fix(release): ship Windows as x86_64 only, as 0.4.1

.github/RELEASE_NOTES.md

@@ -1,10 +1,10 @@
-**deed** is a command line for nostr, built in Zig. It runs on macOS, Linux and Windows, on both Intel and ARM. The Linux binaries are statically linked, so there is no glibc version to satisfy. The macOS binaries are **ad-hoc signed, not notarized**, which means a download that came through a browser needs `xattr -dr com.apple.quarantine` before it will run. The Windows builds are zips holding `deed.exe`, which is not code-signed.
+**deed** is a command line for nostr, built in Zig. It runs on macOS and Linux, on both Intel and ARM, and on Windows. The Linux binaries are statically linked, so there is no glibc version to satisfy. The macOS binaries are **ad-hoc signed, not notarized**, which means a download that came through a browser needs `xattr -dr com.apple.quarantine` before it will run. The Windows builds are zips holding `deed.exe`, which is not code-signed.
 
 Every artifact below is published with a `.sha256` beside it, so the download can be checked against a digest that was written by the same job that built it.
 
-### What's new in v0.4.0
+### What's new in v0.4.1
 
-**deed runs on Windows.** Each release now carries a zip for x86_64 and one for ARM, holding `deed.exe`, with a `.sha256` beside each. The nostr library underneath builds and passes its tests on Windows too, including the read deadline that `req` and `fetch --timeout` rely on.
+**deed runs on Windows.** Each release now carries a zip for x86_64 holding `deed.exe`, with a `.sha256` beside it. Windows on ARM runs it too, under the system's x86_64 emulation; a native ARM build is not shipped yet because it crashes at startup. The nostr library underneath builds and passes its tests on Windows too, including the read deadline that `req` and `fetch --timeout` rely on.
 
 **A new store's directories are made for you, and a store that will not open says why.** `--store ~/.deed/db` used to need `~/.deed` to exist already, and a store that failed to open printed only an error name. deed now creates the missing directories and names the reason: no permission, not a store, or a directory where the file should be. `--local` only reads, so it never creates an empty store at a mistyped path.
 

.github/workflows/ci.yml

@@ -72,9 +72,13 @@ jobs:
       # Asking only whether the script parses would pass on an installer that
       # downloads the wrong file or verifies nothing.
       - name: The installer installs a release, and it runs
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          tag="$(git tag --sort=-v:refname --list 'v*' | head -1)"
+          # The newest PUBLISHED release, not the newest tag: a tag whose
+          # release is still a draft has nothing a reader could download.
+          tag="$(gh release list --repo "$GITHUB_REPOSITORY" --exclude-drafts --exclude-pre-releases --limit 1 --json tagName --jq '.[0].tagName // empty')"
           if [ -z "$tag" ]; then
             echo "no release tag exists yet, so the installer was NOT exercised" >&2
             exit 1
@@ -92,9 +96,12 @@ jobs:
       # refused and must install nothing, because a checksum that is checked and
       # then ignored is worse than none: it reads as a promise.
       - name: A download that does not verify is refused
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          tag="$(git tag --sort=-v:refname --list 'v*' | head -1)"
+          tag="$(gh release list --repo "$GITHUB_REPOSITORY" --exclude-drafts --exclude-pre-releases --limit 1 --json tagName --jq '.[0].tagName // empty')"
+          [ -n "$tag" ] || { echo "no published release to tamper with" >&2; exit 1; }
           work="$RUNNER_TEMP/tamper"
           mkdir -p "$work"
           case "$(uname -s)" in

.github/workflows/release.yml

@@ -82,14 +82,13 @@ jobs:
           v="${{ steps.version.outputs.version }}"
           mkdir -p dist
 
-          for target in aarch64-macos-none x86_64-macos-none x86_64-linux-musl aarch64-linux-musl x86_64-windows-gnu aarch64-windows-gnu; do
+          for target in aarch64-macos-none x86_64-macos-none x86_64-linux-musl aarch64-linux-musl x86_64-windows-gnu; do
             case "$target" in
               aarch64-macos-none)   name=macos-aarch64 ;;
               x86_64-macos-none)    name=macos-x86_64 ;;
               x86_64-linux-musl)    name=linux-x86_64 ;;
               aarch64-linux-musl)   name=linux-aarch64 ;;
               x86_64-windows-gnu)   name=windows-x86_64 ;;
-              aarch64-windows-gnu)  name=windows-aarch64 ;;
             esac
 
