Actually publish to the package managers (#114)

TronBrowser has never reached a single package manager. The channels were
scaffolded on 2026-06-25 and every manifest in distribution/ still said 0.1.0
while releases went out to 3.15.0. Four separate things had to be true for a
release to ship downstream and none of them were.

The trigger never fired. submit-packages.yml listened on `release: [published]`,
but release.yml un-drafts with GITHUB_TOKEN, and GitHub raises no workflow events
for what a GITHUB_TOKEN does. The workflow has zero runs in three months.
release.yml now calls it directly through workflow_call, which needs no PAT.

The dry-run flag was read from `github.event.inputs.dry_run`, which is empty on
anything that is not a workflow_dispatch. The guard was `!= "false"`, so a
release run appended --dry-run every time: even with a working trigger the
submit path could not have executed. Chocolatey was worse, hardcoded --dry-run
with no way to turn it off.

The refreshed manifests were thrown away with the runner. Nothing committed them,
which is why the tree never moved off 0.1.0. They are now opened as a PR, since
those files are the input to every channel's submission and a stale tree means
even a working submit publishes the wrong version.

And there was no submission code at all. The header said submission was "gated on
the relevant secret", but no push, PR or upload existed anywhere in the script --
it rewrote files and exited. Channels we own outright now really publish:
homebrew to our tap, scoop to our bucket, AUR over ssh (with a generated .SRCINFO,
since makepkg is not on a runner), Chocolatey via choco push, Snap via snapcraft
upload. The five that are a pull request into someone else's monorepo (winget,
flathub, nixpkgs, gentoo, freebsd) cannot be automated end to end and now say so
with a link, rather than printing success.

A channel with no secret refreshes its manifest, explains the skip and exits
clean, so a credential-less repo still goes green. A channel that has its secret
and fails is allowed to break the build, because a silent success here is exactly
what hid this for three months.

Verified against the real v3.15.0 release: manifests refresh to 3.15.0 and the
generated AUR sha256 matches the published tarball byte for byte.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ralyodio

.github/workflows/release.yml

@@ -143,3 +143,19 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh release edit "${{ needs.create-release.outputs.tag }}" --draft=false --repo "${{ github.repository }}"
+
+  # 4) Push the release out to the downstream package managers.
+  #
+  # This is a direct call, NOT submit-packages.yml's own `release: [published]`
+  # trigger. The un-draft above uses GITHUB_TOKEN, and GitHub raises no workflow
+  # events for what a GITHUB_TOKEN does, so that trigger never fired once in the
+  # three months it was wired up and no channel was ever updated past 0.1.0.
+  # Calling the workflow keeps that guarantee without needing a PAT.
+  distribute:
+    needs: [create-release, publish]
+    uses: ./.github/workflows/submit-packages.yml
+    secrets: inherit
+    with:
+      version: ${{ needs.create-release.outputs.version }}
+      dry_run: false
+      package_managers: all

.github/workflows/submit-packages.yml

@@ -1,25 +1,46 @@
 name: Submit to Package Managers
 
-# Refresh + submit downstream package managers after a release. Mirrors
-# pairux.com's submit-packages workflow but stays in this monorepo. Each channel
-# is gated on its secret; without the secret it dry-runs (no-op), so this never
-# fails for missing credentials.
+# Refresh + submit downstream package managers after a release. Each channel is
+# gated on its secret; without the secret it refreshes the manifest and skips the
+# submit, so this never fails for missing credentials.
+#
+# NOT triggered by `release: [published]`. release.yml un-drafts with
+# GITHUB_TOKEN, and GitHub deliberately raises no workflow events for anything a
+# GITHUB_TOKEN does, so that trigger never fired once between 2026-06-25 and
+# 2026-09-24 and every channel silently stayed on 0.1.0. release.yml now calls
+# this workflow directly instead, which needs no PAT.
 on:
-  release:
-    types: [published]
+  workflow_call:
+    inputs:
+      version:
+        description: 'Version without v prefix (e.g. 0.1.0)'
+        required: true
+        type: string
+      dry_run:
+        description: 'Refresh manifests without submitting'
+        type: boolean
+        default: false
+      package_managers:
+        description: 'Comma-separated, or "all"'
+        type: string
+        default: all
   workflow_dispatch:
     inputs:
       version:
         description: 'Version without v prefix (e.g. 0.1.0)'
         required: true
       dry_run:
-        description: 'Generate manifests without submitting'
+        description: 'Refresh manifests without submitting'
         type: boolean
         default: true
       package_managers:
         description: 'Comma-separated, or "all"'
         default: all
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   # Everything except Chocolatey runs on Linux.
   submit-linux:
@@ -31,50 +52,74 @@ jobs:
 
