From 7c6a1f92ec278c2c20c2fe279019dec2a9f492a9 Mon Sep 17 00:00:00 2001
From: nicodes <nicozessoules@gmail.com>
Date: Sun, 13 Sep 2026 00:06:07 -0600
Subject: [PATCH 1/2] Fix release package checksum path

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 86e4a13..984a4ce 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -105,7 +105,7 @@ jobs:
           path: dist
 
       - name: Verify downloaded package identity
-        run: sha256sum --check --strict dist/@aviorstudio_gd-network.zip.sha256
+        run: (cd dist && sha256sum --check --strict '@aviorstudio_gd-network.zip.sha256')
 
       - name: Create GitHub Release
         env:

From 652492faa65a3dbf7bcfad6275507d931a3867fb Mon Sep 17 00:00:00 2001
From: nicodes <nicozessoules@gmail.com>
Date: Sun, 13 Sep 2026 00:09:52 -0600
Subject: [PATCH 2/2] Exercise release checksum verification in CI

---
 .github/workflows/release.yml      | 2 +-
 scripts/verify_package_checksum.sh | 8 ++++++++
 tests/package_test.sh              | 2 +-
 3 files changed, 10 insertions(+), 2 deletions(-)
 create mode 100644 scripts/verify_package_checksum.sh

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 984a4ce..2f37c6a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -105,7 +105,7 @@ jobs:
           path: dist
 
       - name: Verify downloaded package identity
-        run: (cd dist && sha256sum --check --strict '@aviorstudio_gd-network.zip.sha256')
+        run: bash ./scripts/verify_package_checksum.sh
 
       - name: Create GitHub Release
         env:
diff --git a/scripts/verify_package_checksum.sh b/scripts/verify_package_checksum.sh
new file mode 100644
index 0000000..8665ddc
--- /dev/null
+++ b/scripts/verify_package_checksum.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+ROOT_DIR=$(cd "$SCRIPT_DIR/.." && pwd)
+DIST_DIR="${1:-$ROOT_DIR/dist}"
+
+(cd "$DIST_DIR" && sha256sum --check --strict '@aviorstudio_gd-network.zip.sha256')
diff --git a/tests/package_test.sh b/tests/package_test.sh
index d656ce0..b2e310d 100755
--- a/tests/package_test.sh
+++ b/tests/package_test.sh
@@ -9,7 +9,7 @@ fixture="$(mktemp -d)"
 trap 'rm -rf "$fixture"' EXIT
 
 test -f "$archive"
-(cd "$ROOT_DIR/dist" && sha256sum --check --strict '@aviorstudio_gd-network.zip.sha256')
+bash "$ROOT_DIR/scripts/verify_package_checksum.sh"
 python3 "$SCRIPT_DIR/verify_zip.py" "$archive" "$ROOT_DIR/addon/package-manifest.txt"
 
 addon_dir="$fixture/addons/@aviorstudio_gd-network"