             rm -rf "out-$target"
@@ -226,8 +225,6 @@ jobs:
         include:
           - runner: windows-latest
             asset: windows-x86_64
-          - runner: windows-11-arm
-            asset: windows-aarch64
     runs-on: ${{ matrix.runner }}
     defaults:
       run:
@@ -292,11 +289,10 @@ jobs:
             "deed-$v-linux-x86_64.tar.gz" "deed-$v-linux-x86_64.tar.gz.sha256" \
             "deed-$v-macos-aarch64.tar.gz" "deed-$v-macos-aarch64.tar.gz.sha256" \
             "deed-$v-macos-x86_64.tar.gz" "deed-$v-macos-x86_64.tar.gz.sha256" \
-            "deed-$v-windows-aarch64.zip" "deed-$v-windows-aarch64.zip.sha256" \
             "deed-$v-windows-x86_64.zip" "deed-$v-windows-x86_64.zip.sha256" | sort)"
           actual="$(ls dist | sort)"
           diff <(printf '%s\n' "$expected") <(printf '%s\n' "$actual") \
-            || { echo "the release assets are not the twelve expected files" >&2; exit 1; }
+            || { echo "the release assets are not the ten expected files" >&2; exit 1; }
 
           for f in dist/*; do
             [ -s "$f" ] || { echo "$f is empty" >&2; exit 1; }
@@ -309,9 +305,9 @@ jobs:
           done
           # A glob that matched nothing would leave the loop body unrun and the
           # step green, having verified precisely nothing.
-          [ "$checked" = "6" ] || { echo "verified $checked checksums, expected 6" >&2; exit 1; }
+          [ "$checked" = "5" ] || { echo "verified $checked checksums, expected 5" >&2; exit 1; }
 
-          echo "twelve assets, all present, none empty, every digest matching"
+          echo "ten assets, all present, none empty, every digest matching"
 
       - name: Lift the draft, then read the page back
         env:
@@ -327,6 +323,6 @@ jobs:
           # Read the list again from the published release. What was checked in
           # the step above was the draft, and this is the page a reader opens.
           count="$(gh release view "$GITHUB_REF_NAME" --json assets --jq '.assets | length')"
-          [ "$count" = "12" ] || { echo "the published release carries $count assets, expected 12" >&2; exit 1; }
+          [ "$count" = "10" ] || { echo "the published release carries $count assets, expected 10" >&2; exit 1; }
 
           echo "published $GITHUB_REF_NAME"

README.md

@@ -19,7 +19,7 @@ For macOS and Linux, Intel and ARM; Windows is [below](#windows). It works out w
 The script is short and worth reading before you pipe anything into bash. If you would rather do it yourself:
 
 ```sh
-VERSION=0.4.0
+VERSION=0.4.1
 PLATFORM=macos-aarch64   # or macos-x86_64, linux-x86_64, linux-aarch64
 BASE=https://github.com/zig-nostr/deed/releases/download/v$VERSION
 
@@ -40,7 +40,7 @@ xattr -dr com.apple.quarantine deed
 
 ### Windows
 
-Windows takes a zip rather than the script. Download `deed-<version>-windows-x86_64.zip` (or `windows-aarch64` on an ARM machine) and the `.sha256` beside it from the [releases page](https://github.com/zig-nostr/deed/releases), then in PowerShell, from the folder they are in:
+Windows takes a zip rather than the script. Download `deed-<version>-windows-x86_64.zip` and the `.sha256` beside it from the [releases page](https://github.com/zig-nostr/deed/releases), then in PowerShell, from the folder they are in:
 
 ```powershell
 $zip = (Get-Item deed-*-windows-*.zip).Name

build.zig.zon

@@ -1,6 +1,6 @@
 .{
     .name = .deed,
-    .version = "0.4.0",
+    .version = "0.4.1",
     .fingerprint = 0x89498c2094a1a4a3,
     .minimum_zig_version = "0.16.0",
     .dependencies = .{

src/main.zig

@@ -16,7 +16,7 @@ const cmd_publish = @import("cmd_publish.zig");
 const cmd_req = @import("cmd_req.zig");
 const cmd_verify = @import("cmd_verify.zig");
 
-pub const version = "0.4.0";
+pub const version = "0.4.1";
 
 const usage =
     \\deed: the nostr command line