ci(release): move checksums to integrity tsv (2026.6.15.0-7E63)

Author: RealWhyKnot

.github/RELEASE_WORKFLOW.md

@@ -29,9 +29,9 @@ integrity TSV are emitted under `dist/` for the workflow to upload.
 ## Body composition
 
 The release body is the verbatim output of
-[Generate-ReleaseNotes.ps1](scripts/Generate-ReleaseNotes.ps1). The body keeps
-a bare `SHA256: <hash>` line for older updaters; the full integrity table is
-uploaded as `WKVRCProxy-v<version>.integrity.tsv`. Layout:
+[Generate-ReleaseNotes.ps1](scripts/Generate-ReleaseNotes.ps1). The body points
+readers at `WKVRCProxy-v<version>.integrity.tsv`; the checksum values live in
+that TSV asset. Layout:
 
 ```
 # WKVRCProxy <tag>
@@ -46,11 +46,9 @@ uploaded as `WKVRCProxy-v<version>.integrity.tsv`. Layout:
 
 **Full Changelog**: <compare-url>
 
-SHA256: <hash>
-
 ## File integrity
 
-Full SHA256 hashes are attached as `<integrity asset>`.
+Full SHA256 hashes are attached as `<integrity TSV>`.
 
 [Additional notes (extras file, if present)]
 ```

.github/scripts/Generate-ReleaseNotes.ps1

@@ -10,8 +10,7 @@
     1. Title (h1: "<repo> <tag>")
     2. What's Changed (auto-changelog from the commit slice between prev tag
        and this tag; bucketed by conventional-commit prefix)
-    3. File integrity (legacy bare SHA256 line plus a pointer to the attached
-       integrity TSV asset)
+    3. File integrity (pointer to the attached integrity TSV asset)
     4. More (from .github/release-template/links.md, with token substitution)
     5. Install (fresh) (from .github/release-template/install.md)
     6. Uninstall (from .github/release-template/uninstall.md)
@@ -73,7 +72,7 @@
 .PARAMETER Manifest
   Path to the per-file manifest emitted by build.ps1 alongside the zip.
   Tab-separated <sha256>\t<size_bytes>\t<relative_path> per line. Used
-  to compose the inner-file rows of the File integrity section.
+  to confirm that the integrity TSV asset can cover the release contents.
   Required (along with -ZipPath, -ZipSize, -ZipSha256) for the File
   integrity section to render; otherwise that section is skipped.
 
@@ -566,15 +565,12 @@ if ($Repo -and $prevTag) {
 }
 
 # --- File integrity ---
-# Keep a bare SHA256 line in the body for older updaters. Full integrity data
-# is published as a separate .integrity.tsv release asset.
+# Full integrity data is published as a separate .integrity.tsv release asset.
 $includeIntegrity = $ZipPath -and $ZipSha256 -and $ZipSize -gt 0 -and $Manifest -and (Test-Path -LiteralPath $Manifest)
 if ($includeIntegrity) {
     $zipNameForLine = if ($zipNameToken) { $zipNameToken } else { Split-Path -Leaf $ZipPath }
     $integrityName = $zipNameForLine -replace '\.zip$', '.integrity.tsv'
     [void]$sb.AppendLine()
-    [void]$sb.AppendLine("SHA256: $($ZipSha256.ToUpper())")
-    [void]$sb.AppendLine()
     [void]$sb.AppendLine("## File integrity")
     [void]$sb.AppendLine()
     [void]$sb.AppendLine("Full SHA256 hashes are attached as ``$integrityName``.")

.github/scripts/Test-GenerateReleaseNotes.ps1

@@ -159,8 +159,8 @@ try {
             -Manifest $manifestPath `
             -SkipScrub) -join "`n"
 
-    Assert-Contains -Text $IntegrityNotes -Expected "SHA256: $zipSha"
     Assert-Contains -Text $IntegrityNotes -Expected 'WKVRCProxy-v2026.5.3.0.integrity.tsv'
+    Assert-NotContains -Text $IntegrityNotes -Unexpected "SHA256: $zipSha"
     Assert-NotContains -Text $IntegrityNotes -Unexpected 'WKVRCProxy.exe                        '
 
     Write-Host 'Generate-ReleaseNotes tests passed.'

.github/workflows/release.yml

@@ -8,7 +8,7 @@ name: Release
 # zip filename all match the tag. build.ps1 validates the shape and fails fast on a malformed tag.
 # Builds the full distribution via build.ps1 on a Windows runner — required because the build
 # produces win-x64 exes and uses PowerShell-only cmdlets — then attaches the zip
-# from dist/ to a GitHub release with a SHA256 line so updater.exe can verify the download.
+# from dist/ to a GitHub release with an integrity TSV so updater.exe can verify the download.
 #
 # Changelog promotion: before the build runs, .github/scripts/Update-Changelog.ps1 renames the
 # "## Unreleased" heading in CHANGELOG.md to "## [vTAG] - DATE", linking
@@ -141,7 +141,7 @@ jobs:
           Write-Host "Release zip:      $($zip.Name)"
           Write-Host "Release manifest: $($manifest.Name)"
           Write-Host "Integrity asset:  $integrityName"
-          Write-Host "SHA256:           $hash"
+          Write-Host "Zip digest:       $hash"
 
       - name: Generate release body
         id: changelog
@@ -155,9 +155,9 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           # Composes the full release body: title + auto-changelog slice +
-          # legacy zip SHA + integrity-asset pointer + four
-          # templated evergreen sections (More / Install / Uninstall / What
-          # you need to do) + optional .github/release-extras/<tag>.md.
+          # integrity-asset pointer + four templated evergreen sections
+          # (More / Install / Uninstall / What you need to do) + optional
+          # .github/release-extras/<tag>.md.
           # See .github/scripts/Generate-ReleaseNotes.ps1 for filtering rules,
           # token substitution, and scrub gates.
           $body = & ./.github/scripts/Generate-ReleaseNotes.ps1 `

src/WKVRCProxy.Tests/UpdaterShaTests.cs

@@ -7,9 +7,9 @@
 
 namespace WKVRCProxy.Tests;
 
-// Updater's SHA256-line regex extraction + ComputeSha256 + tag-version
-// parsing. These are the gates between "tampered/corrupted zip" and
-// "installed-on-user-machine" — a regression here lets bad zips through.
+// Updater checksum extraction + ComputeSha256 + tag-version parsing. These
+// are the gates between "tampered/corrupted zip" and "installed-on-user-
+// machine"; a regression here lets bad zips through.
 public class UpdaterShaTests
 {
     [Fact]

src/WKVRCProxy.Updater/Program.cs

@@ -252,8 +252,8 @@ internal static Version ParseTagVersion(string tag)
         if (string.IsNullOrEmpty(zipUrl))
             throw new InvalidOperationException("No .zip asset on latest release.");
 
-        // Pull the SHA256: <hex> line out of the release body. release.yml
-        // always emits one; releases published by other paths won't.
+        // Prefer the integrity TSV asset, then GitHub's asset digest. Keep
+        // the body parser as a compatibility fallback for older releases.
         string body = releaseElement.TryGetProperty("body", out var b) ? (b.GetString() ?? "") : "";
         string? sha = await ResolveExpectedZipShaAsync(http, zipName, zipDigest, integrityUrl, body)
             .ConfigureAwait(false);