Harden Zapstore zsp install

[AnthonyRonning]

Summary

• update the Zapstore publish workflow to use Go 1.24.11, matching zsp v0.4.5's declared toolchain
• verify zsp v0.4.5 resolves to the expected annotated tag object and peeled commit before install
• verify the Go module and go.mod checksums from the public checksum database before install
• keep GOTOOLCHAIN=local and explicitly set Go proxy/checksum environment for the install step

Validation

• git diff --check
• verified remote zsp v0.4.5 tag object and peeled commit with git ls-remote
• verified zsp v0.4.5 module and go.mod checksums against sum.golang.org
• pre-commit hook ran frontend build and bun test: 92 pass, 0 fail

Note: I could not run go install locally because Go is not installed in this shell.

---

Summary by CodeRabbit

• Chores
  • Updated the publishing workflow to use Go 1.24.11.
  • Added verification checks for the publishing tool and its dependencies before installation.
  • Preserved existing APK publishing and signing validations.

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	e92375f
Status:	✅  Deploy successful!
Preview URL:	https://7180b3bb.maple-ca8.pages.dev
Branch Preview URL:	https://codex-harden-zapstore-zsp-pi.maple-ca8.pages.dev

View logs

[coderabbitai]

📝 Walkthrough

Walkthrough

The Zapstore publishing workflow now pins Go 1.24.11 and validates the zsp v0.4.5 tag, commit, module checksum, and go.mod checksum before installation. Existing APK download and publishing validations remain in place.

Changes

Zapstore publishing

Layer / File(s)	Summary
Pinned Go and verified zsp installation .github/workflows/zapstore-publish.yml	The workflow configures Go 1.24.11, verifies zsp v0.4.5 integrity values with strict shell checks, and installs zsp only when all checks pass.

Estimated code review effort: 3 (Moderate) | ~15–30 minutes

Possibly related PRs

• OpenSecretCloud/Maple#427: Earlier Zapstore workflow changes involving Go setup and zsp version pinning.

Poem

A bunny checks each checksum twice,
Then hops through Go, precise and nice.
The tagged zsp earns its place,
APKs publish at a steady pace.
“Verified!” squeaks the rabbit with grace.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the main change: hardening the zsp installation in the Zapstore publish workflow.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/harden-zapstore-zsp-pin

---

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/zapstore-publish.yml (1)

81-82: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider jq instead of inline python3 for JSON parsing.

jq is preinstalled on ubuntu-latest runners and is more idiomatic for one-line JSON field extraction in CI shell scripts than shelling out to python3.

♻️ Optional refactor using jq

-          actual_module_sum="$(python3 -c 'import json, sys; print(json.load(sys.stdin)["Sum"])' <<<"${download_json}")"
-          actual_gomod_sum="$(python3 -c 'import json, sys; print(json.load(sys.stdin)["GoModSum"])' <<<"${download_json}")"
+          actual_module_sum="$(jq -r '.Sum' <<<"${download_json}")"
+          actual_gomod_sum="$(jq -r '.GoModSum' <<<"${download_json}")"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/zapstore-publish.yml around lines 81 - 82, Replace the
inline python3 JSON parsing used to assign actual_module_sum and
actual_gomod_sum with jq field extraction from download_json. Preserve the
existing Sum and GoModSum values and assignment flow.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/zapstore-publish.yml:
- Around line 81-82: Replace the inline python3 JSON parsing used to assign
actual_module_sum and actual_gomod_sum with jq field extraction from
download_json. Preserve the existing Sum and GoModSum values and assignment
flow.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0062b832-93da-4159-b1e3-e41d60efb452

📥 Commits

Reviewing files that changed from the base of the PR and between 9bb1d5e and e92375f.

📒 Files selected for processing (1)

• .github/workflows/zapstore-publish.yml