       - name: Resolve version
         id: v
-        run: |
-          if [ -n "${{ github.event.inputs.version }}" ]; then V="${{ github.event.inputs.version }}"; else V="${{ github.event.release.tag_name }}"; fi
-          echo "version=${V#v}" >> "$GITHUB_OUTPUT"
+        env:
+          V_IN: ${{ inputs.version }}
+        run: echo "version=${V_IN#v}" >> "$GITHUB_OUTPUT"
 
       - name: Resolve package managers
         id: pms
+        env:
+          PMS_IN: ${{ inputs.package_managers }}
         run: |
-          PMS="${{ github.event.inputs.package_managers }}"
+          PMS="$PMS_IN"
           [ -z "$PMS" ] && PMS="all"
           if [ "$PMS" = "all" ]; then PMS="homebrew,scoop,winget,aur,apt,rpm,gentoo,nix,snap,flatpak,appimage,freebsd"; fi
           echo "list=$(echo "$PMS" | sed 's/chocolatey,*//g')" >> "$GITHUB_OUTPUT"
 
       - name: Refresh + submit manifests
         env:
-          DRY_RUN: ${{ github.event.inputs.dry_run }}
+          # A release calls this with dry_run=false. This previously read
+          # github.event.inputs.dry_run, which is empty on anything but a
+          # workflow_dispatch, so the "!= false" test below appended --dry-run on
+          # every release run: the submit path could never have executed even if
+          # the trigger had worked.
+          DRY_RUN: ${{ inputs.dry_run }}
           GH_TOKEN: ${{ github.token }}
           AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          SCOOP_BUCKET_TOKEN: ${{ secrets.SCOOP_BUCKET_TOKEN }}
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
         run: |
           ARGS="-v ${{ steps.v.outputs.version }}"
           for PM in $(echo "${{ steps.pms.outputs.list }}" | tr ',' ' '); do ARGS="$ARGS -p $PM"; done
-          # Default to dry-run unless explicitly disabled AND submit secrets exist.
           if [ "$DRY_RUN" != "false" ]; then ARGS="$ARGS --dry-run"; fi
           node scripts/submit-packages.mjs $ARGS
 
+      # The refreshed manifests are the input to every future submission, so they
+      # have to outlive the runner. Without this they were rewritten and thrown
+      # away, which is why distribution/ still said 0.1.0 at release 3.15.0.
+      - name: Open a PR with the refreshed manifests
+        if: ${{ inputs.dry_run != true }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.v.outputs.version }}
+        run: bash scripts/open-distribution-pr.sh
+
   # Chocolatey publishes from Windows.
   submit-chocolatey:
     runs-on: windows-latest
     name: Submit (Chocolatey)
     if: >-
-      github.event.inputs.package_managers == 'all' ||
-      github.event.inputs.package_managers == '' ||
-      github.event_name == 'release' ||
-      contains(github.event.inputs.package_managers, 'chocolatey')
+      inputs.package_managers == 'all' ||
+      inputs.package_managers == '' ||
+      contains(inputs.package_managers, 'chocolatey')
     steps:
       - uses: actions/checkout@v5
       - name: Resolve version
         id: v
         shell: bash
-        run: |
-          if [ -n "${{ github.event.inputs.version }}" ]; then V="${{ github.event.inputs.version }}"; else V="${{ github.event.release.tag_name }}"; fi
-          echo "version=${V#v}" >> "$GITHUB_OUTPUT"
-      - name: Refresh chocolatey manifest
+        env:
+          V_IN: ${{ inputs.version }}
+        run: echo "version=${V_IN#v}" >> "$GITHUB_OUTPUT"
+      - name: Refresh + submit chocolatey manifest
         shell: bash
         env:
+          # Was hardcoded --dry-run, so chocolatey could never publish regardless
+          # of trigger or credentials.
+          DRY_RUN: ${{ inputs.dry_run }}
           CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
-        run: node scripts/submit-packages.mjs -v ${{ steps.v.outputs.version }} -p chocolatey --dry-run
+        run: |
+          ARGS="-v ${{ steps.v.outputs.version }} -p chocolatey"
+          if [ "$DRY_RUN" != "false" ]; then ARGS="$ARGS --dry-run"; fi
+          node scripts/submit-packages.mjs $ARGS

