Add channel-aware release tooling and updater recovery

.gitea/workflows/release-status.yml

@@ -0,0 +1,75 @@
+name: Publish launcher release status
+
+on:
+  # Manual-release mode is active. Restore the status-file push trigger when
+  # automatic channel/history publication is wanted again.
+  workflow_dispatch:
+
+concurrency:
+  group: launcher-release-publication
+  cancel-in-progress: false
+
+jobs:
+  history:
+    name: Sign and publish release history
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write
+
+    steps:
+      - name: Check out trusted release metadata
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref }}
+
+      - name: Validate release status configuration
+        shell: bash
+        run: |
+          set -euo pipefail
+          for command in git bash curl jq python3 openssl base64 realpath stat
+          do
+            command -v "$command" >/dev/null || {
+              printf 'Required metadata command is unavailable: %s\n' "$command" >&2
+              exit 1
+            }
+          done
+          python3 -c 'import sys; raise SystemExit(0 if sys.version_info >= (3, 11) else 1)'
+          python3 -m compileall -q ptlinux scripts
+          python3 scripts/generate_history.py --help >/dev/null
+          bash -n scripts/publish-release-history.sh
+
+      - name: Materialize the protected manifest signing key
+        shell: bash
+        env:
+          MANIFEST_SIGNING_KEY: ${{ secrets.MANIFEST_SIGNING_KEY }}
+        run: |
+          set -euo pipefail
+          if [[ -z "${MANIFEST_SIGNING_KEY:-}" ]]
+          then
+            printf '%s\n' 'MANIFEST_SIGNING_KEY is required for metadata publication.' >&2
+            exit 1
+          fi
+          umask 077
+          SIGNING_KEY_FILE="${RUNNER_TEMP}/launcher-manifest-signing-key.pem"
+          printf '%s\n' "$MANIFEST_SIGNING_KEY" > "$SIGNING_KEY_FILE"
+          chmod 0600 "$SIGNING_KEY_FILE"
+          printf 'PTLINUX_SIGNING_KEY=%s\n' "$SIGNING_KEY_FILE" >> "$GITHUB_ENV"
+
+      - name: Publish signed release status and history
+        shell: bash
+        env:
+          RELEASE_BRANCH: main
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+        run: |
+          set -euo pipefail
+          ./scripts/publish-release-history.sh ./dist/status
+
+      - name: Remove signing key
+        if: always()
+        shell: bash
+        run: |
+          if [[ -n "${PTLINUX_SIGNING_KEY:-}" ]]
+          then
+            rm -f -- "$PTLINUX_SIGNING_KEY"
+          fi