From 179bf14f49030149674bd6b15040f7900dfb8aef Mon Sep 17 00:00:00 2001
From: Logan Nguyen <lg.131.dev@gmail.com>
Date: Sun, 17 May 2026 21:58:57 -0500
Subject: [PATCH] fix(updater): embed full release changelog in updater
 manifest

Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com>
---
 .github/workflows/release-please.yml | 40 +++++++++++++++++++---------
 1 file changed, 27 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index bd206a0c..8fa75b6d 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -120,25 +120,39 @@ jobs:
       - name: Generate updater manifest
         env:
           TAG: ${{ needs.release-please.outputs.tag_name }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         working-directory: src-tauri/target/release/bundle/macos
         run: |
           VERSION="${TAG#v}"
           PAYLOAD="Thuki_${VERSION}_aarch64.app.tar.gz"
           SIG="$(cat "${PAYLOAD}.sig")"
           PUB_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-          cat > latest.json <<EOF
-          {
-            "version": "${VERSION}",
-            "notes": "https://github.com/quiet-node/thuki/releases/tag/${TAG}",
-            "pub_date": "${PUB_DATE}",
-            "platforms": {
-              "darwin-aarch64": {
-                "signature": "${SIG}",
-                "url": "https://github.com/quiet-node/thuki/releases/download/${TAG}/${PAYLOAD}"
-              }
-            }
-          }
-          EOF
+          DOWNLOAD_URL="https://github.com/quiet-node/thuki/releases/download/${TAG}/${PAYLOAD}"
+
+          # Embed the full release-please changelog (the GitHub Release body
+          # for this tag) so the in-app updater shows the real notes instead
+          # of a bare link. release-please always creates this release with a
+          # non-empty body before this job runs, so an empty body means
+          # something upstream broke: fail loudly rather than ship a manifest
+          # whose notes are blank.
+          gh release view "$TAG" --json body --jq .body > release-notes.md
+          if [ ! -s release-notes.md ]; then
+            echo "::error::GitHub Release body for ${TAG} is empty; refusing to publish a manifest with no notes." >&2
+            exit 1
+          fi
+
+          # jq --rawfile keeps newlines, quotes, backticks and $ in the
+          # changelog JSON-safe (the old heredoc interpolation could not).
+          jq -n \
+            --arg version "$VERSION" \
+            --rawfile notes release-notes.md \
+            --arg pub_date "$PUB_DATE" \
+            --arg sig "$SIG" \
+            --arg url "$DOWNLOAD_URL" \
+            '{version: $version, notes: $notes, pub_date: $pub_date, platforms: {"darwin-aarch64": {signature: $sig, url: $url}}}' \
+            > latest.json
+
+          rm -f release-notes.md
 
       - name: Install create-dmg
         run: brew install create-dmg