ci(release): check the endpoint old installs use, and let RELEASING.md say less

[PathGao]

Replaces #494, which I closed. That PR added another paragraph to RELEASING.md §5; this one adds the check that makes the paragraph unnecessary and shortens the section instead.

Why §5 kept growing

§4 works because it is adjacent to what it constrains — generating the keypair is step 1 of the runbook, and "the pubkey is permanent" is the warning attached to step 1. §5 constrains forking the repository, which is not a step in this runbook and never will be. It has been compensating with length for not being next to anything, and #494 was about to add more.

The check

create-release
  └─ The endpoint old installs still use must lead to this repository   ← new, before the draft
  └─ Create Release

It asserts the property, not a proxy for it. It does not ask whether a redirect exists — it fetches

https://github.com/alecdotdev/Markpad/releases/latest/download/latest.json

and checks that the feed's platforms[].url values still name $GITHUB_REPOSITORY.

That distinction is the whole point. A repository at the old location that serves a correct feed would keep old installs working, and it passes — correctly. That case is precisely what #494 was going to spend a paragraph warning about; the check handles it without anyone having to reason about it under pressure.

Placed before the draft is created, so a broken endpoint does not leave half a release behind.

Verified, and falsified

Run against the live endpoint from this machine:

version 2.7.0, platforms: darwin-aarch64 darwin-x86_64 linux-x86_64 windows-aarch64 windows-x86_64
all five URLs → sftwrdotdev/Markpad/releases/download/v2.7.0/...
✓ passes

Three falsifications:

broken how	behaviour
expected repository name does not match the feed	fails, naming all five foreign URLs
the URL answers with something that is not a feed (fork, 404)	fails via the "not an updater feed" branch
the URL cannot be reached at all	::warning, exit 0 — a flake does not block a release

npm test 778/778. build.yml parses.

What I could not verify

• The step has not run in CI. build.yml is workflow_dispatch-only, so this is proven by executing the script body locally against the real URL, not by a green run. The first real exercise is the next release.
• I have not tested what GitHub actually does when a repository is created at a transferred location. The claim that the redirect is voided is from GitHub's documentation, quoted in §5, not from an experiment — which is part of why a check that observes the outcome is better than prose asserting the cause.

🤖 Generated with Claude Code