[ajianaz]

Summary

Fixes #151 — Sets up main as release-only branch and improves install experience.

Problem

• curl -fsSL .../main/install.sh | sh returns 404 because main was stale (initial commit, 155 commits behind develop)
• No checksum verification in install script — MITM/corruption risk
• Release workflow didn't sync main on tag push

Changes

install.sh

• Added SHA256 checksum verification using checksums-sha256.txt from releases
• Graceful fallback if checksums unavailable (warn, don't error)

.github/workflows/release.yml

• Added sync-main job: on every v* tag push, force-syncs develop → main
• Updated release notes template to prioritize install.sh over manual tarball download
• Fixed changelog link from develop/CHANGELOG.md → main/CHANGELOG.md

README.md

• Added CORA_VERSION pinning example
• Simplified CI manual install to use install.sh instead of raw tarball download

Post-merge Steps

After this PR is merged to develop, the next release tag (v*) will:

1. Trigger the sync-main job → main gets synced to develop tip
2. install.sh on main will be current and accessible via curl .../main/install.sh | sh

Flow

develop (active development, PR target)
  ↓ (on v* tag push)
release workflow: sync develop → main
  ↓
install.sh URL → main (always stable, matches latest release)

Test Plan

• Verify install.sh downloads and verifies checksum correctly
• Verify sync-main job runs on next tag push
• Verify curl .../main/install.sh | sh works after first post-merge release

[github-actions]

🔍 Cora AI Code Review

❌ Blocked — critical issues found.

🔴 Error (1)

• install.sh:108 — When the checksums file fails to download (curl fails), the script only warns and continues installation. This means an attacker performing a MITM could block the checksums URL while serving a malicious binary, and the script would silently proceed without verification. The same applies when the archive name isn't found in the checksums file. Consider making this a hard failure, or at least requiring an explicit opt-out flag like --skip-verify.

---

Review powered by cora-cli · BYOK · MIT