From 74bef9e2502af3eb2fdbd8e401b1f0b313cf9c6b Mon Sep 17 00:00:00 2001
From: Conduction Release Bot <release-bot@conduction.nl>
Date: Thu, 6 Aug 2026 13:17:18 +0200
Subject: [PATCH] feat(release): ship a .sha256 with releases from release.yml
 too

The other shared workflow (release-beta.yml) gained this; this one is
what openregister and opencatalogi use, and they are the two apps that
already publish unstable builds from development. Without it those builds
are the ones a person is most likely to install by hand and the ones with
no digest to check.

Same shape as the other workflow: bare digest, named to sit beside the
renamed asset.
---
 .github/workflows/release.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 72a7b7f..d636333 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -331,12 +331,24 @@ jobs:
         run: |
           openssl dgst -sha512 -sign signing-key.key nextcloud-release.tar.gz | openssl base64 -out nextcloud-release.signature
 
+      # Sibling digest for installers that fetch the archive over plain HTTPS
+      # rather than through the app store. The App Versions app looks for a
+      # .sha256 next to the .tar.gz and verifies against it; without one it
+      # falls back to trusting whatever it downloaded the first time. The
+      # file holds the bare digest, because the archive is renamed on upload
+      # and a "digest  filename" line would name the wrong file.
+      - name: Compute SHA-256 of tarball
+        run: |
+          sha256sum nextcloud-release.tar.gz | cut -d' ' -f1 > nextcloud-release.tar.gz.sha256
+          echo "SHA-256: $(cat nextcloud-release.tar.gz.sha256)"
+
       - name: Upload tarball as artifact
         uses: actions/upload-artifact@v4
         with:
           name: ${{ inputs.release-type }}-${{ inputs.app-name }}-${{ env.NEW_VERSION }}
           path: |
             nextcloud-release.tar.gz
+            nextcloud-release.tar.gz.sha256
             nextcloud-release.signature
           retention-days: ${{ inputs.release-type == 'stable' && 90 || (inputs.release-type == 'beta' && 30 || 7) }}
 
@@ -358,6 +370,18 @@ jobs:
           tag: v${{ env.NEW_VERSION }}
           overwrite: true
 
+      # Named to sit beside the tarball: <app>-<version>.tar.gz.sha256. The
+      # installer derives this name from the archive's own URL, so the suffix
+      # follows the renamed asset rather than the build file.
+      - name: Attach SHA-256 to release
+        uses: svenstaro/upload-release-action@v2
+        with:
+          repo_token: ${{ github.token }}
+          file: nextcloud-release.tar.gz.sha256
+          asset_name: ${{ inputs.app-name }}-${{ env.NEW_VERSION }}.tar.gz.sha256
+          tag: v${{ env.NEW_VERSION }}
+          overwrite: true
+
       # ── App Store upload (beta and stable only) ──
 
       - name: Register and upload to Nextcloud App Store