ci: add sha256 and real publish date to download manifest

The manifest generator now hashes each installer (SHA-256) so the
website download page can display verifiable checksums, and accepts an
optional pub-date argument. The sync-to-r2 job passes the release's
actual publishedAt instead of relying on generation time, which drifted
for backfills.
This commit is contained in:
Jason
2026-07-27 16:37:35 +08:00
parent 934a2d0348
commit 708b38791c
2 changed files with 22 additions and 7 deletions
+6 -1
View File
@@ -788,7 +788,12 @@ jobs:
- name: Generate download manifest
if: steps.r2.outputs.configured == 'true'
run: node scripts/generate-download-manifest.mjs r2-assets "$GITHUB_REF_NAME" "$R2_PUBLIC_BASE_URL" manifest.json
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
set -euo pipefail
pub_date=$(gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --json publishedAt --jq .publishedAt)
node scripts/generate-download-manifest.mjs r2-assets "$GITHUB_REF_NAME" "$R2_PUBLIC_BASE_URL" manifest.json "$pub_date"
- name: Upload assets and manifest to R2
if: steps.r2.outputs.configured == 'true'