feat(release): auto-publish cli builds to cloudflare r2 (#5)

Wire release.yml to call publish-r2.yml after a successful tag or
dispatch release. Upload archives, checksums, release JSON, and
checksum-verifying installers to software.cortex.foundation. Teach
cortex upgrade to parse the static R2 manifest layout.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Mathis <echobt@users.noreply.github.com>

Author: echobt

.github/workflows/publish-r2.yml

@@ -374,4 +374,24 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+  # ==========================================================================
+  # Publish binaries to software.cortex.foundation (Cloudflare R2)
+  # ==========================================================================
+  publish:
+    name: Publish to software.cortex.foundation
+    needs: [prepare, release]
+    if: success() && needs.release.result == 'success'
+    uses: ./.github/workflows/publish-r2.yml
+    with:
+      version: ${{ needs.prepare.outputs.version }}
+      channel: ${{ contains(needs.prepare.outputs.version, '-') && 'beta' || 'stable' }}
+      release_run_id: ${{ github.run_id }}
+    secrets:
+      R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+      R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+    permissions:
+      contents: read
+      actions: read
+
 

.github/workflows/release.yml

@@ -49,12 +49,22 @@ in your OS keyring.
 
 ### Linux and macOS
 
+The installer downloads the matching archive from
+[software.cortex.foundation](https://software.cortex.foundation), verifies its
+SHA-256, and installs to `~/.local/bin`. Review it first if you prefer:
+
 ```bash
+curl -fsSL https://software.cortex.foundation/install.sh | less
 curl -fsSL https://software.cortex.foundation/install.sh | sh
 ```
 
+Update an existing install with `cortex upgrade`. Pin a version with
+`CORTEX_VERSION=0.1.4` when running the installer.
+
 ### Windows
 
+Windows installs into `%LOCALAPPDATA%\Cortex\bin` after the same checksum check:
+
 ```powershell
 irm https://software.cortex.foundation/install.ps1 | iex
 ```
@@ -171,7 +181,8 @@ through `generate_tui_demo` and rasterises the frames into `docs/media/intro.gif
 
 Merges to `main` run [`.github/workflows/version-bump.yml`](.github/workflows/version-bump.yml),
 which patch-bumps the version and tags it. Tags run
-[`release.yml`](.github/workflows/release.yml), which can publish to
+[`release.yml`](.github/workflows/release.yml), which builds GitHub Release
+assets and **automatically** publishes them to Cloudflare R2 /
 [software.cortex.foundation](https://software.cortex.foundation) via
 [`publish-r2.yml`](.github/workflows/publish-r2.yml).
 

Cargo.lock

@@ -1,8 +1,8 @@
 # CI secrets
 
-This repository does not invent cloud accounts. The workflows imported from `CortexLM/cortex-code` already point at `cortex.foundation` / `software.cortex.foundation`. Configure these GitHub Actions secrets on `CortexLM/cli` only if the matching account already exists.
+This repository does not invent cloud accounts. Configure these GitHub Actions secrets and variables on `CortexLM/cli` only if the matching Cortex Foundation account already exists.
 
-None of these values belong in git.
+None of these values belong in git. Do not add AWS access keys or an IAM user for CLI binary publishing.
 
 ## Required for PR CI (`.github/workflows/ci.yml`)
 
@@ -16,21 +16,42 @@ No secrets. `fmt`, `clippy`, `test`, `audit`, and TUI jobs use the public crates
 
 ## Release artifacts (`.github/workflows/release.yml`)
 
-Builds `Cortex` binaries and attaches them to the GitHub Release. Uses `GITHUB_TOKEN` only.
+Fires on tag `v*` / `cli-v*` and on `workflow_dispatch` with a version. Builds `Cortex` binaries, creates a GitHub Release, then **automatically** calls `.github/workflows/publish-r2.yml` (`workflow_call`) so the same artifacts are published to `https://software.cortex.foundation`.
 
-Optional Linux deps (`libasound2-dev`) are installed in the job; no extra secrets.
+The GitHub Release job uses `GITHUB_TOKEN` only. Optional Linux deps (`libasound2-dev`) are installed in the build job; no extra secrets.
 
 ## Publish to software.cortex.foundation (`.github/workflows/publish-r2.yml`)
 
-The existing R2 publisher uploads to bucket `cortex-software` and public URLs under `https://software.cortex.foundation/v1/assets/...`.
+Production publisher. Uploads to Cloudflare R2 bucket `cortex-software` using **R2 API tokens** (not AWS IAM, not GitHub OIDC). Public URLs stay under `https://software.cortex.foundation`.
+
+Called automatically after a successful `release` job. Can also be run by hand (`workflow_dispatch`) to republish, passing the release workflow's `release_run_id`.
 
