ci: publish the site and drive releases + Sparkle notes from CHANGELOG

- Add a deploy-site workflow: publishes web/* to Pages on push (or manual
  dispatch), re-publishing the live appcast.xml so a site deploy never
  wipes the Sparkle feed.
- Release workflow: build the GitHub release body from the matching
  CHANGELOG.md section (### promoted to ##) plus Install / Update, and
  embed that section as sanitized inline HTML in the appcast <description>
  so Sparkle shows clean notes. Assemble web/* into the Pages artifact
  with a cache-busted stylesheet. Bump pinned action versions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: PangMo5

.github/workflows/deploy-site.yml

@@ -0,0 +1,78 @@
+name: Deploy site
+
+# Publishes the marketing/docs site to GitHub Pages independently of releases.
+# The release workflow owns appcast.xml (it signs + regenerates it); this
+# workflow re-publishes the currently live appcast alongside the site so a site
+# deploy never wipes the Sparkle feed.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "web/**"
+      - "Resources/Marketing/app-icon.png"
+      - ".github/workflows/deploy-site.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Assemble site
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          OWNER: ${{ github.repository_owner }}
+        run: |
+          set -euo pipefail
+          SITE="$RUNNER_TEMP/site"
+          mkdir -p "$SITE"
+
+          # Latest release version for the no-JS download/version fallback in
+          # index.html (the page also resolves this live via the API).
+          VERSION="$(gh release view --repo "$REPO" --json tagName -q .tagName 2>/dev/null | sed 's/^v//' || true)"
+          echo "Latest version: ${VERSION:-<none>}"
+
+          cp web/*.html web/*.css "$SITE/"
+          if [ -n "$VERSION" ]; then
+            sed -i "s/__VERSION__/${VERSION}/g" "$SITE/index.html"
+          fi
+          cp Resources/Marketing/app-icon.png "$SITE/icon.png"
+
+          # Cache-bust the stylesheet so a CSS change is never masked by a
+          # stale browser cache (HTML + CSS stay in lockstep per deploy).
+          BUST="${GITHUB_SHA:0:8}"
+          sed -i "s#\"./style.css\"#\"./style.css?v=${BUST}\"#g" "$SITE"/*.html
+
+          # Preserve the Sparkle feed. GitHub Pages replaces the whole site on
+          # deploy, so re-publish the live appcast.xml. Fail rather than deploy
+          # without it (deploying without it would break in-app updates).
+          OWNER_LC="$(printf '%s' "$OWNER" | tr '[:upper:]' '[:lower:]')"
+          NAME="${REPO##*/}"
+          curl -fsSL "https://${OWNER_LC}.github.io/${NAME}/appcast.xml" -o "$SITE/appcast.xml"
+          echo "Bundled appcast.xml ($(wc -c < "$SITE/appcast.xml") bytes)"
+
+      - uses: actions/upload-pages-artifact@v5
+        with:
+          path: ${{ runner.temp }}/site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v5

.github/workflows/release.yml

@@ -24,7 +24,7 @@ jobs:
       TUIST_DEVELOPMENT_TEAM: ${{ secrets.DEVELOPMENT_TEAM }}
       TUIST_SPARKLE_PUBLIC_ED_KEY: ${{ secrets.SPARKLE_PUBLIC_ED_KEY }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Resolve version
         id: version
@@ -38,7 +38,7 @@ jobs:
           fi
           echo "version=$TAG_VERSION" >> "$GITHUB_OUTPUT"
 
-      - uses: jdx/mise-action@v2
+      - uses: jdx/mise-action@v4
 
       - name: Import Developer ID certificate
         env:
@@ -159,33 +159,82 @@ jobs:
             --download-url-prefix "https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/" \
             "$RUNNER_TEMP/release"
 
