Actually publish to the package managers

.github/workflows/release.yml

@@ -116,3 +116,19 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh release edit "${{ needs.create-release.outputs.tag }}" --draft=false --repo "${{ github.repository }}"
+
+  # 4) Push the release out to the downstream package managers.
+  #
+  # This is a direct call, NOT submit-packages.yml's own `release: [published]`
+  # trigger. The un-draft above uses GITHUB_TOKEN, and GitHub raises no workflow
+  # events for what a GITHUB_TOKEN does, so that trigger never fired once in the
+  # three months it was wired up and no channel was ever updated past 0.1.0.
+  # Calling the workflow keeps that guarantee without needing a PAT.
+  distribute:
+    needs: [create-release, publish]
+    uses: ./.github/workflows/submit-packages.yml
+    secrets: inherit
+    with:
+      version: ${{ needs.create-release.outputs.version }}
+      dry_run: false
+      package_managers: all

.github/workflows/submit-packages.yml

@@ -1,25 +1,46 @@
 name: Submit to Package Managers
 
-# Refresh + submit downstream package managers after a release. Mirrors
-# pairux.com's submit-packages workflow but stays in this monorepo. Each channel
-# is gated on its secret; without the secret it dry-runs (no-op), so this never
-# fails for missing credentials.
+# Refresh + submit downstream package managers after a release. Each channel is
+# gated on its secret; without the secret it refreshes the manifest and skips the
+# submit, so this never fails for missing credentials.
+#
+# NOT triggered by `release: [published]`. release.yml un-drafts with
+# GITHUB_TOKEN, and GitHub deliberately raises no workflow events for anything a
+# GITHUB_TOKEN does, so that trigger never fired once between 2026-06-25 and
+# 2026-09-24 and every channel silently stayed on 0.1.0. release.yml now calls
+# this workflow directly instead, which needs no PAT.
 on:
-  release:
-    types: [published]
+  workflow_call:
+    inputs:
+      version:
+        description: 'Version without v prefix (e.g. 0.1.0)'
+        required: true
+        type: string
+      dry_run:
+        description: 'Refresh manifests without submitting'
+        type: boolean
+        default: false
+      package_managers:
+        description: 'Comma-separated, or "all"'
+        type: string
+        default: all
   workflow_dispatch:
     inputs:
       version:
         description: 'Version without v prefix (e.g. 0.1.0)'
         required: true
       dry_run:
-        description: 'Generate manifests without submitting'
+        description: 'Refresh manifests without submitting'
         type: boolean
         default: true
       package_managers:
         description: 'Comma-separated, or "all"'
         default: all
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   # Everything except Chocolatey runs on Linux.
   submit-linux:
@@ -31,50 +52,74 @@ jobs:
 
       - name: Resolve version
         id: v
-        run: |
-          if [ -n "${{ github.event.inputs.version }}" ]; then V="${{ github.event.inputs.version }}"; else V="${{ github.event.release.tag_name }}"; fi
-          echo "version=${V#v}" >> "$GITHUB_OUTPUT"
+        env:
+          V_IN: ${{ inputs.version }}
+        run: echo "version=${V_IN#v}" >> "$GITHUB_OUTPUT"
 
       - name: Resolve package managers
         id: pms
+        env:
+          PMS_IN: ${{ inputs.package_managers }}
         run: |
-          PMS="${{ github.event.inputs.package_managers }}"
+          PMS="$PMS_IN"
           [ -z "$PMS" ] && PMS="all"
           if [ "$PMS" = "all" ]; then PMS="homebrew,scoop,winget,aur,apt,rpm,gentoo,nix,snap,flatpak,appimage,freebsd"; fi
           echo "list=$(echo "$PMS" | sed 's/chocolatey,*//g')" >> "$GITHUB_OUTPUT"
 
       - name: Refresh + submit manifests
         env:
-          DRY_RUN: ${{ github.event.inputs.dry_run }}
+          # A release calls this with dry_run=false. This previously read
+          # github.event.inputs.dry_run, which is empty on anything but a
+          # workflow_dispatch, so the "!= false" test below appended --dry-run on
+          # every release run: the submit path could never have executed even if
+          # the trigger had worked.
+          DRY_RUN: ${{ inputs.dry_run }}
           GH_TOKEN: ${{ github.token }}
           AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          SCOOP_BUCKET_TOKEN: ${{ secrets.SCOOP_BUCKET_TOKEN }}
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
         run: |
           ARGS="-v ${{ steps.v.outputs.version }}"
           for PM in $(echo "${{ steps.pms.outputs.list }}" | tr ',' ' '); do ARGS="$ARGS -p $PM"; done
-          # Default to dry-run unless explicitly disabled AND submit secrets exist.
           if [ "$DRY_RUN" != "false" ]; then ARGS="$ARGS --dry-run"; fi
           node scripts/submit-packages.mjs $ARGS
 
