Put the installers on the release page people actually open

[jwussler]

Independent of #1 and #2 — branches off main, touches only .github/workflows/release.yml.

All 16 releases on this repo have zero assets, and they carry the full "download HamDeckPusher-win-Setup.exe" notes regardless — telling the reader to download a file that isn't there. v0.1.29's artifacts were on jwussler/hamdeck-releases; every tag before it has no downloadable installer anywhere.

Nothing ever failed. gh release create is perfectly happy to publish a release with an empty file list, and the job goes green.

Changes

• Publish to both repos from the same step, with the same file list, so they can't drift. hamdeck-releases stays the canonical public download — this repo is private and Velopack's updater can't read it without a token that would be embedded in every copy handed to a friend. But the source repo is where its own author goes to find a build.
• Refuse to publish an empty release, and read the asset count back from the API afterwards and fail if it's short. That's the check that was missing.
• create-or-upload, so re-running a tag tops up an existing release instead of failing on "already exists" and leaving it half filled.
• The macOS job uploads to both too and reads the .dmg back — it publishes the one asset that comes from a different job than the rest, so it can go missing without the publish gate noticing.
• Two tokens, not one falling back to the other. The fine-grained PAT is scoped to hamdeck-releases and can't write here; github.token can't write there. One variable holding whichever exists fails on one of them.

Gate proven to fail

Stubbed gh, three cases:

case	result
dist/ yielded no files	refusing to publish an empty release, exit 1
files exist, release reports back 0 assets (the 16-release bug)	has 0 assets, expected 3, exit 1
release reports back complete	both repos pass, exit 0

Already done by hand

v0.1.29's 7 assets were mirrored onto this repo's release, so the link that prompted this isn't a dead end any more. The 15 older releases are left as they are — they were superseded before they had anything to attach.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EqubrbjLXwz1GrVgmTcrf9

[jwussler]

Two more commits, from what the v0.1.29 page actually showed.

The Windows client was never missing — it was mislabelled. hamdeck-qml.exe (1.29 MB, signed) ships inside HamDeckPusher-win-Setup.exe. One installer, both apps, updated together — that part was deliberate. But the download is named after the Pusher, so the release page never said the client was in there. It is now HamDeck-win-Setup.exe, packTitle "HamDeck", and the notes say what it contains.

⚠️ The packId stays HamDeckPusher. It's Velopack's update identity — changing it orphans every existing install silently: they keep running and never see another update. Only the file name and display title move. The file name is safe to change precisely because the updater never fetches it: RELEASES points at the .nupkg; Setup.exe is only what a human downloads once, which is the whole problem being fixed.

The version was drifting. client/CMakeLists.txt hardcoded VERSION 0.1.15, so v0.1.29 shipped hamdeck-client_0.1.15_amd64.deb — built from the right commit, named from a literal nobody had touched in fourteen releases. The pusher took its version from the tag; the client didn't. It now comes from the tag on all three platforms, 0.0.0 fallback for a local build. Same number feeds CFBundleShortVersionString, so the Mac app would have told Get Info it was 0.1.15 as well.

New gate, proven to fail first:

file list	result
the real v0.1.29 (hamdeck-client_0.1.15_amd64.deb)	does not carry the release version 0.1.29, exit 1
corrected (_0.1.29_)	passes

Still outstanding, not addressed here: the Windows arm64 leg fails at Stage the Qt runtime beside the binary, and it's continue-on-error, so releases publish without it and nothing says so. Windows on ARM runs the x64 build under emulation, so it's an optimisation rather than enablement — but the silence is the bad part.