-      - name: Add release-notes links to appcast
+      - name: Embed release notes in appcast
         env:
           APPCAST: ${{ runner.temp }}/release/appcast.xml
-          REPO: ${{ github.repository }}
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
-          python3 - <<'PY'
-          import os, xml.etree.ElementTree as ET
-          sparkle = "http://www.andymatuschak.org/xml-namespaces/sparkle"
-          ET.register_namespace("sparkle", sparkle)
-          path, repo = os.environ["APPCAST"], os.environ["REPO"]
-          tree = ET.parse(path)
-          for item in tree.getroot().iter("item"):
-              version = item.find(f"{{{sparkle}}}shortVersionString")
-              if version is None or item.find(f"{{{sparkle}}}releaseNotesLink") is not None:
-                  continue
-              link = ET.SubElement(item, f"{{{sparkle}}}releaseNotesLink")
-              link.text = f"https://github.com/{repo}/releases/tag/v{version.text}"
-          tree.write(path, xml_declaration=True, encoding="utf-8")
-          print("appcast: release-notes links added")
+          set -euo pipefail
+          # This version's changelog section (### promoted to ##), without the
+          # install boilerplate — Sparkle shows the actual changes inline.
+          awk -v h="## ${VERSION} " 'index($0, h) == 1 { g = 1; next } g && /^## / { exit } g { print }' \
+            CHANGELOG.md | sed 's/^### /## /' > "$RUNNER_TEMP/changelog-section.md"
+          SECTION="$RUNNER_TEMP/changelog-section.md" python3 - <<'PY'
+          import os, re, html as H
+          def inline(s):
+              s = H.escape(s)
+              s = re.sub(r"`([^`]+)`", r"<code>\1</code>", s)
+              s = re.sub(r"\*\*([^*]+)\*\*", r"<strong>\1</strong>", s)
+              s = re.sub(r"\[([^\]]+)\]\(([^)]+)\)", r'<a href="\2">\1</a>', s)
+              s = re.sub(r"(?<!\*)\*([^*]+)\*(?!\*)", r"<em>\1</em>", s)
+              return s
+          out, in_ul = [], False
+          for line in open(os.environ["SECTION"], encoding="utf-8").read().splitlines():
+              if line.startswith("## "):
+                  if in_ul: out.append("</ul>"); in_ul = False
+                  out.append("<h2>" + inline(line[3:].strip()) + "</h2>")
+              elif line.startswith("- "):
+                  if not in_ul: out.append("<ul>"); in_ul = True
+                  out.append("<li>" + inline(line[2:].strip()) + "</li>")
+              elif line.strip() == "":
+                  if in_ul: out.append("</ul>"); in_ul = False
+              else:
+                  if in_ul: out.append("</ul>"); in_ul = False
+                  out.append("<p>" + inline(line.strip()) + "</p>")
+          if in_ul: out.append("</ul>")
+          html = "\n".join(out).strip()
+          appcast = os.environ["APPCAST"]
+          xml = open(appcast, encoding="utf-8").read()
+          if html and "<description>" not in xml:
+              desc = "<description><![CDATA[\n" + html + "\n]]></description>\n    "
+              xml = xml.replace("</item>", desc + "</item>", 1)
+              open(appcast, "w", encoding="utf-8").write(xml)
+              print("appcast: embedded release notes")
+          else:
+              print("appcast: skipped (no notes or description already present)")
           PY
 
+      - name: Build release notes from CHANGELOG
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          NOTES="$RUNNER_TEMP/release-notes.md"
+          # Pull this version's section from CHANGELOG.md (the source of truth),
+          # promoting its ### subheadings to ## for the GitHub release.
+          awk -v h="## ${VERSION} " 'index($0, h) == 1 { g = 1; next } g && /^## / { exit } g { print }' \
+            CHANGELOG.md | sed 's/^### /## /' > "$NOTES"
+          if [ ! -s "$NOTES" ]; then
+            echo "See the [changelog](https://github.com/${REPO}/blob/main/CHANGELOG.md)." > "$NOTES"
+          fi
+          # Append the install/update boilerplate (kept out of CHANGELOG.md).
+          {
+            echo ""
+            echo "## Install / Update"
+            echo ""
+            echo "- Homebrew: \`brew upgrade --cask tatami\`"
+            echo "- Direct: [Tatami-${VERSION}.dmg](https://github.com/${REPO}/releases/download/${TAG}/Tatami-${VERSION}.dmg)"
+            echo "- In-app: Sparkle will pick this up on its next check."
+          } >> "$NOTES"
+
       - name: Publish GitHub Release
         run: |
           gh release create "${{ github.ref_name }}" \
             "$RUNNER_TEMP/Tatami-${{ steps.version.outputs.version }}.dmg" \
             --title "${{ github.ref_name }}" \
-            --generate-notes
+            --notes-file "$RUNNER_TEMP/release-notes.md"
         env:
           GH_TOKEN: ${{ github.token }}
 
@@ -214,13 +263,25 @@ jobs:
           git commit -am "tatami ${VERSION}"
           git push
 
-      - name: Publish appcast to GitHub Pages
+      - name: Assemble GitHub Pages site (landing page + appcast)
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
           set -euo pipefail
           mkdir -p "$RUNNER_TEMP/site"
+          # Static pages (configuration.html / releases.html render their source
+          # of truth at runtime; index.html gets the release version injected).
+          cp web/*.html web/*.css "$RUNNER_TEMP/site/"
+          sed "s/__VERSION__/${VERSION}/g" web/index.html > "$RUNNER_TEMP/site/index.html"
+          cp Resources/Marketing/app-icon.png "$RUNNER_TEMP/site/icon.png"
+          # Cache-bust the stylesheet so a CSS change is never masked by a
+          # stale browser cache.
+          BUST="${GITHUB_SHA:0:8}"
+          sed -i "s#\"./style.css\"#\"./style.css?v=${BUST}\"#g" "$RUNNER_TEMP/site"/*.html
+          # Sparkle feed.
           cp "$RUNNER_TEMP/release/appcast.xml" "$RUNNER_TEMP/site/appcast.xml"
 
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: ${{ runner.temp }}/site
 
@@ -232,4 +293,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5