's#.*[:/]([^/]+/[^/]+?)(\.git)?$#\1#')"
+REPO="$(echo "${ORIGIN%.git}" | sed -E 's#.*[:/]([^/]+/[^/]+)$#\1#')"
 TOKEN="${RELEASE_TOKEN:-${GITHUB_TOKEN:-${GITEA_TOKEN:-}}}"
-[[ -n "$TOKEN" ]] || { echo "error: set RELEASE_TOKEN (or run in Actions with a write token)" >&2; exit 1; }
+[[ -n "$TOKEN" ]] || { echo "error: set RELEASE_TOKEN (or run in Actions)" >&2; exit 1; }
 
-PROTO="$(sed -n 's/.*protoVersion = \([0-9]*\).*/\1/p' "$ROOT/packages/core/lib/src/constants.dart")"
-SHA="$(sha256sum "$TARBALL" | cut -d' ' -f1)"
 ASSET="$(basename "$TARBALL")"
 PREV="$(git -C "$ROOT" describe --tags --abbrev=0 HEAD 2>/dev/null || true)"
 if [[ -n "$PREV" && "$PREV" != "$TAG" ]]; then
@@ -48,37 +46,4 @@ echo "uploading $ASSET ..."
 curl -fsS -H "Authorization: token $TOKEN" -H 'Content-Type: application/gzip' \
   --data-binary "@$TARBALL" \
   "$SERVER/api/v1/repos/$REPO/releases/$REL_ID/assets?name=$ASSET" > /dev/null
-
+echo "published $TAG."
-export MANIFEST_FILE="$ROOT/updates/manifest.json" MANIFEST_VER="$VER" \
-  MANIFEST_PROTO="$PROTO" MANIFEST_SHA="$SHA" \
-  MANIFEST_URL="$SERVER/$REPO/releases/download/$TAG/$ASSET"
-python3 - <<'EOF'
-import json, os
-path = os.environ['MANIFEST_FILE']
-try:
-    with open(path) as f:
-        manifest = json.load(f)
-except (FileNotFoundError, ValueError):
-    manifest = {}
-manifest.update({
-    'version': os.environ['MANIFEST_VER'],
-    'protocol': int(os.environ['MANIFEST_PROTO']),
-    'url': os.environ['MANIFEST_URL'],
-    'sha256': os.environ['MANIFEST_SHA'],
-    'notes': os.environ['REL_NOTES'].splitlines()[0] if os.environ['REL_NOTES'] else '',
-})
-with open(path, 'w') as f:
-    json.dump(manifest, f, indent=2)
-    f.write('\n')
-EOF
-
-echo "committing manifest back to main ..."
-git -C "$ROOT" fetch origin main 2>/dev/null || true
-git -C "$ROOT" checkout -B main origin/main
-git -C "$ROOT" add updates/manifest.json
-git -C "$ROOT" -c user.name='watch-together-release' -c user.email='release@localhost' \
-  commit -m "Release $TAG manifest" -- updates/manifest.json
-if ! git -C "$ROOT" push -o ci.skip origin main 2>/dev/null; then
-  git -C "$ROOT" push origin main
-fi
-echo "published $TAG — manifest live at updates/manifest.json on main."

updates/manifest.example.json

@@ -2,6 +2,5 @@
   "version": "0.2.0",
   "protocol": 4,
   "url": "https://git.senkochan.moe/Foxyz/sync_replay_project/releases/download/v0.2.0/watch-together-0.2.0-linux-x64.tar.gz",
-  "sha256": "<sha256 of the tarball, filled in at release time>",
   "notes": "One-line highlight of what changed."
 }