Publish releases to kw/nolimit-discounts-dist and point the header there

The family shape is source private, releases in a separate public repo so a
shop can fetch an update without credentials and without the source being
readable. This plugin was the only one still serving its own update feed out of
the repository that holds ci/, docs/ and tests/.

kw/nolimit-discounts-dist created (public, zips only). RELEASE_REPO in
ci/plugin.conf now names it, and ci/publish-release.sh honours it over
GITHUB_REPOSITORY — falling back to the running repo, which is what a plugin
without a split still wants.

🔴 The "Update URI:" header moves in the SAME commit as the publishing target,
and ci/static.sh now fails when the two disagree. The header is what every
installed copy polls; if it names a repository nothing is published to any
more, the shop stops being offered updates and nothing announces it, because
latest_release() simply returns false. That is the same failure as a privacy
page standing still while the code moves, and the check is what makes it
impossible to forget.

Proven red before being believed: pointing RELEASE_REPO at another repository
fails with both sides named. RELEASE_REPO is required by ci_load_conf, because
an unset value would turn the comparison into a no-op and restore exactly the
bug it prevents.

Not done here, and it is the blocker for actually cutting a release: publishing
to another repository needs a token with write access to it. The job token only
covers the repo it runs in, so this needs a cross-repo PAT in the repository
secrets, and that is Kristian's to add.

Also not done, deliberately: the source repo stays public for now. Making it
private before the dist repo has releases would break the feed for the copy
installed on the live shop, whose header still points at the old address.
1.4.6 and earlier keep working through Gitea's rename redirect - measured, the
old name still answers 200 - and that redirect is the only thing holding them
up, so it must not be removed until a build carrying the new header has
propagated.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ci/lib.sh

@@ -22,7 +22,7 @@ ci_load_conf() {
   # leaves the floors empty, every comparison becomes a no-op, and the hollow
   # checks these were added to fix come back silently — the same shape of bug.
   local missing=
-  for var in PLUGIN_SLUG PLUGIN_MAIN TEXT_DOMAIN NEEDS_WOOCOMMERCE MIN_SHIPPED_PHP_FILES MIN_TRANSLATION_CALLS; do
+  for var in PLUGIN_SLUG PLUGIN_MAIN TEXT_DOMAIN NEEDS_WOOCOMMERCE MIN_SHIPPED_PHP_FILES MIN_TRANSLATION_CALLS RELEASE_REPO; do
     [ -n "${!var:-}" ] || missing="$missing $var"
   done
   if [ -n "$missing" ]; then

ci/plugin.conf

@@ -51,3 +51,18 @@ MIN_SHIPPED_PHP_FILES=5
 # Set to 0 for a plugin with no translatable strings: the check then warns
 # instead of failing, so zero is never silent either way.
 MIN_TRANSLATION_CALLS=60
+
+# Where releases are published, when that is not the repository running the
+# workflow. The source repo is kw/nolimit-discounts; the plugin's update feed
+# is a separate PUBLIC repo holding built zips only, so a shop can fetch
+# updates without credentials and without the source being readable.
+#
+# 🔴 This and the "Update URI:" header in the plugin file must name the same
+# repository. ci/static.sh fails when they disagree — a feed that moves while
+# the header stands still is how every installed copy silently stops receiving
+# updates, and nothing announces it because latest_release() just returns false.
+#
+# Publishing here needs a token with write access to that OTHER repository. The
+# job token only covers the repo it runs in, so this is a cross-repo PAT and
+# Kristian's to add.
+RELEASE_REPO=kw/nolimit-discounts-dist

ci/publish-release.sh

@@ -23,8 +23,14 @@ ci_load_conf
 zip="build/$PLUGIN_SLUG.zip"
 [ -f "$zip" ] || { echo "$zip does not exist — run ci/build-zip.sh first." >&2; exit 1; }
 
-owner="${GITHUB_REPOSITORY%%/*}"
-repo="${GITHUB_REPOSITORY#*/}"
+# RELEASE_REPO wins over the repository running the workflow: releases go to a
+# separate public dist repo, so the source can be private while a shop still
+# fetches its update anonymously. Falls back to the running repo, which is what
+# a plugin without a split still wants.
+target="${RELEASE_REPO:-$GITHUB_REPOSITORY}"
+owner="${target%%/*}"
+repo="${target#*/}"
+echo "Publishing $TAG to $owner/$repo" >&2
 
 # The tag message is the announcement, so it has to survive the checkout.
 #

ci/static.sh

@@ -160,6 +160,21 @@ for readme in readme.txt README.txt; do
     || note_fail "$readme has 'Stable tag: $stable' but the plugin header says $version."
 done
 
+ci_step "the update feed and the release target name the same repository"
+# 🔴 The header is what every installed copy polls; RELEASE_REPO is where the
+# zip is actually published. If they disagree, the shop keeps asking an address
+# nothing is published to any more and quietly stops receiving updates —
+# latest_release() just returns false, and nothing says so. Same failure as a
+# privacy page that stands still while the code moves: the two must change in
+# one commit, and this is what makes that impossible to forget.
+update_uri=$(ci_plugin_header 'Update URI')
+echo "  Update URI:   ${update_uri:-<missing>}"
+echo "  RELEASE_REPO: $RELEASE_REPO"
+case "$update_uri" in
+  */"$RELEASE_REPO") echo "  they agree" ;;
+  *) note_fail "Update URI is '$update_uri' but releases are published to '$RELEASE_REPO'. Installed copies poll the header, so they would stop being offered updates without a word." ;;
+esac
+
 ci_step "no secrets in tracked files"
 # Suggested by the AI-manager port, and it costs nothing: a pushed key cannot be
 # unpushed. It has to be rotated, and the window between the push and noticing

woocommerce-email-discount-manager.php

@@ -2,7 +2,7 @@
 /**
  * Plugin Name: Nolimit Discounts
  * Plugin URI:  https://gitea.nolimit.dk/kw/woo-discount-manager
- * Update URI:  https://gitea.nolimit.dk/kw/woo-discount-manager
+ * Update URI:  https://gitea.nolimit.dk/kw/nolimit-discounts-dist
  * Description: Apply discounts and show/hide shipping methods based on the customer's email address (full address, domain or partial match).
  * Version:     1.4.6
  * Author:      Kristian Wind