+      # The refreshed manifests are the input to every future submission, so they
+      # have to outlive the runner. Without this they were rewritten and thrown
+      # away, which is why distribution/ still said 0.1.0 at release 3.15.0.
+      - name: Open a PR with the refreshed manifests
+        if: ${{ inputs.dry_run != true }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.v.outputs.version }}
+        run: bash scripts/open-distribution-pr.sh
+
   # Chocolatey publishes from Windows.
   submit-chocolatey:
     runs-on: windows-latest
     name: Submit (Chocolatey)
     if: >-
-      github.event.inputs.package_managers == 'all' ||
-      github.event.inputs.package_managers == '' ||
-      github.event_name == 'release' ||
-      contains(github.event.inputs.package_managers, 'chocolatey')
+      inputs.package_managers == 'all' ||
+      inputs.package_managers == '' ||
+      contains(inputs.package_managers, 'chocolatey')
     steps:
       - uses: actions/checkout@v5
       - name: Resolve version
         id: v
         shell: bash
-        run: |
-          if [ -n "${{ github.event.inputs.version }}" ]; then V="${{ github.event.inputs.version }}"; else V="${{ github.event.release.tag_name }}"; fi
-          echo "version=${V#v}" >> "$GITHUB_OUTPUT"
-      - name: Refresh chocolatey manifest
+        env:
+          V_IN: ${{ inputs.version }}
+        run: echo "version=${V_IN#v}" >> "$GITHUB_OUTPUT"
+      - name: Refresh + submit chocolatey manifest
         shell: bash
         env:
+          # Was hardcoded --dry-run, so chocolatey could never publish regardless
+          # of trigger or credentials.
+          DRY_RUN: ${{ inputs.dry_run }}
           CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
-        run: node scripts/submit-packages.mjs -v ${{ steps.v.outputs.version }} -p chocolatey --dry-run
+        run: |
+          ARGS="-v ${{ steps.v.outputs.version }} -p chocolatey"
+          if [ "$DRY_RUN" != "false" ]; then ARGS="$ARGS --dry-run"; fi
+          node scripts/submit-packages.mjs $ARGS

distribution/aur/PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Profullstack, Inc. <security@profullstack.com>
 # AUR binary package — consumes the GitHub release tarball.
 pkgname=tronbrowser-bin
-pkgver=0.1.0
+pkgver=3.15.0
 pkgrel=1
 pkgdesc="Open-source, privacy-first, AI-native browser (Ungoogled Chromium fork)"
 arch=('x86_64')
@@ -11,7 +11,7 @@ depends=('chromium')
 provides=('tronbrowser')
 conflicts=('tronbrowser')
 source=("tronbrowser-${pkgver}.tar.gz::https://github.com/profullstack/tronbrowser.dev/releases/download/v${pkgver}/tronbrowser-linux-x64.tar.gz")
-sha256sums=('d966a54a6369ec283203abd257f89e50844ff68551229a463f568dc638dcf4c7')
+sha256sums=('0870fc5fd4b7acdfa1679f542d038a34e932b65721918cb4c1071e7a6b008779')
 
 package() {
   install -dm755 "${pkgdir}/usr/lib/tronbrowser"

distribution/homebrew/tronbrowser.rb

@@ -4,17 +4,17 @@
 class Tronbrowser < Formula
   desc "Open-source, privacy-first, AI-native browser (Ungoogled Chromium fork)"
   homepage "https://tronbrowser.dev"
-  version "0.1.0"
+  version "3.15.0"
   license "MIT"
 
   on_macos do
-    url "https://github.com/profullstack/tronbrowser.dev/releases/download/v0.1.0/tronbrowser-macos.zip"
+    url "https://github.com/profullstack/tronbrowser.dev/releases/download/v3.15.0/tronbrowser-macos.zip"
     sha256 "4f928b90b83a34d90edf6f3b4f522c47b85090046424ce69cc535a0cb85d77d1"
   end
 
   on_linux do
-    url "https://github.com/profullstack/tronbrowser.dev/releases/download/v0.1.0/tronbrowser-linux-x64.tar.gz"
-    sha256 "d966a54a6369ec283203abd257f89e50844ff68551229a463f568dc638dcf4c7"
+    url "https://github.com/profullstack/tronbrowser.dev/releases/download/v3.15.0/tronbrowser-linux-x64.tar.gz"
+    sha256 "0870fc5fd4b7acdfa1679f542d038a34e932b65721918cb4c1071e7a6b008779"
   end
 