 | Secret | Used for |
 |--------|----------|
-| `R2_ACCESS_KEY_ID` | Cloudflare R2 access key (already used by cortex-code) |
+| `R2_ACCESS_KEY_ID` | Cloudflare R2 access key for bucket `cortex-software` |
 | `R2_SECRET_ACCESS_KEY` | Cloudflare R2 secret |
-| `CLOUDFLARE_ACCOUNT_ID` | R2 endpoint `https://$CLOUDFLARE_ACCOUNT_ID.r2.cloudflarestorage.com` |
+| `CLOUDFLARE_ACCOUNT_ID` | R2 S3 endpoint `https://$CLOUDFLARE_ACCOUNT_ID.r2.cloudflarestorage.com` |
+
+No GitHub Actions variables are required for this path. Do not configure `github-production-deploy`, `PRODUCTION_SOFTWARE_BUCKET`, or AWS keys for CLI binaries.
+
+### Public URL map
+
+Bucket root is the host root (`software.cortex.foundation`):
+
+| Object | Public URL |
+|--------|------------|
+| Unix installer | `https://software.cortex.foundation/install.sh` |
+| Windows installer | `https://software.cortex.foundation/install.ps1` |
+| Channel manifest | `https://software.cortex.foundation/releases/manifest.json` |
+| Per-version JSON | `https://software.cortex.foundation/releases/<version>.json` |
+| Platform archive | `https://software.cortex.foundation/v1/assets/<platform>/<version>/cortex.tar.gz` (`.zip` on Windows) |
+| Archive checksum | same path + `.sha256` |
+
+Aliases also written for `cortex upgrade`: `/v1/releases/manifest.json`, `/v1/releases/<version>.json`, `/v1/releases/latest.json`.
+
+Platform keys: `linux-x86_64`, `linux-aarch64`, `darwin-x86_64`, `darwin-aarch64`, `windows-x86_64`.
 
-Do not add AWS account IDs, IAM users, or a second bucket name unless Cortex Foundation already operates them.
+`cortex upgrade` and the installers parse the same `ReleaseInfo` / `manifest.json` JSON. Tag versions that contain `-` (prerelease) publish to the `beta` channel; otherwise `stable`.
 
 ## Homebrew / WinGet (optional)
 

README.md

@@ -7,7 +7,10 @@ This page takes you from nothing installed to a working Cortex Code session.
 ### Linux and macOS
 
 The install script fetches the release build for your platform from
-[software.cortex.foundation](https://software.cortex.foundation):
+[software.cortex.foundation](https://software.cortex.foundation), verifies the
+SHA-256 checksum from the release manifest, and installs into `~/.local/bin`
+(`Cortex`, plus a `cortex` symlink). Add that directory to `PATH` if it is not
+already there.
 
 ```bash
 curl -fsSL https://software.cortex.foundation/install.sh | sh
@@ -19,8 +22,14 @@ Read it first if you would rather not pipe a script into a shell:
 curl -fsSL https://software.cortex.foundation/install.sh | less
 ```
 
+Pin a version with `CORTEX_VERSION=0.1.4`. Update later with `cortex upgrade`
+(same host, same checksum).
+
 ### Windows
 
+Windows installs into `%LOCALAPPDATA%\Cortex\bin` and adds that folder to the
+user `PATH`:
+
 ```powershell
 irm https://software.cortex.foundation/install.ps1 | iex
 ```
@@ -50,6 +59,17 @@ cargo build -p cortex-cli --release
 cortex --version
 ```
 
+### Update
+
+```bash
+cortex upgrade          # latest on the stable channel
+cortex upgrade --check  # report only
+```
+
+`cortex upgrade` talks to `https://software.cortex.foundation`
+(`/releases/manifest.json` and `/v1/assets/...`), verifies SHA-256, and
+replaces the current binary.
+
 ## 2. Sign in
 
