ci: publish checksummed package artifacts

.github/workflows/ci.yml

@@ -19,3 +19,37 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run ci
+
+  package:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.22.3
+          cache: npm
+      - run: npm install
+      - run: npm test
+      - run: npm run build
+      - run: npm run package:validate
+      - name: Pack artifact and write SHA-256 checksum
+        id: pack
+        shell: bash
+        run: |
+          package_file="$(npm pack --silent)"
+          sha256sum "${package_file}" > "${package_file}.sha256"
+          echo "package_file=${package_file}" >> "${GITHUB_OUTPUT}"
+      - name: Verify SHA-256 checksum
+        shell: bash
+        run: sha256sum --check "${{ steps.pack.outputs.package_file }}.sha256"
+      - name: Upload package and checksum
+        uses: actions/upload-artifact@v4
+        with:
+          name: openclaw-armada-dm-${{ github.sha }}
+          path: |
+            ${{ steps.pack.outputs.package_file }}
+            ${{ steps.pack.outputs.package_file }}.sha256
+          if-no-files-found: error

README.md

@@ -31,11 +31,18 @@ For a standard OpenClaw installation, pack and install the managed artifact:
 
 ```bash
 npm pack
+sha256sum openclaw-armada-dm-0.1.0.tgz > openclaw-armada-dm-0.1.0.tgz.sha256
+sha256sum --check openclaw-armada-dm-0.1.0.tgz.sha256
 openclaw plugins install npm-pack:/absolute/path/openclaw-armada-dm-0.1.0.tgz
 openclaw plugins enable armada-dm
 openclaw gateway restart
 ```
 
+After each change reaches `main` (including every merged pull request), CI repeats
+the install, test, build, validation, and pack sequence. The workflow artifact
+contains both the `.tgz` package and its `.sha256` file so a downloaded package
+can be checked with `sha256sum --check <package>.tgz.sha256`.
+
 The published `setup-entry.js` uses only the OpenClaw `2026.6.1` public SDK compatibility baseline, while deployment requires patched OpenClaw `2026.7.2-beta.6` or newer. It does not run a wizard, prompt for values, edit configuration, read the secret file, publish events, or start relay connections.
 
 ## Migrating another Nostr channel

src/__tests__/metadata.test.ts

@@ -112,6 +112,23 @@ describe("package and manifest contracts", () => {
     expect(workflow).toContain("npm run ci");
   });
 
+  it("packs a checksummed artifact after changes reach main", async () => {
+    const workflow = await readFile(
+      new URL(".github/workflows/ci.yml", root),
+      "utf8",
+    );
+
+    expect(workflow).toContain("github.event_name == 'push'");
+    expect(workflow).toContain("github.ref == 'refs/heads/main'");
+    expect(workflow).toContain("npm install");
+    expect(workflow).toContain("npm test");
+    expect(workflow).toContain("npm run build");
+    expect(workflow).toContain("npm run package:validate");
+    expect(workflow).toContain("npm pack");
+    expect(workflow).toContain("sha256sum");
+    expect(workflow).toContain("actions/upload-artifact@v4");
+  });
+
   it("fails CI when coverage falls below the repository baseline", async () => {
     const config = await readFile(new URL("vitest.config.mjs", root), "utf8");