ci: fix release builds and automate tagged releases

Author: perpetus

.github/workflows/dependency-freshness.yml

@@ -14,7 +14,7 @@ jobs:
   rust:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
       - uses: dtolnay/rust-toolchain@stable

.github/workflows/mpv-windows.yml

@@ -6,13 +6,18 @@ on:
     branches: [main]
   push:
     branches: [main]
+    tags: ["v*"]
     paths:
       - "**/*.rs"
       - "**/*.slint"
       - "**/Cargo.toml"
       - "Cargo.lock"
       - "mpv.lock.json"
+      - "vcpkg.json"
+      - "triplets/**"
+      - "vcpkg-overlays/**"
       - "setup/**"
+      - "scripts/generate_release_notes.py"
       - ".github/workflows/**"
 
 env:
@@ -24,16 +29,49 @@ jobs:
   windows:
     name: Windows x64
     runs-on: windows-2022
+    env:
+      VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
       - uses: dtolnay/rust-toolchain@stable
         with:
           target: x86_64-pc-windows-msvc
+      - name: Export GitHub Actions cache environment for vcpkg
+        uses: actions/github-script@v9
+        with:
+          script: |
+            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL);
+            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN);
+      - name: Cache vcpkg installed packages
+        uses: actions/cache@v6
+        with:
+          path: vcpkg_installed
+          key: Windows-vcpkg-static-release-v1-${{ hashFiles('vcpkg.json', 'triplets/**', 'vcpkg-overlays/**') }}
+          restore-keys: |
+            Windows-vcpkg-static-release-v1-
+            Windows-vcpkg-static-release-
+      - name: Install optimized static libtorrent
+        uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgGitCommitId: "84bab45d415d22042bd0b9081aea57f362da3f35"
+          vcpkgDirectory: "${{ github.workspace }}/vcpkg"
+          vcpkgJsonGlob: "vcpkg.json"
+          runVcpkgInstall: true
+        env:
+          VCPKG_INSTALLED_DIR: ${{ github.workspace }}/vcpkg_installed
+          VCPKG_DEFAULT_TRIPLET: x64-windows-static-release
+          VCPKG_OVERLAY_TRIPLETS: ${{ github.workspace }}/triplets
+          VCPKG_OVERLAY_PORTS: ${{ github.workspace }}/vcpkg-overlays
       - uses: Swatinem/rust-cache@v2
       - name: Build release
         run: cargo build --locked --release --package stremio-native
+        env:
+          VCPKG_ROOT: ${{ github.workspace }}/vcpkg
+          VCPKG_INSTALLED_DIR: ${{ github.workspace }}/vcpkg_installed
+          VCPKGRS_TRIPLET: x64-windows-static-release
+          PKG_CONFIG_PATH: ${{ github.workspace }}/vcpkg_installed/x64-windows-static-release/lib/pkgconfig
       - name: Verify runtime bundle
         shell: pwsh
         run: |
@@ -46,7 +84,7 @@ jobs:
         run: |
           set "SKIP_BUILD=1"
           call setup\create_setup.cmd
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: stremio-native-windows-x64
           path: |
@@ -61,7 +99,7 @@ jobs:
     name: Linux x64
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
       - uses: dtolnay/rust-toolchain@stable
@@ -72,8 +110,75 @@ jobs:
           sudo apt-get install -y build-essential clang cmake ninja-build pkg-config libssl-dev libtorrent-rasterbar-dev libboost-dev libclang-dev libgtk-3-dev libayatana-appindicator3-dev libmpv-dev libfontconfig1-dev libfreetype6-dev libxkbcommon-dev libwayland-dev libx11-xcb-dev libxcb-shape0-dev libxcb-xfixes0-dev libgl1-mesa-dev libegl1-mesa-dev
       - name: Build release
         run: cargo build --locked --release --package stremio-native
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: stremio-native-linux-x64
           path: target/release/stremio-native
           if-no-files-found: error
+
+  release:
+    name: Publish tagged release
+    needs: [windows, linux]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Download release artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: artifacts
+      - name: Prepare release assets
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p release
+
+          copy_latest() {
+            local pattern="$1"
+            local source
+            source="$(find artifacts -type f -name "$pattern" | sort -V | tail -n 1)"
+            if [[ -z "$source" ]]; then
+              echo "Missing required release asset: $pattern" >&2
+              exit 1
+            fi
+            cp "$source" release/
+          }
+
+          copy_latest "StremioSetup-v*-x64.exe"
+          copy_latest "stremio-native-v*-x86_64-pc-windows-msvc.zip"
+
+          linux_binary="$(find artifacts/stremio-native-linux-x64 -type f -name stremio-native | head -n 1)"
+          if [[ -z "$linux_binary" ]]; then
+            echo "Missing required Linux release binary" >&2
+            exit 1
+          fi
+          linux_asset="release/stremio-native-${GITHUB_REF_NAME}-x86_64-unknown-linux-gnu"
+          cp "$linux_binary" "$linux_asset"
+          chmod +x "$linux_asset"
+
+          (cd release && sha256sum * > SHA256SUMS.txt)
+          find release -maxdepth 1 -type f -printf '%f\n' | sort
+      - name: Prepare release notes
+        shell: bash
+        run: |
+          previous_tag="$(git describe --tags --abbrev=0 "${GITHUB_REF_NAME}^" 2>/dev/null || true)"
+          python scripts/generate_release_notes.py \
+            --repo "${GITHUB_REPOSITORY}" \
+            --tag "${GITHUB_REF_NAME}" \
+            --previous-tag "${previous_tag}" \
+            --asset-dir release \
+            --changelog CHANGELOG.md \
+            --output "${GITHUB_WORKSPACE}/RELEASE_BODY.md"
+          cat "${GITHUB_WORKSPACE}/RELEASE_BODY.md"
+      - name: Create GitHub release
+        uses: softprops/action-gh-release@v3
+        with:
+          files: release/*
+          body_path: RELEASE_BODY.md
+          fail_on_unmatched_files: true
+          generate_release_notes: false
+          prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'alpha') || contains(github.ref, 'rc') }}

