From b25c55eb9b59b043495b8fffff6c4dca249cbbb2 Mon Sep 17 00:00:00 2001
From: mohammad junayd <111487869+m-jay21@users.noreply.github.com>
Date: Mon, 14 Sep 2026 17:15:24 +0400
Subject: [PATCH] ci(release): publish SHA256SUMS for every release asset

Let the installer verify downloads against a same-origin checksum
manifest before extract (#1267).
---
 .github/workflows/build-release.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 9e5292b5..64a54a88 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -113,9 +113,26 @@ jobs:
           path: release
           merge-multiple: true
 
+      # Same-origin integrity manifest for every release asset. Hashes use bare
+      # basenames (no directory prefix) so the installer can match the file it
+      # downloaded into a temp dir. Detects corruption / single-asset swap; not
+      # a defense against a fully compromised release pipeline — that needs
+      # Sigstore / build-provenance attestation (handled separately in #1267).
+      - name: Generate SHA256SUMS
+        working-directory: release
+        shell: bash
+        run: |
+          : > SHA256SUMS
+          while IFS= read -r -d '' f; do
+            ( cd "$(dirname "$f")" && sha256sum "$(basename "$f")" )
+          done < <(find . -type f ! -name SHA256SUMS -print0 | sort -z) >> SHA256SUMS
+          echo "=== SHA256SUMS ==="
+          cat SHA256SUMS
+
       - name: Create Release
         uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
         with:
           prerelease: ${{ !startsWith(github.ref, 'refs/tags/') }}
           generate_release_notes: true
+          # release/** already includes release/SHA256SUMS generated above.
           files: release/**