distribution/aur/PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Profullstack, Inc. <security@profullstack.com>
 # AUR binary package — consumes the GitHub release tarball.
 pkgname=tronbrowser-bin
-pkgver=0.1.0
+pkgver=3.15.0
 pkgrel=1
 pkgdesc="Open-source, privacy-first, AI-native browser (Ungoogled Chromium fork)"
 arch=('x86_64')
@@ -11,7 +11,7 @@ depends=('chromium')
 provides=('tronbrowser')
 conflicts=('tronbrowser')
 source=("tronbrowser-${pkgver}.tar.gz::https://github.com/profullstack/tronbrowser.dev/releases/download/v${pkgver}/tronbrowser-linux-x64.tar.gz")
-sha256sums=('d966a54a6369ec283203abd257f89e50844ff68551229a463f568dc638dcf4c7')
+sha256sums=('0870fc5fd4b7acdfa1679f542d038a34e932b65721918cb4c1071e7a6b008779')
 
 package() {
   install -dm755 "${pkgdir}/usr/lib/tronbrowser"

distribution/homebrew/tronbrowser.rb

@@ -4,17 +4,17 @@
 class Tronbrowser < Formula
   desc "Open-source, privacy-first, AI-native browser (Ungoogled Chromium fork)"
   homepage "https://tronbrowser.dev"
-  version "0.1.0"
+  version "3.15.0"
   license "MIT"
 
   on_macos do
-    url "https://github.com/profullstack/tronbrowser.dev/releases/download/v0.1.0/tronbrowser-macos.zip"
+    url "https://github.com/profullstack/tronbrowser.dev/releases/download/v3.15.0/tronbrowser-macos.zip"
     sha256 "4f928b90b83a34d90edf6f3b4f522c47b85090046424ce69cc535a0cb85d77d1"
   end
 
   on_linux do
-    url "https://github.com/profullstack/tronbrowser.dev/releases/download/v0.1.0/tronbrowser-linux-x64.tar.gz"
-    sha256 "d966a54a6369ec283203abd257f89e50844ff68551229a463f568dc638dcf4c7"
+    url "https://github.com/profullstack/tronbrowser.dev/releases/download/v3.15.0/tronbrowser-linux-x64.tar.gz"
+    sha256 "0870fc5fd4b7acdfa1679f542d038a34e932b65721918cb4c1071e7a6b008779"
   end
 
   def install

distribution/scoop/tronbrowser.json

@@ -1,20 +1,20 @@
 {
-  "version": "0.1.0",
+  "version": "3.15.0",
   "description": "Open-source, privacy-first, AI-native browser (Ungoogled Chromium fork).",
   "homepage": "https://tronbrowser.dev",
   "license": "MIT",
   "architecture": {
     "64bit": {
-      "url": "https://github.com/profullstack/tronbrowser.dev/releases/download/v0.1.0/tronbrowser-win-x64.zip",
-      "hash": "TODO-needs-windows-build"
+      "url": "https://github.com/profullstack/tronbrowser.dev/releases/download/v3.15.0/tronbrowser-win-x64.zip",
+      "hash": "ebb5b0c7675255accc9975e0ac31a542cb9c9eb1bb700eac18fce8cca681f82c"
     }
   },
   "bin": [["tronbrowser/tronbrowser.exe", "tron"], ["tronbrowser/tronbrowser.exe", "tronbrowser"]],
   "checkver": "github",
   "autoupdate": {
     "architecture": {
       "64bit": {
-        "url": "https://github.com/profullstack/tronbrowser.dev/releases/download/v$version/tronbrowser-win-x64.zip"
+        "url": "https://github.com/profullstack/tronbrowser.dev/releases/download/v3.15.0/tronbrowser-win-x64.zip"
       }
     }
   }

