[eric] release: every publish and download path names the public shell by literal, the release workflows publish with a shell-scoped token behind a fail-closed check, and a push runs only the Windows suite leg (ENG-516)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WFgFyiXdf8goqjeyckFLj8

scripts/release/check-shell-token.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+# The shell is the public repo every installed updater polls; a build repo's own workflow token cannot write to it.
+set -euo pipefail
+
+SHELL_REPO="${RELEASE_SHELL_REPO:-openswarm-ai/openswarm}"
+
+if [ -z "${GH_TOKEN:-}" ]; then
+    echo "RELEASE_SHELL_TOKEN is not set: this run cannot publish into $SHELL_REPO" >&2
+    exit 1
+fi
+if ! gh api "repos/$SHELL_REPO" --jq '.full_name' >/dev/null; then
+    echo "the release token cannot read $SHELL_REPO" >&2
+    exit 1
+fi
+if [ "$(gh api "repos/$SHELL_REPO" --jq '.permissions.push')" != "true" ]; then
+    echo "the release token cannot write to $SHELL_REPO, so the release would land nowhere" >&2
+    exit 1
+fi
+gh release list --repo "$SHELL_REPO" --limit 1 >/dev/null
+echo "release shell $SHELL_REPO is reachable with write access"

scripts/release/sync-shell.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+# Publishes release-shell/ as the only content of the public shell's main. Tags and releases are never touched:
+# every installed updater and every download link reads them from this repo, and a deleted tag takes its release with it.
+set -euo pipefail
+
+SHELL_REPO="${RELEASE_SHELL_REPO:-openswarm-ai/openswarm}"
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+MODE="${1:---dry-run}"
+case "$MODE" in
+    --dry-run|--apply|--apply-and-prune) ;;
+    *) echo "usage: sync-shell.sh [--dry-run|--apply|--apply-and-prune]" >&2; exit 2 ;;
+esac
+
+cmp -s "$ROOT/scripts/release/verify-release.js" "$ROOT/release-shell/scripts/release/verify-release.js" \
+    || { echo "release-shell/scripts/release/verify-release.js drifted from scripts/release/verify-release.js" >&2; exit 1; }
+cmp -s "$ROOT/electron/build/icon.ico" "$ROOT/release-shell/electron/build/icon.ico" \
+    || { echo "release-shell/electron/build/icon.ico drifted from electron/build/icon.ico" >&2; exit 1; }
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+git init -q "$WORK"
+cp -R "$ROOT/release-shell/." "$WORK/"
+(cd "$WORK" && git add -A && git -c user.name=openswarm -c user.email=releases@openswarm.com commit -q -m "releases shell, synced $(date -u +%Y-%m-%d)")
+
+echo "== $SHELL_REPO main would carry:"
+(cd "$WORK" && git ls-files | sed 's/^/   /')
+others="$(gh api "repos/$SHELL_REPO/branches?per_page=100" --paginate --jq '.[].name' | grep -vx main || true)"
+echo "== branches on $SHELL_REPO other than main: $(printf '%s\n' "$others" | grep -c . || true)"
+echo "== tags on $SHELL_REPO (kept): $(gh api "repos/$SHELL_REPO/tags?per_page=100" --paginate --jq '.[].name' | grep -c . || true)"
+
+if [ "$MODE" = "--dry-run" ]; then
+    echo "dry run: nothing pushed, nothing deleted"
+    exit 0
+fi
+
+(cd "$WORK" && git push --force "https://github.com/$SHELL_REPO.git" HEAD:refs/heads/main)
+echo "pushed release-shell/ as $SHELL_REPO main"
+
+if [ "$MODE" = "--apply-and-prune" ]; then
+    for b in $others; do
+        gh api -X DELETE "repos/$SHELL_REPO/git/refs/heads/$b" >/dev/null && echo "deleted branch $b"
+    done
+fi