Update build_updatexml.yml

.github/workflows/build_updatexml.yml

@@ -14,9 +14,13 @@ on:
         description: "Filename to save the downloaded ZIP as. Required when asset_download_url is provided."
         required: false
         default: ""
+      release_tag:
+        description: "Release tag to attach dist/updates.xml to (manual runs only). Leave blank to skip attachment."
+        required: false
+        default: ""
 
 permissions:
-  contents: read
+  contents: write
 
 jobs:
   build-updates-xml:
@@ -108,42 +112,54 @@ jobs:
         run: |
           set -euo pipefail
 
-          python3 - <<'PY'
-          import os
-          import xml.etree.ElementTree as ET
-          from pathlib import Path
+          python3 -c $'import os
+import xml.etree.ElementTree as ET
+from pathlib import Path
 
-          template_path = Path(os.environ["TEMPLATE_PATH"])
-          out_path = Path(os.environ["OUTPUT_PATH"])
-          download_url = os.environ.get("DOWNLOAD_URL", "").strip()
-          sha256 = os.environ.get("SHA256", "").strip()
+template_path = Path(os.environ["TEMPLATE_PATH"])
+out_path = Path(os.environ["OUTPUT_PATH"])
+download_url = os.environ.get("DOWNLOAD_URL", "").strip()
+sha256 = os.environ.get("SHA256", "").strip()
 
-          if not template_path.is_file():
+if not template_path.is_file():
     raise SystemExit(f"Template not found: {template_path}")
-          if not download_url:
+if not download_url:
     raise SystemExit("Missing DOWNLOAD_URL")
-          if not sha256:
+if not sha256:
     raise SystemExit("Missing SHA256")
 
-          tree = ET.parse(template_path)
-          root = tree.getroot()
+tree = ET.parse(template_path)
+root = tree.getroot()
 
-          downloadurl_el = root.find(".//downloadurl")
-          sha256_el = root.find(".//sha256")
+downloadurl_el = root.find(".//downloadurl")
+sha256_el = root.find(".//sha256")
 
-          if downloadurl_el is None:
+if downloadurl_el is None:
     raise SystemExit("Template missing <downloadurl> element")
-          if sha256_el is None:
+if sha256_el is None:
     raise SystemExit("Template missing <sha256> element")
 
-          downloadurl_el.text = download_url
-          sha256_el.text = sha256
+downloadurl_el.text = download_url
+sha256_el.text = sha256
 
-          out_path.parent.mkdir(parents=True, exist_ok=True)
-          tree.write(out_path, encoding="utf-8", xml_declaration=True)
+out_path.parent.mkdir(parents=True, exist_ok=True)
+tree.write(out_path, encoding="utf-8", xml_declaration=True)
 
-          print(f"Wrote: {out_path}")
-					PY
+print(f"Wrote: {out_path}")
+'
+            - name: Attach updates.xml to GitHub Release
+        if: ${{ github.event_name == 'release' || github.event.inputs.release_tag != '' }}
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || github.event.inputs.release_tag }}
+        run: |
+          set -euo pipefail
+          if [ -z "$RELEASE_TAG" ]; then
+            echo "Missing release tag" >&2
+            exit 1
+          fi
+          gh release upload "$RELEASE_TAG" "dist/updates.xml" --clobber
 
       - name: Upload updates.xml artifact
         uses: actions/upload-artifact@v4
@@ -151,4 +167,6 @@ jobs:
           name: updates-xml
           path: dist/updates.xml
           if-no-files-found: error
-          retention-days: 7
+          # GitHub does not support indefinite artifact retention.
+          # This is set to the maximum allowed retention period.
+          retention-days: 90