Add SHA256 checksum generation to release builds (#1994)

* Add SHA256 checksum generation to release builds

- Create reusable generate_checksums action in .github/actions
- Update desktop_cd.yaml publish job to generate checksums for all artifacts
- Checksums are uploaded to GitHub Releases alongside binaries

Co-Authored-By: yujonglee <[email protected]>

* Add required name and description fields to generate_checksums action

Co-Authored-By: yujonglee <[email protected]>

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: yujonglee

.github/actions/generate_checksums/action.yaml

@@ -0,0 +1,43 @@
+name: "Generate SHA256 Checksums"
+description: "Generate SHA-256 checksum files for build artifacts"
+
+inputs:
+  files:
+    description: "Newline-separated list of files to generate checksums for"
+    required: true
+
+outputs:
+  checksum_files:
+    description: "Comma-separated list of generated checksum files"
+    value: ${{ steps.generate.outputs.checksum_files }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: generate
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        CHECKSUM_FILES=""
+
+        while IFS= read -r file; do
+          if [[ -z "$file" ]]; then
+            continue
+          fi
+
+          if [[ ! -f "$file" ]]; then
+            echo "File not found for checksum: $file" >&2
+            exit 1
+          fi
+
+          sha256sum "$file" > "${file}.sha256"
+
+          if [[ -n "$CHECKSUM_FILES" ]]; then
+            CHECKSUM_FILES="${CHECKSUM_FILES},${file}.sha256"
+          else
+            CHECKSUM_FILES="${file}.sha256"
+          fi
+        done <<< "${{ inputs.files }}"
+
+        echo "checksum_files=$CHECKSUM_FILES" >> "$GITHUB_OUTPUT"

.github/workflows/desktop_cd.yaml

@@ -305,6 +305,13 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           custom_tag: desktop_v${{ needs.compute-version.outputs.version }}
           tag_prefix: ""
+      - id: checksums
+        uses: ./.github/actions/generate_checksums
+        with:
+          files: |
+            ${{ needs.build-macos.result == 'success' && 'hyprnote-macos-aarch64.dmg' || '' }}
+            ${{ needs.build-macos.result == 'success' && 'hyprnote-macos-x86_64.dmg' || '' }}
+            ${{ needs.build-linux.result == 'success' && 'hyprnote-linux-x86_64.AppImage' || '' }}
       - id: artifacts
         run: |
           ARTIFACTS=""
@@ -322,6 +329,9 @@ jobs:
             echo "No artifacts to release" >&2
             exit 1
           fi
+          if [[ -n "${{ steps.checksums.outputs.checksum_files }}" ]]; then
+            ARTIFACTS="$ARTIFACTS,${{ steps.checksums.outputs.checksum_files }}"
+          fi
           echo "list=$ARTIFACTS" >> $GITHUB_OUTPUT
       - uses: ncipollo/release-action@v1
         with: