Add hardened auto-update with immutable release notes artifacts

.github/workflows/release.yml

@@ -183,6 +183,18 @@ jobs:
             opennow-stable/dist-release/*.deb
           if-no-files-found: error
 
+      - name: Upload updater metadata
+        if: matrix.label == 'windows' || matrix.label == 'macos-x64' || matrix.label == 'linux-x64'
+        uses: actions/upload-artifact@v4
+        with:
+          name: opennow-stable-${{ matrix.label }}-metadata
+          path: |
+            opennow-stable/dist-release/latest.yml
+            opennow-stable/dist-release/latest-mac.yml
+            opennow-stable/dist-release/latest-linux.yml
+            opennow-stable/dist-release/*.blockmap
+          if-no-files-found: error
+
   release:
     name: publish-release
     runs-on: blacksmith-2vcpu-ubuntu-2404
@@ -199,6 +211,38 @@ jobs:
           path: release-artifacts
           merge-multiple: true
 
+      - name: Verify release assets
+        shell: bash
+        run: |
+          shopt -s nullglob
+          package_assets=(release-artifacts/*.exe release-artifacts/*.dmg release-artifacts/*.zip release-artifacts/*.AppImage release-artifacts/*.deb)
+          metadata_assets=(
+            release-artifacts/latest.yml
+            release-artifacts/latest-mac.yml
+            release-artifacts/latest-linux.yml
+          )
+          blockmap_assets=(release-artifacts/*.blockmap)
+
+          if [[ ${#package_assets[@]} -eq 0 ]]; then
+            echo "No package assets were downloaded." >&2
+            exit 1
+          fi
+
+          required_metadata_files=(
+            release-artifacts/latest.yml
+            release-artifacts/latest-mac.yml
+            release-artifacts/latest-linux.yml
+          )
+          for required_file in "${required_metadata_files[@]}"; do
+            if [[ ! -f "$required_file" ]]; then
+              echo "Missing required updater metadata file: $required_file" >&2
+              exit 1
+            fi
+          done
+
+          echo "Release assets to publish:"
+          printf ' - %s\n' "${package_assets[@]}" "${metadata_assets[@]}" "${blockmap_assets[@]}"
+
       - name: Publish GitHub release
         uses: softprops/action-gh-release@v2
         with:
@@ -207,7 +251,17 @@ jobs:
           prerelease: ${{ needs.preflight.outputs.prerelease }}
           make_latest: ${{ needs.preflight.outputs.make_latest }}
           generate_release_notes: true
-          files: release-artifacts/**/*
+          fail_on_unmatched_files: true
+          files: |
+            release-artifacts/*.exe
+            release-artifacts/*.dmg
+            release-artifacts/*.zip
+            release-artifacts/*.AppImage
+            release-artifacts/*.deb
+            release-artifacts/latest.yml
+            release-artifacts/latest-mac.yml
+            release-artifacts/latest-linux.yml
+            release-artifacts/*.blockmap
 
   finalize:
     name: finalize-version-bump