[demortes]

What & why

A codebase audit flagged that AutoUpdateService (src/EDNexus.App/AutoUpdateService.cs:131-160,211-237) already does best-effort SHA-256 verification of a downloaded update against a <asset>.sha256 sidecar when one exists in the release — but .github/workflows/release.yml never generated or published one, so the verification code had nothing to check against and always silently fell through to "no checksum".

This is a small, targeted fix distinct from the full signing scheme in #104 (which is being deprioritized as a nice-to-have, not a milestone requirement — key rotation and CI-secret maintenance for that is a bigger lift). This just closes the gap so the checksum verification that's already written actually does something: integrity-only, not authenticity, but a real improvement over nothing.

Changes

• .github/workflows/release.yml: after downloading build artifacts and before creating the GitHub release, hash every artifact file and write a <file>.sha256 sidecar next to it (sha256sum | cut -d' ' -f1). The existing files: artifacts/**/* glob on the release step already picks these up as release assets.

How it was verified

No dotnet/CI runner available in this environment to execute the workflow end-to-end. Verified by inspection:

• AutoUpdateService's sidecar name matching (fileName + ".sha256", case-insensitive) matches the sidecar naming this step produces (same basename with .sha256 appended).
• The parser (sumText.Trim().Split(...)[0]) accepts a bare hash on its own line, which is what this step writes.
• find ... ! -name '*.sha256' avoids re-hashing already-generated sidecars if the step were ever re-run.

Not verified: an actual tagged release run through the real workflow (would need a real release to trigger).

Checklist

• Builds clean, no new warnings (workflow YAML only — no app code touched)
• Honours project conventions — no CommanderState/engine code touched
• Validated against real journal data — n/a, CI-only change
• No secrets, tokens, or personal journal files committed

🤖 Generated with Claude Code

https://claude.ai/code/session_01HavJeraG7CAM1KBEXLGaRz

---

Generated by Claude Code

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: cf559f59-1739-4ab9-8faa-59851408c4bb

📥 Commits

Reviewing files that changed from the base of the PR and between 6f5edff and 46c9902.

📒 Files selected for processing (1)

• .github/workflows/release.yml

 ___________________________________________________
< Vibe code cleanup in progress... Expect swearing. >
 ---------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}