feat(ci): publish rolling release on every push

Made-with: Cursor

.gitea/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
         run: |
           node --version
           npm --version
-          bare --version 2>/dev/null || echo "bare not in PATH (ok, used via npx)"
+          bare --version 2>/dev/null || echo "bare not in PATH (ok)"
 
       - name: Install root dependencies
         run: npm install
@@ -61,24 +61,22 @@ jobs:
           PLAT=$(node -e "process.stdout.write(process.platform)")
           if [ "$PLAT" = "linux" ]; then
             echo "Linux runner — building linux-arm64 + linux-x64 + win32-x64"
-            node scripts/build-distributable.js --host linux-arm64 --host linux-x64 --host win32-x64
+            node scripts/build-distributable.js --host linux-arm64 --host linux-x64 --host win32-x64 --package
           elif [ "$PLAT" = "darwin" ]; then
             echo "macOS runner — building darwin-arm64 + darwin-x64"
-            node scripts/build-distributable.js --host darwin-arm64 --host darwin-x64
+            node scripts/build-distributable.js --host darwin-arm64 --host darwin-x64 --package
           else
             echo "Unknown platform $PLAT — building current host only"
-            npm run build:dist
+            node scripts/build-distributable.js --package
           fi
 
       - name: Smoke test — run native binary for current platform
         run: |
-          # Detect current platform/arch and pick the matching binary
           PLAT=$(node -e "process.stdout.write(process.platform)")
           ARCH=$(node -e "process.stdout.write(process.arch === 'arm64' ? 'arm64' : 'x64')")
           HOST="${PLAT}-${ARCH}"
           echo "Runner platform: $HOST"
 
-          # Find the binary for this platform
           BIN=""
           for candidate in \
             "releases/${HOST}/holesail-browser-host" \
@@ -115,10 +113,65 @@ jobs:
 
           echo "PASS: smoke test complete"
 
-      - name: List release artifacts
+      - name: Generate checksums
+        run: |
+          cd releases
+          find . -name "*.zip" -o -name "*.xpi" | sort | xargs sha256sum > SHA256SUMS.txt
+          cat SHA256SUMS.txt
+
+      - name: List artifacts
         run: |
           echo "=== All release artifacts ==="
           find releases/ -type f | sort
           echo ""
-          echo "=== Sizes ==="
           find releases/ -type f -exec ls -lh {} \; | awk '{print $5, $9}'
+
+      - name: Publish rolling release
+        # Only publish on branch pushes, not PRs
+        if: github.event_name == 'push'
+        run: |
+          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          BRANCH=$(echo "${{ github.ref_name }}" | sed 's|/|-|g')
+          TAG="latest-${BRANCH}"
+          TITLE="Latest build (${BRANCH} @ ${SHORT_SHA})"
+
+          # Delete existing rolling release/tag so we can recreate it
+          curl -s -X DELETE \
+            -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/tags/${TAG}" || true
+
+          curl -s -X DELETE \
+            -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/git/refs/tags/${TAG}" || true
+
+          sleep 2
+
+          # Create new release
+          RELEASE_ID=$(curl -s -X POST \
+            -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases" \
+            -d "{
+              \"tag_name\": \"${TAG}\",
+              \"name\": \"${TITLE}\",
+              \"body\": \"Automated build from \`${BRANCH}\` branch, commit \`${SHORT_SHA}\`.\n\nThis release is updated on every push and always contains the latest build.\",
+              \"prerelease\": true,
+              \"target_commitish\": \"${{ github.sha }}\"
+            }" | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>console.log(JSON.parse(d).id))")
+
+          echo "Release ID: $RELEASE_ID"
+
+          # Upload all artifacts
+          for FILE in releases/*.zip releases/*.xpi releases/SHA256SUMS.txt; do
+            [ -f "$FILE" ] || continue
+            NAME=$(basename "$FILE")
+            echo "Uploading $NAME..."
+            curl -s -X POST \
+              -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}" \
+              -H "Content-Type: application/octet-stream" \
+              "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${RELEASE_ID}/assets?name=${NAME}" \
+              --data-binary "@${FILE}"
+            echo ""
+          done
+
+          echo "Release published: ${TAG}"