[Microck]

Problem

The v2.6.0 SHA256SUMS refers to release-artifacts/opencode-studio-server-2.6.0.tgz, so sha256sum -c SHA256SUMS fails when both downloaded assets are in the same directory, even though their digests match.

Change

Generate checksums from inside the artifact directory and add a regression that verifies the manifest from that directory. Local synthetic checksum verification passed.

This changes future release generation; it does not replace the already-published v2.6.0 checksum asset. npm publication for v2.6.0 is separately blocked by a publish E404 and remains unverified. Draft pending CI and review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
opencode-studio	Ready	Preview	Nov 12, 2026 11:32am UTC

[Microck]

@coderabbitai review

[coderabbitai]

Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review.

This PR makes release checksum generation portable by writing SHA256SUMS from inside the artifact directory.

• Release packaging now calls scripts/write-release-checksums.sh release-artifacts. The script changes into the supplied directory and runs sha256sum -- *.tgz > SHA256SUMS, so manifest entries use bare filenames that sha256sum -c resolves when assets share a directory.
• The regression workflow runs the new scripts/test-release-checksums.sh after the client build. That test creates a synthetic .tgz, generates the manifest, and verifies it with sha256sum -c.
• Compatibility: the published v2.6.0 SHA256SUMS is not replaced. Only future releases use the new manifest format. npm publication for v2.6.0 remains unverified.

Reviewer actions:

• Confirm the CI regression job passes on the current head. The PR is a draft, and no completed check results were supplied.
• Note that the new test uses a synthetic file. It does not verify a real release artifact.

Walkthrough

The release workflow now uses scripts/write-release-checksums.sh to generate SHA256SUMS for release artifacts. The regression workflow runs a new script that creates a synthetic package, generates its checksums, and verifies them with sha256sum -c.

Merge Risk: Minimal · up to 944af

Future releases will produce a checksum manifest that verifies when the assets are downloaded into the same directory. No merge-blocking risk remains. The published v2.6.0 checksum asset is not changed by this PR.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ef5c39e0-9c71-4438-a450-87e7af7936ec

Commits

Reviewing files that changed from the base of the PR and between 1a8315f and 944af8e.

Files selected for processing: 3

• .github/workflows/regression.yml
• scripts/test-release-checksums.sh
• scripts/write-release-checksums.sh

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 0 remain after this review.