 ```bash

docs/CI_SECRETS.md

@@ -0,0 +1,133 @@
+# Install Cortex CLI from https://software.cortex.foundation
+#
+# Usage:
+#   irm https://software.cortex.foundation/install.ps1 | iex
+#
+# Optional environment:
+#   CORTEX_VERSION       Pin a version (e.g. 0.1.2). Default: latest on the channel.
+#   CORTEX_CHANNEL       stable (default), beta, or nightly
+#   CORTEX_INSTALL_DIR   Prefix (default: $env:LOCALAPPDATA\Cortex). Binary in PREFIX\bin.
+#   CORTEX_SOFTWARE_URL  Override the distribution host (testing only).
+#
+# Downloads the matching zip, verifies SHA-256, then installs Cortex.exe.
+# Checksum verification is required; the script will not install an unverified file.
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+$SoftwareUrl = if ($env:CORTEX_SOFTWARE_URL) { $env:CORTEX_SOFTWARE_URL.TrimEnd("/") } else { "https://software.cortex.foundation" }
+$Channel = if ($env:CORTEX_CHANNEL) { $env:CORTEX_CHANNEL } else { "stable" }
+$Prefix = if ($env:CORTEX_INSTALL_DIR) { $env:CORTEX_INSTALL_DIR } else { Join-Path $env:LOCALAPPDATA "Cortex" }
+$BinDir = Join-Path $Prefix "bin"
+$PinnedVersion = if ($env:CORTEX_VERSION) { $env:CORTEX_VERSION.TrimStart("v") } else { $null }
+
+if ($Channel -notin @("stable", "beta", "nightly")) {
+    throw "install.ps1: invalid CORTEX_CHANNEL='$Channel' (use stable, beta, or nightly)"
+}
+
+$arch = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture
+switch ($arch) {
+    "X64" { $Platform = "windows-x86_64" }
+    "Arm64" { throw "install.ps1: Windows ARM64 builds are not published yet. Use an x64 machine or the GitHub Release." }
+    default { throw "install.ps1: unsupported architecture: $arch" }
+}
+
+function Get-Json($Url) {
+    return Invoke-RestMethod -Uri $Url -Method Get
+}
+
+function Try-GetJson($Url) {
+    try {
+        return Invoke-RestMethod -Uri $Url -Method Get
+    } catch {
+        return $null
+    }
+}
+
+Write-Host "Cortex CLI installer"
+Write-Host "  host:     $SoftwareUrl"
+Write-Host "  platform: $Platform"
+Write-Host "  prefix:   $Prefix"
+
+$release = $null
+$version = $PinnedVersion
+
+if ($version) {
+    $release = Try-GetJson "$SoftwareUrl/releases/$version.json"
+    if (-not $release) {
+        $release = Try-GetJson "$SoftwareUrl/v1/releases/$version.json"
+    }
+    if (-not $release) {
+        throw "install.ps1: could not fetch release metadata for $version from $SoftwareUrl"
+    }
+} else {
+    $manifest = Try-GetJson "$SoftwareUrl/releases/manifest.json"
+    if (-not $manifest) {
+        $manifest = Try-GetJson "$SoftwareUrl/v1/releases/manifest.json"
+    }
+    if (-not $manifest) {
+        throw "install.ps1: could not fetch $SoftwareUrl/releases/manifest.json"
+    }
+    $release = $manifest.$Channel
+    if (-not $release) {
+        throw "install.ps1: no $Channel release in manifest"
+    }
+    $version = $release.version
+}
+
+$asset = $release.assets.$Platform
+if (-not $asset) {
+    throw "install.ps1: no asset for platform $Platform in version $version"
+}
+
+$expectedSha = ([string]$asset.sha256).Trim().ToLowerInvariant()
+if (-not $expectedSha) {
+    throw "install.ps1: release JSON missing sha256 for $Platform"
+}
+
+Write-Host "  version:  $version"
+Write-Host "  download: $($asset.url)"
+
+$tempRoot = Join-Path ([System.IO.Path]::GetTempPath()) ("cortex-install-" + [guid]::NewGuid().ToString("N"))
+New-Item -ItemType Directory -Path $tempRoot | Out-Null
+try {
+    $zipPath = Join-Path $tempRoot "cortex.zip"
+    Invoke-WebRequest -Uri $asset.url -OutFile $zipPath -UseBasicParsing
+
+    $actualSha = (Get-FileHash -Path $zipPath -Algorithm SHA256).Hash.ToLowerInvariant()
+    if ($actualSha -ne $expectedSha) {
+        throw "install.ps1: SHA-256 mismatch for cortex.zip: expected $expectedSha, got $actualSha"
+    }
+    Write-Host "  checksum: ok"
+
+    $extractDir = Join-Path $tempRoot "extract"
+    Expand-Archive -Path $zipPath -DestinationPath $extractDir -Force
+
+    $binary = Get-ChildItem -Path $extractDir -Recurse -File |
+        Where-Object { $_.Name -in @("Cortex.exe", "cortex.exe") } |
+        Select-Object -First 1
+    if (-not $binary) {
+        throw "install.ps1: archive did not contain Cortex.exe"
+    }
+
+    New-Item -ItemType Directory -Path $BinDir -Force | Out-Null
+    $dest = Join-Path $BinDir "Cortex.exe"
+    Copy-Item -Path $binary.FullName -Destination $dest -Force
+
+    $userPath = [Environment]::GetEnvironmentVariable("Path", "User")
+    $pathParts = @()
+    if ($userPath) {
+        $pathParts = $userPath.Split(";", [System.StringSplitOptions]::RemoveEmptyEntries)
+    }
+    if ($pathParts -notcontains $BinDir) {
+        $newPath = if ($userPath) { "$userPath;$BinDir" } else { $BinDir }
+        [Environment]::SetEnvironmentVariable("Path", $newPath, "User")
+        $env:Path = "$env:Path;$BinDir"
+        Write-Host "Added $BinDir to the user PATH."
+    }
+
+    Write-Host "Installed Cortex CLI v$version to $dest"
+    Write-Host "Restart the terminal, then run: cortex --version"
+} finally {
+    Remove-Item -Recurse -Force $tempRoot -ErrorAction SilentlyContinue
+}