ci: auto-register published release on the website updater (#693)

Append a step to the release_artifact_build job that POSTs the freshly built
InvoiceShelf.zip + metadata to the website updater's /api/releases endpoint
(Bearer WEBSITE_RELEASE_TOKEN) right after the asset upload, so deployed installs
are offered the release automatically instead of a manual kubectl+tinker import.

- Runs only on release events; skips with a warning if WEBSITE_RELEASE_TOKEN is unset
- Channel derived from the prerelease flag / "-" tag suffix (GA->stable, pre->insider)
- min_php + extensions read from config/installer.php; release fields passed via env
  to avoid shell injection from the release body
- Idempotent (the endpoint upserts per version)


Claude-Session: https://claude.ai/code/session_012tpgisKcrC4D4mCbGTeTKz

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/docker.yaml

@@ -124,6 +124,42 @@ jobs:
           tag: ${{ github.ref }}
           overwrite: true
 
+      # Auto-register this release on the website updater backend so deployed installs
+      # are offered it. The zip is already built here (./InvoiceShelf.zip) and the checkout
+      # is present for config/installer.php, so this needs no re-download and can't race the
+      # asset upload. Idempotent per version (the endpoint upserts). Release fields are passed
+      # via env (not inline ${{ }}) to avoid shell injection from the release body.
+      - name: Register release on the website updater
+        env:
+          CI_RELEASE_TOKEN: ${{ secrets.WEBSITE_RELEASE_TOKEN }}
+          TAG: ${{ github.event.release.tag_name }}
+          PRERELEASE: ${{ github.event.release.prerelease }}
+          PUBLISHED: ${{ github.event.release.published_at }}
+          BODY: ${{ github.event.release.body }}
+        run: |
+          if [ -z "$CI_RELEASE_TOKEN" ]; then
+            echo "::warning::WEBSITE_RELEASE_TOKEN not set — skipping updater registration for $TAG"
+            exit 0
+          fi
+          MIN_PHP=$(php -r '$c=require "config/installer.php"; echo $c["core"]["minPhpVersion"] ?? "";')
+          EXTS=$(php -r '$c=require "config/installer.php"; echo implode(", ", $c["requirements"]["php"] ?? []);')
+          printf '%s' "$BODY" > /tmp/changelog.txt
+          case "$TAG" in
+            *-*) CHANNEL=insider ;;
+            *)   [ "$PRERELEASE" = "true" ] && CHANNEL=insider || CHANNEL=stable ;;
+          esac
+          echo "Registering $TAG (channel=$CHANNEL, min_php=$MIN_PHP) on the updater"
+          curl -fsS --retry 3 --retry-delay 5 -X POST https://invoiceshelf.com/api/releases \
+            -H "Authorization: Bearer $CI_RELEASE_TOKEN" \
+            -F "version=$TAG" \
+            -F "channel=$CHANNEL" \
+            -F "released_at=$PUBLISHED" \
+            -F "min_php_version=$MIN_PHP" \
+            -F "extensions=$EXTS" \
+            -F "changelog=<changelog.txt" \
+            -F "description=<changelog.txt" \
+            -F "release_file=@InvoiceShelf.zip"
+
   release_docker_build:
     name: 🐳 Release Docker Build
     if: github.event_name == 'release'