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 This file records notable changes to Stremio Native relative to the initial source snapshot.
 
-## Unreleased - 2026-07-18
+## 1.0.0 - 2026-07-18
 
 ### Desktop lifecycle and startup
 
@@ -43,6 +43,8 @@ This file records notable changes to Stremio Native relative to the initial sour
 - Disables stream-server's standalone Windows EXE resource table only when it is embedded, preventing duplicate `VERSIONINFO`/icon resources while preserving the GUI executable's own `1.0.0` metadata.
 - Preserves only OpenGL state supported by the active context and uses an ES2-compatible RGBA render target, preventing ES3-only libmpv sharing operations from leaking `GL_INVALID_ENUM` into Slint/FemtoVG on Windows.
 - Adds clean Windows and Linux release jobs. The Windows job also produces the Inno Setup installer and GitHub updater archive.
+- Provisions the optimized static libtorrent 2.0.13 dependency on clean Windows runners through stream-server's pinned vcpkg baseline, overlay, triplet, and GitHub Actions cache.
+- Publishes tagged `v*` builds automatically after both platforms pass, with updater-compatible assets, the Linux binary, SHA-256 checksums, direct download links, the matching detailed changelog section, categorized commit links, and a full comparison link.
 
 ### Resource baseline
 

Cargo.lock

@@ -45,7 +45,7 @@ The native values were captured on July 18, 2026 from the already-running, settl
 
 ### 📦 Secure Offline Database Cache (Turso & Limbo)
 * **Local-First Database Storage**: Stores all settings, historical logs, and metadata inside a single local database file (`stremio.db`) using the native `turso` engine.
-* **Memory-Based Image Loading**: Poster artwork and thumbnails are cached as database blobs and decoded asynchronously on background thread pools (using the Rust `image` crate), keeping your UI rendering at a locked $60\text{ FPS}$ without disk lag.
+* **Asynchronous Image Loading**: Poster artwork and thumbnails are fetched, cached, and decoded on bounded background workers, keeping disk and decode work off the UI thread.
 * **Privacy-Focused**: No cloud synchronizations, trackers, or telemetry. Your viewing history, settings, and logs remain 100% private and stored locally.
 
 ---
@@ -54,6 +54,8 @@ The native values were captured on July 18, 2026 from the already-running, settl
 
 Windows x64 builds automatically download and verify the pinned optimized `libmpv-2.dll`; no media binaries are stored in this repository. Linux builds use the system's dynamic `libmpv` through `pkg-config`. The Windows runtime currently targets the `x86-64-v3` CPU baseline.
 
+Pushing a `v*` tag builds both platforms and publishes a GitHub release automatically after both jobs pass. The release contains the Windows installer, the updater-compatible Windows archive, the Linux x64 binary, SHA-256 checksums, direct download links, version-matched changelog notes, and linked commits since the previous tag.
+
 ### 1. Prerequisites
 On Windows, install the `x86_64-pc-windows-msvc` Rust toolchain from [rustup.rs](https://rustup.rs/) and the Visual Studio 2022 C++ build tools/Windows SDK. On Linux, install Rust, `pkg-config`, the libmpv development package, and the native GUI packages listed in the release workflow.
 

