From eb96e921eb6909593257a9a411d4e0f91154799c Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Mon, 18 May 2026 08:53:46 -0500
Subject: [PATCH 1/2] fix(ci): add Netlify deploy for electron update metadata
 on dl.devsy.sh

---
 .github/workflows/release.yml | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 15fabde4c..1c24e4797 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -219,6 +219,31 @@ jobs:
           name: devsy-flatpak
           path: desktop/release/*.deb
 
+  deploy-update-metadata:
+    name: Deploy Electron Update Metadata
+    needs: [build-desktop]
+    runs-on: ubuntu-latest
+    steps:
+      - name: download update metadata artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: update-metadata-*
+          path: metadata/
+
+      - name: arrange files into publish directory
+        run: |
+          mkdir -p publish-dir/desktop
+          find metadata/ -name 'latest*.yml' -exec cp {} publish-dir/desktop/ \;
+
+      - name: deploy to Netlify (dl.devsy.sh)
+        uses: nwtgck/actions-netlify@v3
+        with:
+          publish-dir: ./publish-dir
+          production-deploy: true
+        env:
+          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_DL_SITE_ID }}
+
   build-flatpak:
     name: Build Flatpak
     runs-on: ubuntu-latest
@@ -266,7 +291,7 @@ jobs:
 
   prerelease:
     name: Publish Prerelease
-    needs: [build-desktop, build-flatpak]
+    needs: [build-desktop, build-flatpak, deploy-update-metadata]
     permissions:
       contents: write
     if: github.event.release.prerelease

From fb7f47e217b014f75b916b5fdff7c6a41f53204d Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Mon, 18 May 2026 08:58:57 -0500
Subject: [PATCH 2/2] fix(ci): add permissions block to deploy-update-metadata
 job

Adds `permissions: contents: read` for least-privilege security.
---
 .github/workflows/release.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1c24e4797..9332ff288 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -223,6 +223,8 @@ jobs:
     name: Deploy Electron Update Metadata
     needs: [build-desktop]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: download update metadata artifacts
         uses: actions/download-artifact@v8