Prepare release engine

bin/release.sh

@@ -1,20 +1,17 @@
 #!/usr/bin/env bash
-# Builds and signs a WP-LIT-MCP release from the committed state. It publishes nothing: tag, Gitea release and the
-# upload of the two files in dist/ are done afterwards, then bin/release-check.sh looks at the result.
+# Builds a WP-LIT-MCP release ZIP from the committed state into dist/. It publishes nothing: bin/ship.sh does the
+# whole way (this script, push, release, upload, check from outside).
 #
 #   bin/release.sh
 #
-# Needs: bsdtar, composer, php (sodium). The signing key (php bin/release-sign.php keygen) lives outside the
-# repository.
-#
-# Environment: LIT_MCP_RELEASE_KEY (default ~/.config/wp-lit-mcp/release.key), LIT_MCP_DIVI_CHECK (command that must
-# succeed before a release, default: ddev wp --user=janniclas lit-mcp divi-check).
+# Needs: bsdtar, composer.
+# Environment: LIT_MCP_DIVI_CHECK (command that must succeed before a release, default:
+# ddev wp --user=janniclas lit-mcp divi-check).
 set -euo pipefail
 
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$root"
 
-key="${LIT_MCP_RELEASE_KEY:-$HOME/.config/wp-lit-mcp/release.key}"
 divi_check="${LIT_MCP_DIVI_CHECK:-ddev wp --user=janniclas lit-mcp divi-check}"
 
 fail() { echo "ABBRUCH: $*" >&2; exit 1; }
@@ -29,7 +26,6 @@ version="$(sed -n "s/.*const VERSION = '\(.*\)';/\1/p" src/Plugin.php)"
 grep -q "^= $version =\$" readme.txt || fail "readme.txt hat keinen Changelog-Eintrag für $version"
 [[ -z "$(git status --porcelain)" ]] || fail "Arbeitsbaum nicht sauber: erst committen, das ZIP entsteht aus HEAD"
 ! git rev-parse -q --verify "refs/tags/v$version" >/dev/null || fail "Tag v$version existiert schon"
-[[ -r "$key" ]] || fail "Signierschlüssel fehlt: $key (php bin/release-sign.php keygen <Datei>)"
 
 # --- 2. Tests and the Divi check must be green ------------------------------------------------------------------------
 step "Tests"
@@ -46,8 +42,9 @@ git archive HEAD | tar -x -C "$work/wp-lit-mcp"
 (cd "$work/wp-lit-mcp" && composer install --no-dev --optimize-autoloader --no-interaction --quiet)
 name="wp-lit-mcp-$version.zip"
 mkdir -p dist
+# Files of earlier releases would be one wrong click away from the upload.
+rm -f dist/wp-lit-mcp-*
 zip="$root/dist/$name"
-rm -f "$zip" "$zip.sig"
 (cd "$work" && bsdtar --format zip -cf "$zip" wp-lit-mcp)
 
 # --- 4. Look into the ZIP like WordPress will: one folder, the plugin, its autoloader, the right version --------------
@@ -57,18 +54,10 @@ if grep -qv '^wp-lit-mcp/' <<<"$entries"; then fail "ZIP enthält Einträge auß
 for need in wp-lit-mcp/wp-lit-mcp.php wp-lit-mcp/vendor/autoload_packages.php; do
     grep -qx "$need" <<<"$entries" || fail "Im ZIP fehlt $need"
 done
-if grep -qE '^wp-lit-mcp/(tests|bin|docs/superpowers|\.git)(/|$)' <<<"$entries"; then
+if grep -qE '^wp-lit-mcp/(tests|bin|docs/superpowers|\.git|\.gitea-token)(/|$)' <<<"$entries"; then
     fail "Entwicklungsdateien im ZIP"
 fi
 [[ "$(bsdtar -xOf "$zip" wp-lit-mcp/wp-lit-mcp.php | sed -n 's/^ \* Version: //p')" == "$version" ]] \
     || fail "Version im ZIP stimmt nicht mit $version überein"
 
-# --- 5. Sign, and prove the signature against the key built into the plugin -------------------------------------------
-step "Signieren"
-php bin/release-sign.php sign "$zip" "$key" > "$zip.sig"
-php bin/release-sign.php verify "$zip" "$zip.sig" >/dev/null \
-    || fail "Signatur passt nicht zum Schlüssel im Plugin (PackageSignature::RELEASE_KEY)"
-
-echo "In Ordnung: dist/$name und dist/$name.sig"
-echo "Weiter: Tag v$version und Release auf Gitea anlegen, beide Dateien hochladen, veröffentlichen."
-echo "Danach: bin/release-check.sh $version"
+echo "In Ordnung: dist/$name"