ci(release): auto-sync distribution manifests after publish

All four channels (homebrew cask, scoop, winget, flatpak) were stuck on
stale versions / placeholder SHAs because update-shas.sh used the wrong
artifact names (e.g. open-codesign.Setup.X.exe instead of the actual
open-codesign-X-x64-setup.exe electron-builder emits).

- Rewrite update-shas.sh to read SHA256SUMS.txt from the release, handle
  per-arch Windows installers, cover flatpak, and derive the mac .app
  bundle / Windows .exe name from productName in electron-builder.yml so
  the upcoming "Open CoDesign" rename propagates automatically.
- Fix URL templates: cask intel is -x64.dmg, scoop splits x64/arm64 with
  proper autoupdate, winget has separate Architecture entries.
- Fill v0.1.2 SHAs across every manifest.
- Add a bump-manifests job to release.yml that runs after publish, syncs
  packaging/ from the release, and commits back to main with [skip ci].
- Align winget identifier with release.yml: OpenCoworkAI.OpenCoDesign
  (PascalCase). Stale 0.1.1 winget dir + top-level seed file removed.

Author: hqhq1025

.github/workflows/release.yml

@@ -344,6 +344,60 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+  # ------------------------------------------------------------------
+  # Sync in-repo distribution manifests (cask / scoop / winget / flatpak)
+  # to the freshly-published release. Pulls SHA256SUMS.txt from the
+  # release, rewrites version strings + checksums + URLs across all four
+  # channels, and commits the diff back to main so the packaging/ tree
+  # stays in sync without a manual step.
+  # ------------------------------------------------------------------
+  bump-manifests:
+    name: Sync packaging manifests to release
+    needs: [publish]
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && !contains(github.ref_name, '-')
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Check out the default branch (not the tag) so the commit lands
+          # on main. We pass the version explicitly to the script.
+          ref: main
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Derive version from tag
+        id: ver
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+
+      - name: Run update-shas.sh
+        env:
+          GITHUB_REF_NAME: ${{ github.ref_name }}
+        run: ./packaging/update-shas.sh "${{ steps.ver.outputs.version }}"
+
+      - name: Commit + push
+        run: |
+          if git diff --quiet packaging/; then
+            echo "::notice::packaging/ already up to date — no commit"
+            exit 0
+          fi
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add packaging/
+          git commit -m "chore(release): sync manifests to ${GITHUB_REF_NAME}
+
+Auto-generated by .github/workflows/release.yml after publishing
+${GITHUB_REF_NAME}. Pulls SHA256SUMS.txt from the release and
+rewrites cask / scoop / winget / flatpak manifests to match.
+
+[skip ci]"
+          # Rebase in case main advanced while the release job ran.
+          git pull --rebase origin main
+          git push origin HEAD:main
+
   # ------------------------------------------------------------------
   # Homebrew Cask bump — opens a PR against OpenCoworkAI/homebrew-tap
   # with the new version + sha256 of the mac DMGs.

packaging/README.md

@@ -1,6 +1,6 @@
 # Distribution channels
 
-Canonical sources for Open CoDesign's package manager manifests. The `packaging/` tree is the source of truth; after each release we run `update-shas.sh` to fill in checksums, commit here, then mirror the per-channel files to the downstream repos listed below.
+Canonical sources for Open CoDesign's package manager manifests. The `packaging/` tree is the source of truth; after each tag push `release.yml` auto-runs `update-shas.sh` and commits the synced manifests back to `main`.
 
 All artifacts are **unsigned** for the v0.1 line. Each channel's README / caveats explains the Gatekeeper or SmartScreen workaround.
 
