dc
f1ae501d49
The release job now hashes every asset it uploads (frontend.zip, the SAS 9 and Viya deployment programs, the SASjs Server bundle) into a SHA256SUMS file with basename-only paths, and attaches it to the release alongside the assets. The release body gains a "Verifying the download" section - emitted by .gitea/scripts/verify-section.sh so the YAML scalar stays clean - with the sha256sum -c command and a note on what a checksum does and does not prove. The upload loop is rewritten from an inline list to a bash array shared by the hashing and upload steps, so the asset set cannot drift between what is hashed and what is uploaded. Simulated end to end locally (stubbed curl/jq): 8 uploads fire with correct paths, SHA256SUMS verifies with sha256sum -c, a tampered file fails the check, and the assembled release body keeps the existing notes with the new section and installation footer on their own lines.