README.md

@@ -236,6 +236,10 @@ The official desktop interaction distinguishes browsing from navigation: a singl
 - [x] This durable implementation ledger was created for context compaction.
 - [x] Windows CI produces the executable, verified MPV runtime/licenses, installer, and updater archive from a clean checkout.
 - [x] Linux CI installs system libmpv development metadata and builds the portable release path.
+- [x] Linux MPV artifact hashing is compatible with `sha2` 0.11 without digest-type formatting assumptions.
+- [x] Windows CI mirrors stream-server's pinned optimized static libtorrent 2.0.13 vcpkg baseline, overlay, triplet, and GitHub Actions cache instead of relying on runner-local libraries.
+- [x] All GitHub Actions references use their current stable major lines; checkout and artifact upload are on v7.
+- [x] A pushed `v*` tag automatically waits for Windows and Linux builds, collects updater-compatible assets, writes SHA-256 checksums, and publishes a release with direct downloads, version-matched changelog notes, categorized commit links, and a full comparison link.
 - [x] Stremio Core and stream-server dependencies use pinned remote Git revisions for clean CI/CD checkouts.
 - [x] Update the implementation ledger, rendering reference, MPV guide, README, and changelog.
 - [x] Run `cargo fmt --all`.
@@ -273,6 +277,7 @@ The official desktop interaction distinguishes browsing from navigation: a singl
 - [x] Final combined validation passed after the cache, GLES2, immediate Player Back, tray-shutdown, and logo-alignment corrections: `slint-viewer --check .\\app\\ui\\app.slint`, formatting, diff hygiene, and `cargo check --workspace --release` all completed successfully on 2026-07-18.
 - [x] One combined validation passed on 2026-07-18 for persisted hydration, FIFO storage, and first-login catalogs: Slint syntax, formatting, diff hygiene, the focused FIFO executor test, and `cargo check --workspace --release` all succeeded.
 - [x] Validated the corrected Discover single-click-preview/double-click-details callback path while retaining Library's one-click details behavior: Slint syntax, formatting, diff hygiene, and the release package check passed on 2026-07-18.
+- [ ] Confirm the corrected Linux and Windows release jobs pass after the CI dependency patch; failed run `29631460575` identified the `sha2` 0.11 digest-format incompatibility and missing Windows vcpkg toolchain.
 - [ ] Restart twice and confirm Continue Watching and Calendar project current data immediately; runtime verification remains with the user.
 - [ ] Confirm addon-provider Movie/Series Board cards populate on the first authenticated launch, Discover previews on one click and opens details on double-click, and Library opens details with one click; runtime verification remains with the user.
 - [ ] Rebuild and restart, then confirm repeat details visits leave the skeleton immediately and Back remains visible during loading; runtime verification remains with the user.

docs/implementation-progress.md

@@ -13,5 +13,5 @@ pkg-config = "0.3.33"
 reqwest = { workspace = true, features = ["blocking", "rustls"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
-sha2 = "0.10.9"
+sha2 = "0.11.0"
 sevenz-rust = "0.6.1"

playback-mpv/Cargo.toml

@@ -418,6 +418,8 @@ fn validate_file_hash(path: &Path, expected: &str) -> Result<(), io::Error> {
 }
 
 fn sha256_file(path: &Path) -> Result<String, io::Error> {
+    const HEX_DIGITS: &[u8; 16] = b"0123456789abcdef";
+
     let mut reader = BufReader::new(fs::File::open(path)?);
     let mut hasher = Sha256::new();
     let mut buffer = [0_u8; 128 * 1024];
@@ -428,7 +430,14 @@ fn sha256_file(path: &Path) -> Result<String, io::Error> {
         }
         hasher.update(&buffer[..read]);
     }
-    Ok(format!("{:x}", hasher.finalize()))
+
+    let digest = hasher.finalize();
+    let mut encoded = String::with_capacity(digest.len() * 2);
+    for byte in digest.iter().copied() {
+        encoded.push(char::from(HEX_DIGITS[usize::from(byte >> 4)]));
+        encoded.push(char::from(HEX_DIGITS[usize::from(byte & 0x0f)]));
+    }
+    Ok(encoded)
 }
 
 fn validate_sha256(value: &str) -> Result<(), io::Error> {