@@ -11,28 +11,32 @@ packaging/
 ├── homebrew/
 │   └── Casks/open-codesign.rb
 ├── winget/
-│   └── manifests/o/OpenCoworkAI/open-codesign/<version>/
-│       ├── OpenCoworkAI.open-codesign.yaml
-│       ├── OpenCoworkAI.open-codesign.installer.yaml
-│       └── OpenCoworkAI.open-codesign.locale.en-US.yaml
+│   └── manifests/o/OpenCoworkAI/OpenCoDesign/<version>/
+│       ├── OpenCoworkAI.OpenCoDesign.yaml
+│       ├── OpenCoworkAI.OpenCoDesign.installer.yaml
+│       └── OpenCoworkAI.OpenCoDesign.locale.en-US.yaml
 ├── scoop/
 │   └── bucket/open-codesign.json
+├── flatpak/
+│   └── ai.opencowork.codesign.yaml
 └── update-shas.sh
 ```
 
 ## Release flow
 
-1. Push a `vX.Y.Z` tag — `release.yml` builds and publishes the DMG / EXE / AppImage on GitHub Releases.
-2. Once the release is live, run from the repo root:
+1. Push a `vX.Y.Z` tag. `release.yml` builds + publishes the installers.
+2. After `publish` succeeds, the **`bump-manifests`** job auto-runs `update-shas.sh`: it pulls `SHA256SUMS.txt` from the release, rewrites versions / URLs / checksums across all four channels (and auto-creates the new winget version directory by copying from the previous one), then commits the diff back to `main` as `chore(release): sync manifests to vX.Y.Z`.
+3. Downstream mirroring (tap / bucket / winget-pkgs / Flathub) is still handled per-channel — see below.
 
-   ```sh
-   ./packaging/update-shas.sh
-   ```
+To run the sync manually (e.g. to backfill a past release or test script changes):
 
-   It downloads every artifact, computes SHA256, and rewrites the placeholders (`REPLACE_WITH_*_SHA256`) in all three channels' manifests. If you're on slow internet or offline, pass a local directory of pre-downloaded artifacts as the second arg.
+```sh
+./packaging/update-shas.sh              # uses apps/desktop/package.json version
+./packaging/update-shas.sh 0.1.2        # override version
+./packaging/update-shas.sh 0.1.2 ./dist # hash local artifacts instead of downloading
+```
 
-3. `git diff packaging/`, sanity-check, commit.
-4. Mirror to the downstream repos (see below). The tap and bucket repos watch this tree, so the usual workflow is a copy-push per channel.
+The script derives the mac `.app` bundle name and Windows `.exe` from `productName` in `apps/desktop/electron-builder.yml`, so renaming productName propagates into the cask's `app` field and the scoop `bin` automatically.
 
 ## Channel-specific mirroring
 
@@ -60,16 +64,16 @@ brew install --cask open-codesign
 
 ### winget — `microsoft/winget-pkgs`
 
-Microsoft's monorepo. Fork it, copy `packaging/winget/manifests/o/OpenCoworkAI/open-codesign/<version>/` into the same path in the fork, open a PR. `wingetcreate validate` is worth running first:
+Microsoft's monorepo. Fork it, copy `packaging/winget/manifests/o/OpenCoworkAI/OpenCoDesign/<version>/` into the same path in the fork, open a PR. `wingetcreate validate` is worth running first:
 
 ```sh
-wingetcreate validate packaging/winget/manifests/o/OpenCoworkAI/open-codesign/0.1.0
+wingetcreate validate packaging/winget/manifests/o/OpenCoworkAI/OpenCoDesign/0.1.2
 ```
 
 Users install with:
 