   def install

distribution/scoop/tronbrowser.json

@@ -1,20 +1,20 @@
 {
-  "version": "0.1.0",
+  "version": "3.15.0",
   "description": "Open-source, privacy-first, AI-native browser (Ungoogled Chromium fork).",
   "homepage": "https://tronbrowser.dev",
   "license": "MIT",
   "architecture": {
     "64bit": {
-      "url": "https://github.com/profullstack/tronbrowser.dev/releases/download/v0.1.0/tronbrowser-win-x64.zip",
-      "hash": "TODO-needs-windows-build"
+      "url": "https://github.com/profullstack/tronbrowser.dev/releases/download/v3.15.0/tronbrowser-win-x64.zip",
+      "hash": "ebb5b0c7675255accc9975e0ac31a542cb9c9eb1bb700eac18fce8cca681f82c"
     }
   },
   "bin": [["tronbrowser/tronbrowser.exe", "tron"], ["tronbrowser/tronbrowser.exe", "tronbrowser"]],
   "checkver": "github",
   "autoupdate": {
     "architecture": {
       "64bit": {
-        "url": "https://github.com/profullstack/tronbrowser.dev/releases/download/v$version/tronbrowser-win-x64.zip"
+        "url": "https://github.com/profullstack/tronbrowser.dev/releases/download/v3.15.0/tronbrowser-win-x64.zip"
       }
     }
   }

distribution/snap/snapcraft.yaml

@@ -2,7 +2,7 @@
 # and exec the host's Chromium. `snapcraft` builds; publish with `snapcraft upload`.
 name: tronbrowser
 base: core24
-version: '0.1.1'
+version: '3.15.0'
 summary: Privacy-first, AI-native browser (Ungoogled Chromium fork)
 description: |
   Open-source, privacy-first, AI-native web browser built on Ungoogled Chromium.
@@ -20,6 +20,6 @@ apps:
 parts:
   tronbrowser:
     plugin: dump
-    source: https://github.com/profullstack/tronbrowser.dev/releases/download/v0.1.1/tronbrowser-linux-x64.tar.gz
+    source: https://github.com/profullstack/tronbrowser.dev/releases/download/v3.15.0/tronbrowser-linux-x64.tar.gz
     organize:
       'tronbrowser/*': './'

distribution/winget/Profullstack.TronBrowser.installer.yaml

@@ -2,12 +2,12 @@
 # manifests/p/Profullstack/TronBrowser/<version>/. Needs a Windows installer
 # (.exe/.msi) or a portable zip artifact — pending the Windows build.
 PackageIdentifier: Profullstack.TronBrowser
-PackageVersion: 0.1.0
+PackageVersion: 3.15.0
 InstallerType: zip
 Installers:
   - Architecture: x64
-    InstallerUrl: https://github.com/profullstack/tronbrowser.dev/releases/download/v0.1.0/tronbrowser-win-x64.zip
-    InstallerSha256: TODO-NEEDS-WINDOWS-BUILD
+    InstallerUrl: https://github.com/profullstack/tronbrowser.dev/releases/download/v3.15.0/tronbrowser-win-x64.zip
+    InstallerSha256: EBB5B0C7675255ACCC9975E0AC31A542CB9C9EB1BB700EAC18FCE8CCA681F82C
     NestedInstallerType: portable
     NestedInstallerFiles:
       - RelativeFilePath: tronbrowser\tronbrowser.exe

scripts/open-distribution-pr.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Open a PR with the manifests submit-packages.mjs just refreshed.
+#
+# Why this exists: the refresh rewrites files under distribution/ on the runner
+# and nothing ever persisted them, so every manifest in git stayed frozen at the
+# version it was scaffolded with (0.1.0/0.1.1) while releases went out to 3.15.0.
+# Those manifests are the input to every channel's submission, so a stale tree
+# means even a working submit publishes the wrong version.
+#
+# A PR rather than a push to main: main is protected, and a bad checksum should
+# be reviewable before it reaches a package manager.
+set -euo pipefail
+
+: "${VERSION:?VERSION must be set}"
+
+if git diff --quiet -- distribution; then
+  echo "distribution/ already current for v${VERSION}, nothing to commit"
+  exit 0
+fi
+
+git config user.name "github-actions[bot]"
+git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+BRANCH="chore/distribution-${VERSION}"
+
+# A re-run of the same release must not fail on an existing branch.
+if git ls-remote --exit-code --heads origin "${BRANCH}" >/dev/null 2>&1; then
+  echo "branch ${BRANCH} already exists on origin; force-updating it"
+  git checkout -B "${BRANCH}"
+  git add distribution
+  git commit -m "chore(distribution): refresh manifests for v${VERSION}"
+  git push --force-with-lease origin "${BRANCH}"
+else
+  git checkout -b "${BRANCH}"
+  git add distribution
+  git commit -m "chore(distribution): refresh manifests for v${VERSION}"
+  git push origin "${BRANCH}"
+fi
+
+# `gh pr create` fails if one is already open for the branch, which is fine.
+gh pr create \
+  --base main \
+  --head "${BRANCH}" \
+  --title "chore(distribution): refresh manifests for v${VERSION}" \
+  --body "Automated manifest refresh from the release pipeline for v${VERSION}.
+
+Version strings and sha256 checksums are rewritten from the published release
+assets by \`scripts/submit-packages.mjs\`." \
+  || echo "a PR for ${BRANCH} already exists; branch updated in place"