distribution/snap/snapcraft.yaml

@@ -2,7 +2,7 @@
 # and exec the host's Chromium. `snapcraft` builds; publish with `snapcraft upload`.
 name: tronbrowser
 base: core24
-version: '0.1.1'
+version: '3.15.0'
 summary: Privacy-first, AI-native browser (Ungoogled Chromium fork)
 description: |
   Open-source, privacy-first, AI-native web browser built on Ungoogled Chromium.
@@ -20,6 +20,6 @@ apps:
 parts:
   tronbrowser:
     plugin: dump
-    source: https://github.com/profullstack/tronbrowser.dev/releases/download/v0.1.1/tronbrowser-linux-x64.tar.gz
+    source: https://github.com/profullstack/tronbrowser.dev/releases/download/v3.15.0/tronbrowser-linux-x64.tar.gz
     organize:
       'tronbrowser/*': './'

distribution/winget/Profullstack.TronBrowser.installer.yaml

@@ -2,12 +2,12 @@
 # manifests/p/Profullstack/TronBrowser/<version>/. Needs a Windows installer
 # (.exe/.msi) or a portable zip artifact — pending the Windows build.
 PackageIdentifier: Profullstack.TronBrowser
-PackageVersion: 0.1.0
+PackageVersion: 3.15.0
 InstallerType: zip
 Installers:
   - Architecture: x64
-    InstallerUrl: https://github.com/profullstack/tronbrowser.dev/releases/download/v0.1.0/tronbrowser-win-x64.zip
-    InstallerSha256: TODO-NEEDS-WINDOWS-BUILD
+    InstallerUrl: https://github.com/profullstack/tronbrowser.dev/releases/download/v3.15.0/tronbrowser-win-x64.zip
+    InstallerSha256: EBB5B0C7675255ACCC9975E0AC31A542CB9C9EB1BB700EAC18FCE8CCA681F82C
     NestedInstallerType: portable
     NestedInstallerFiles:
       - RelativeFilePath: tronbrowser\tronbrowser.exe

scripts/open-distribution-pr.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Open a PR with the manifests submit-packages.mjs just refreshed.
+#
+# Why this exists: the refresh rewrites files under distribution/ on the runner
+# and nothing ever persisted them, so every manifest in git stayed frozen at the
+# version it was scaffolded with (0.1.0/0.1.1) while releases went out to 3.15.0.
+# Those manifests are the input to every channel's submission, so a stale tree
+# means even a working submit publishes the wrong version.
+#
+# A PR rather than a push to main: main is protected, and a bad checksum should
+# be reviewable before it reaches a package manager.
+set -euo pipefail
+
+: "${VERSION:?VERSION must be set}"
+
+if git diff --quiet -- distribution; then
+  echo "distribution/ already current for v${VERSION}, nothing to commit"
+  exit 0
+fi
+
+git config user.name "github-actions[bot]"
+git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+BRANCH="chore/distribution-${VERSION}"
+
+# A re-run of the same release must not fail on an existing branch.
+if git ls-remote --exit-code --heads origin "${BRANCH}" >/dev/null 2>&1; then
+  echo "branch ${BRANCH} already exists on origin; force-updating it"
+  git checkout -B "${BRANCH}"
+  git add distribution
+  git commit -m "chore(distribution): refresh manifests for v${VERSION}"
+  git push --force-with-lease origin "${BRANCH}"
+else
+  git checkout -b "${BRANCH}"
+  git add distribution
+  git commit -m "chore(distribution): refresh manifests for v${VERSION}"
+  git push origin "${BRANCH}"
+fi
+
+# `gh pr create` fails if one is already open for the branch, which is fine.
+gh pr create \
+  --base main \
+  --head "${BRANCH}" \
+  --title "chore(distribution): refresh manifests for v${VERSION}" \
+  --body "Automated manifest refresh from the release pipeline for v${VERSION}.
+
+Version strings and sha256 checksums are rewritten from the published release
+assets by \`scripts/submit-packages.mjs\`." \
+  || echo "a PR for ${BRANCH} already exists; branch updated in place"