feat: sha256 checksum for self-updates

.github/workflows/rolling-release.yml

@@ -5,6 +5,14 @@ on:
     branches:
       - main
 
+# Serialize runs: the rolling `nightly` release is deleted and recreated at the
+# end of each run, and overlapping runs could interleave those steps (or leave
+# a checksums file describing another run's assets). Queue instead of cancel so
+# an in-flight delete/create is never aborted halfway.
+concurrency:
+  group: rolling-release
+  cancel-in-progress: false
+
 permissions:
   contents: write
   security-events: write
@@ -210,7 +218,11 @@ jobs:
         id: timestamp
         shell: bash
         run: |
-          TIMESTAMP=$(date -u +"%Y-%m-%d")
+          # Committer date, not wall clock: every job in this run (including
+          # update-nightly-release, which runs much later) must derive the
+          # exact same tag, or a run straddling midnight UTC splits the
+          # release from its checksums.
+          TIMESTAMP=$(git show -s --format=%cs HEAD)
           COMMIT_HASH=$(echo "${GITHUB_SHA}" | cut -c1-7)
           echo "timestamp=${TIMESTAMP}-${COMMIT_HASH}" >> $GITHUB_OUTPUT
           echo "Generated timestamp: ${TIMESTAMP}-${COMMIT_HASH}"
@@ -289,7 +301,9 @@ jobs:
       - name: Generate nightly tag
         id: tag
         run: |
-          TIMESTAMP=$(date -u +"%Y-%m-%d")
+          # Committer date — must match the tag the build matrix computed (see
+          # the timestamp step there), even when this job runs past midnight.
+          TIMESTAMP=$(git show -s --format=%cs HEAD)
           COMMIT_HASH=$(echo "${GITHUB_SHA}" | cut -c1-7)
           echo "nightly_tag=nightly-${TIMESTAMP}-${COMMIT_HASH}" >> $GITHUB_OUTPUT
 
@@ -355,8 +369,16 @@ jobs:
           mkdir -p "$ASSETS_DIR"
           gh release download "$NIGHTLY_TAG" --dir "$ASSETS_DIR" --clobber
 
-          # Rename versioned filenames to stable nightly names
+          # Checksums for the per-commit release (original filenames). The app
+          # self-updater downloads from per-commit nightly releases and refuses
+          # to install anything it cannot verify against this file.
+          # --repo is required: ASSETS_DIR is outside the git checkout, so gh
+          # cannot infer the repository from the working directory.
           cd "$ASSETS_DIR"
+          sha256sum Donut* > SHA256SUMS.txt
+          gh release upload "$NIGHTLY_TAG" SHA256SUMS.txt --clobber --repo "$GITHUB_REPOSITORY"
+
+          # Rename versioned filenames to stable nightly names
           for f in Donut_*_aarch64.dmg; do [ -f "$f" ] && mv "$f" Donut_nightly_aarch64.dmg; done
           for f in Donut_*_x64.dmg; do [ -f "$f" ] && mv "$f" Donut_nightly_x64.dmg; done
           for f in Donut_*_x64-setup.exe; do [ -f "$f" ] && mv "$f" Donut_nightly_x64-setup.exe; done
@@ -368,6 +390,10 @@ jobs:
           for f in Donut-*.aarch64.rpm; do [ -f "$f" ] && mv "$f" Donut_nightly_aarch64.rpm; done
           for f in Donut_*_aarch64.app.tar.gz; do [ -f "$f" ] && mv "$f" Donut_aarch64.app.tar.gz; done
           for f in Donut_*_x64.app.tar.gz; do [ -f "$f" ] && mv "$f" Donut_x64.app.tar.gz; done
+
+          # Checksums for the rolling release (renamed filenames), restricted
+          # to exactly the assets uploaded below.
+          sha256sum Donut_nightly_* Donut_aarch64.app.tar.gz Donut_x64.app.tar.gz > SHA256SUMS.txt
           cd "$GITHUB_WORKSPACE"
 
           # Delete existing rolling nightly release and tag
@@ -379,6 +405,7 @@ jobs:
             "$ASSETS_DIR"/Donut_nightly_* \
             "$ASSETS_DIR"/Donut_aarch64.app.tar.gz \
             "$ASSETS_DIR"/Donut_x64.app.tar.gz \
+            "$ASSETS_DIR"/SHA256SUMS.txt \
             --title "Donut Browser Nightly" \
             --notes-file /tmp/nightly-notes.md \
             --prerelease