From 4bf7b7eba67e3a53e024f171fae4daa10e4e661f Mon Sep 17 00:00:00 2001 From: Ross Golder Date: Tue, 6 Oct 2026 13:33:55 +0700 Subject: [PATCH] Keep Zapstore protocol out of this repository's checklist An earlier attempt at this step documented relay event kinds and the version_code requirement, which is the action's internals leaking into the wrong repository. It would also rot as soon as the action changed how it reports. What is left asserts only what this repository owns: the publish step has to succeed, and zapstore.yaml points at CHANGELOG.md so a stale changelog publishes stale notes. pubkey, match, relay verification, credential rotation and how a publish is reported are all documented in rossigee/zapstore-publish, which is where a reader should be sent. One sms2webhook-specific fact is worth checking first: CHANGELOG.md is the source of the store's release notes, so step 2 is not optional. --- AGENTS.md | 47 +++++++++++++++++++++-------------------------- 1 file changed, 21 insertions(+), 26 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 95eb7b7..c1115eb 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -281,35 +281,30 @@ git tag -a vX.Y.Z -m "..." && git push origin vX.Y.Z The trigger is `v[0-9]+.[0-9]+.[0-9]+`, so a prerelease such as `v2.2.0-rc1` is deliberately excluded and will publish nothing. -**7. Confirm it actually published** +**7. Confirm the publish step passed** `release.yml` sets `skip-if-unconfigured: 'true'`, so **a green run does not prove the Zapstore publish happened** — a missing or invalid `ZAPSTORE_SIGN_WITH` exits -success having published nothing. Look for these lines in the `Publish to Zapstore` -step: - -``` -APK resolved from ... sms2webhook-vX.Y.Z-release-signed.apk -org.golder.sms2webhook X.Y.Z (code N), certificate ... via v2 -uploaded sms2webhook/src/main/ic_launcher-playstore.png (...) -published kind 32267 ... -``` - -The `uploaded ic_launcher-playstore.png` line is how you confirm the listing icon -actually reached the CDN. Without an `icon:` field in `zapstore.yaml` the kind 32267 -event carries no icon tag and the store shows a placeholder letter instead, which -looks like a client bug rather than a missing config field. - -The resolved asset must be the **release-signed** APK. `zapstore.yaml` pins -`match: ".*-release-signed\\.apk$"` so the debug APK cannot be chosen, and both APKs -are deliberately attached to the GitHub release, so seeing `sms2webhook-*.apk` -listed there is expected and not a mistake. - -If `ZAPSTORE_SIGN_WITH` is changed or rotated, run `verify-zapstore-signing.yml` -first: it signs every event but uploads and publishes nothing. -`zapstore-publisher.yml` separately proves the committed npub matches the signing -credential, and runs weekly. A mismatch there is refused by the relay with no -useful local symptom. +success having published nothing. The `Publish to Zapstore` step has to succeed. If it +does not, re-run it (`gh run rerun --failed`); it is idempotent, republishing the +same content-addressed assets. + +One thing here is this repository's own problem: `zapstore.yaml` sets +`release_notes: ./CHANGELOG.md`, so **an out-of-date changelog publishes out-of-date +notes**. That is what step 2 is for. See the action's documentation for what happens +when no section matches the released version. + +**How the publish actually works is not documented here, and should not be.** The +`pubkey` and `match` fields, the relay's verification, credential rotation and the +reporting of a publish all belong to +[`rossigee/zapstore-publish`](https://github.com/rossigee/zapstore-publish). If the +step reports success but the listing is wrong — no APK behind Install, a placeholder +icon, rejected events — that is a bug in the action: fix and report it there rather +than working around it or documenting it in this file. + +If `ZAPSTORE_SIGN_WITH` is changed or rotated, run this repository's +`verify-zapstore-signing.yml` first, which exercises the credential without writing to +a shared relay. ### GitHub Actions Workflows