From 7fdd6752a5e51ff956ecba59eba3da87b193e498 Mon Sep 17 00:00:00 2001
From: TerminallyLazy <inf3ctious007@gmail.com>
Date: Thu, 23 Jul 2026 17:11:45 -0400
Subject: [PATCH] ci: harden release artifact checksums

Generate portable checksum manifests, verify them during packaging, and use the current artifact upload action.
---
 .github/workflows/release.yml |  2 +-
 scripts/package-release.sh    | 17 +++++++++++++----
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b057f70..c73522f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
         run: sh scripts/package-release.sh
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: tree-ring-memory-${{ matrix.os }}
           path: |
diff --git a/scripts/package-release.sh b/scripts/package-release.sh
index 5c4d5e1..bfd3f91 100755
--- a/scripts/package-release.sh
+++ b/scripts/package-release.sh
@@ -12,6 +12,7 @@ ARCH=$(uname -m | tr '[:upper:]' '[:lower:]')
 NAME="tree-ring-memory-$VERSION-$OS-$ARCH"
 DIST_DIR=${TREE_RING_DIST_DIR:-dist}
 WORK_DIR="$DIST_DIR/$NAME"
+ARCHIVE="$NAME.tar.gz"
 
 rm -rf "$WORK_DIR"
 mkdir -p "$WORK_DIR"
@@ -21,14 +22,22 @@ cargo build --release -p tree-ring-memory-cli --locked
 cp target/release/tree-ring "$WORK_DIR/tree-ring"
 cp README.md LICENSE install.sh "$WORK_DIR/"
 
-tar -C "$DIST_DIR" -czf "$DIST_DIR/$NAME.tar.gz" "$NAME"
+tar -C "$DIST_DIR" -czf "$DIST_DIR/$ARCHIVE" "$NAME"
 
 if command -v shasum >/dev/null 2>&1; then
-  shasum -a 256 "$DIST_DIR/$NAME.tar.gz" > "$DIST_DIR/$NAME.tar.gz.sha256"
+  (
+    cd "$DIST_DIR"
+    shasum -a 256 "$ARCHIVE" > "$ARCHIVE.sha256"
+    shasum -a 256 -c "$ARCHIVE.sha256"
+  )
 elif command -v sha256sum >/dev/null 2>&1; then
-  sha256sum "$DIST_DIR/$NAME.tar.gz" > "$DIST_DIR/$NAME.tar.gz.sha256"
+  (
+    cd "$DIST_DIR"
+    sha256sum "$ARCHIVE" > "$ARCHIVE.sha256"
+    sha256sum -c "$ARCHIVE.sha256"
+  )
 else
   printf '%s\n' "warning: no SHA-256 tool found; checksum not written" >&2
 fi
 
-printf 'release_package=%s\n' "$DIST_DIR/$NAME.tar.gz"
+printf 'release_package=%s\n' "$DIST_DIR/$ARCHIVE"