From 7b840f734a8e5f61b017fd0ebf524de2df4ea497 Mon Sep 17 00:00:00 2001
From: hawkff <109485367+hawkff@users.noreply.github.com>
Date: Mon, 13 Jul 2026 15:09:00 -0400
Subject: [PATCH 1/2] ci(release): expose checksummed validation artifacts

---
 .github/workflows/release.yml | 45 ++++++++++++++++++++++++++++++++++-
 1 file changed, 44 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5d3fd12d6..52cad804f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -157,10 +157,44 @@ jobs:
           fi
           APK=$(dirname "$APK")
           echo "APK=$APK" >> $GITHUB_ENV
+      - name: Generate APK checksums
+        env:
+          APK: ${{ env.APK }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          APK_FILES=("$APK"/*.apk)
+          if [ "${#APK_FILES[@]}" -eq 0 ]; then
+            echo "Error: no release APKs found in $APK" >&2
+            exit 1
+          fi
+          (
+            cd "$APK"
+            sha256sum ./*.apk > SHA256SUMS
+          )
       - uses: namespace-actions/upload-artifact@f6ccaacc655aec41b93af180d1d7eef21af862d2 # v1
         with:
           name: APKs
           path: ${{ env.APK }}
+      - name: Publish arm64 release APK to Namespace workspace store
+        env:
+          APK: ${{ env.APK }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          APK_FILES=("$APK"/*arm64-v8a*.apk)
+          if [ "${#APK_FILES[@]}" -ne 1 ]; then
+            echo "Error: expected one arm64-v8a release APK, found ${#APK_FILES[@]}" >&2
+            exit 1
+          fi
+          APK_FILE="${APK_FILES[0]}"
+          REF="${GITHUB_REF_NAME//\//-}"
+          DEST_DIR="nekobox-release/${REF}/${GITHUB_RUN_ID}"
+          DEST="$DEST_DIR/$(basename "$APK_FILE")"
+          nsc artifact upload "$APK_FILE" "$DEST"
+          nsc artifact upload "$APK/SHA256SUMS" "$DEST_DIR/SHA256SUMS"
+          echo "Uploaded to Namespace workspace store: $DEST"
+          echo "Uploaded checksums to Namespace workspace store: $DEST_DIR/SHA256SUMS"
   publish:
     name: Publish Release
     if: ${{ inputs.publish == true }}
@@ -181,6 +215,15 @@ jobs:
           wget -O ghr.tar.gz https://github.com/tcnksm/ghr/releases/download/v0.13.0/ghr_v0.13.0_linux_amd64.tar.gz
           tar -xvf ghr.tar.gz
           mv ghr*linux_amd64/ghr .
+          shopt -s globstar nullglob
+          CHECKSUM_FILES=(artifacts/**/SHA256SUMS)
+          if [ "${#CHECKSUM_FILES[@]}" -ne 1 ]; then
+            echo "Error: expected one SHA256SUMS file, found ${#CHECKSUM_FILES[@]}" >&2
+            exit 1
+          fi
+          CHECKSUM_DIR=$(dirname "${CHECKSUM_FILES[0]}")
+          (cd "$CHECKSUM_DIR" && sha256sum --check SHA256SUMS)
           mkdir apks
-          find artifacts -name "*.apk" -exec cp {} apks \;
+          RELEASE_FILES=(artifacts/**/*.apk artifacts/**/SHA256SUMS)
+          cp "${RELEASE_FILES[@]}" apks/
           ./ghr -delete -t "${{ github.token }}" -n "${{ github.event.inputs.tag }}" "${{ github.event.inputs.tag }}" apks

From c47eb0cac3661e05a13f880bc276fdaf303135ef Mon Sep 17 00:00:00 2001
From: hawkff <109485367+hawkff@users.noreply.github.com>
Date: Mon, 13 Jul 2026 15:27:47 -0400
Subject: [PATCH 2/2] ci(release): tighten artifact set validation

---
 .github/workflows/release.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 52cad804f..4de0a3f22 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -191,8 +191,10 @@ jobs:
           REF="${GITHUB_REF_NAME//\//-}"
           DEST_DIR="nekobox-release/${REF}/${GITHUB_RUN_ID}"
           DEST="$DEST_DIR/$(basename "$APK_FILE")"
+          ARM64_SUMS=$(mktemp)
+          (cd "$APK" && sha256sum "./$(basename "$APK_FILE")") > "$ARM64_SUMS"
           nsc artifact upload "$APK_FILE" "$DEST"
-          nsc artifact upload "$APK/SHA256SUMS" "$DEST_DIR/SHA256SUMS"
+          nsc artifact upload "$ARM64_SUMS" "$DEST_DIR/SHA256SUMS"
           echo "Uploaded to Namespace workspace store: $DEST"
           echo "Uploaded checksums to Namespace workspace store: $DEST_DIR/SHA256SUMS"
   publish:
@@ -212,6 +214,7 @@ jobs:
           path: artifacts
       - name: Release
         run: |
+          set -euo pipefail
           wget -O ghr.tar.gz https://github.com/tcnksm/ghr/releases/download/v0.13.0/ghr_v0.13.0_linux_amd64.tar.gz
           tar -xvf ghr.tar.gz
           mv ghr*linux_amd64/ghr .
@@ -223,7 +226,12 @@ jobs:
           fi
           CHECKSUM_DIR=$(dirname "${CHECKSUM_FILES[0]}")
           (cd "$CHECKSUM_DIR" && sha256sum --check SHA256SUMS)
+          APK_FILES=(artifacts/**/*.apk)
+          if [ "${#APK_FILES[@]}" -eq 0 ]; then
+            echo "Error: no release APKs found in artifacts" >&2
+            exit 1
+          fi
           mkdir apks
-          RELEASE_FILES=(artifacts/**/*.apk artifacts/**/SHA256SUMS)
+          RELEASE_FILES=("${APK_FILES[@]}" "${CHECKSUM_FILES[@]}")
           cp "${RELEASE_FILES[@]}" apks/
           ./ghr -delete -t "${{ github.token }}" -n "${{ github.event.inputs.tag }}" "${{ github.event.inputs.tag }}" apks