 ```pwsh
-winget install OpenCoworkAI.open-codesign
+winget install OpenCoworkAI.OpenCoDesign
 ```
 
 ### Scoop — `OpenCoworkAI/scoop-bucket`

packaging/flatpak/ai.opencowork.codesign.yaml

@@ -38,8 +38,8 @@ modules:
       - type: extra-data
         filename: open-codesign.AppImage
         url: https://github.com/OpenCoworkAI/open-codesign/releases/download/v0.1.2/open-codesign-0.1.2-x64.AppImage
-        sha256: REPLACE_WITH_REAL_SHA256_FROM_RELEASE
-        size: 0  # fill in from ls -l on the AppImage
+        sha256: eb8ea485f2ebcac0e54621ed505cb112e3ef0018d35dee49c6c4cd497e7cadfb
+        size: 142067225
       - type: script
         dest-filename: apply_extra
         commands:

packaging/homebrew/Casks/open-codesign.rb

@@ -1,18 +1,25 @@
 cask "open-codesign" do
-  version "0.1.1"
+  version "0.1.2"
 
   on_arm do
-    url "https://github.com/OpenCoworkAI/open-codesign/releases/download/v#{version}/open-codesign-#{version}-arm64.dmg"
-    sha256 "REPLACE_WITH_ARM64_SHA256"
+    url "https://github.com/OpenCoworkAI/open-codesign/releases/download/v#{version}/open-codesign-#{version}-arm64.dmg",
+        verified: "github.com/OpenCoworkAI/open-codesign/"
+    sha256 "6c3be603e32340c017b66ad8cd01822aa21a98cc28c3aac56912a94c0b53d5c4"
   end
   on_intel do
-    url "https://github.com/OpenCoworkAI/open-codesign/releases/download/v#{version}/open-codesign-#{version}.dmg"
-    sha256 "REPLACE_WITH_X64_SHA256"
+    url "https://github.com/OpenCoworkAI/open-codesign/releases/download/v#{version}/open-codesign-#{version}-x64.dmg",
+        verified: "github.com/OpenCoworkAI/open-codesign/"
+    sha256 "349efb65326ff067c85b4d07731bcd04e17319707e3709f9c33a327ce9141753"
   end
 
   name "Open CoDesign"
   desc "Open-source desktop AI design tool — prompt to prototype, BYOK, local-first"
-  homepage "https://github.com/OpenCoworkAI/open-codesign"
+  homepage "https://opencoworkai.github.io/open-codesign/"
+
+  livecheck do
+    url :url
+    strategy :github_latest
+  end
 
   auto_updates false
   depends_on macos: ">= :big_sur"

packaging/homebrew/open-codesign.rb

@@ -1,21 +1,34 @@
 {
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Open-source desktop AI design tool — prompt to prototype, BYOK, local-first",
-  "homepage": "https://github.com/OpenCoworkAI/open-codesign",
+  "homepage": "https://opencoworkai.github.io/open-codesign/",
   "license": "MIT",
-  "url": "https://github.com/OpenCoworkAI/open-codesign/releases/download/v0.1.1/open-codesign.Setup.0.1.1.exe#/dl.7z",
-  "hash": "REPLACE_WITH_WIN_SHA256",
+  "architecture": {
+    "64bit": {
+      "url": "https://github.com/OpenCoworkAI/open-codesign/releases/download/v0.1.2/open-codesign-0.1.2-x64-setup.exe#/dl.7z",
+      "hash": "328768b7dbb400cd7d15267037acd4ac03b64f15cd3d6eb1c80e58f5abe82e74"
+    },
+    "arm64": {
+      "url": "https://github.com/OpenCoworkAI/open-codesign/releases/download/v0.1.2/open-codesign-0.1.2-arm64-setup.exe#/dl.7z",
+      "hash": "d6c475044c10d8f66a7f0f65dbabf2b488061235d29cdcfb7db3f116c0466cdc"
+    }
+  },
   "bin": "open-codesign.exe",
   "shortcuts": [
     [
       "open-codesign.exe",
       "Open CoDesign"
     ]
   ],
-  "checkver": {
-    "github": "https://github.com/OpenCoworkAI/open-codesign"
-  },
+  "checkver": "github",
   "autoupdate": {
-    "url": "https://github.com/OpenCoworkAI/open-codesign/releases/download/v$version/open-codesign.Setup.$version.exe#/dl.7z"
+    "architecture": {
+      "64bit": {
+        "url": "https://github.com/OpenCoworkAI/open-codesign/releases/download/v$version/open-codesign-$version-x64-setup.exe#/dl.7z"
+      },
+      "arm64": {
+        "url": "https://github.com/OpenCoworkAI/open-codesign/releases/download/v$version/open-codesign-$version-arm64-setup.exe#/dl.7z"
+      }
+    }
   }
 }