Use edge-apps-actions v26.10.0 and add release badge to README

.github/workflows/checks.yml

@@ -3,14 +3,16 @@ name: Checks
 on:
   push:
     branches:
+      - development
       - main
   pull_request:
     branches:
+      - development
       - main
 
 jobs:
   checks:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Screenly/edge-apps-actions/checks@v1
+      - uses: Screenly/edge-apps-actions/checks@v26.10.0

.github/workflows/initialize-edge-app.yml

@@ -30,12 +30,12 @@ jobs:
     environment: ${{ inputs.environment }}
     steps:
       - uses: actions/checkout@v7
-        with:
-          ref: main
-      - uses: Screenly/edge-apps-actions/initialize@f4ccd2bd50db5fb0a5147d287ac03cafe552d29b
+      - uses: Screenly/edge-apps-actions/initialize@v26.10.0
         with:
           screenly_api_token: ${{ secrets.SCREENLY_API_TOKEN }}
           edge_app_name: ${{ inputs.edge_app_name }}
           edge_app_title: ${{ inputs.edge_app_title }}
           environment: ${{ inputs.environment }}
-          edge_app_id: ${{ secrets.EDGE_APP_ID || (inputs.environment == 'production' && vars.PRODUCTION_EDGE_APP_ID || (inputs.environment == 'stage' && vars.STAGE_EDGE_APP_ID)) }}
+          # First create: leave STAGE_EDGE_APP_ID / PRODUCTION_EDGE_APP_ID unset
+          # so this is "". After create: set the matching var to the printed id.
+          edge_app_id: ${{ (inputs.environment == 'production' && vars.PRODUCTION_EDGE_APP_ID) || (inputs.environment == 'stage' && vars.STAGE_EDGE_APP_ID) || '' }}

.github/workflows/update-edge-app.yml

@@ -2,39 +2,51 @@
 name: Update Edge App
 
 on:
+  workflow_dispatch:
   push:
     branches:
       - main
     tags:
-      - 'v*'
+      - 'v[0-9]*'
 
-run-name: Updating RSS Reader in ${{ startsWith(github.ref, 'refs/tags/v') && 'production' || 'stage' }}
+run-name: Updating RSS Reader in ${{ (github.event_name == 'push' && !github.event.deleted && startsWith(github.ref, 'refs/tags/v')) && 'production' || 'stage' }}
 
 jobs:
   deploy-stage:
     name: Updating RSS Reader in stage
     runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main'
+    if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'workflow_dispatch'
     environment: stage
     steps:
-      - uses: actions/checkout@v6
-      - uses: Screenly/edge-apps-actions/update@f4ccd2bd50db5fb0a5147d287ac03cafe552d29b
+      - uses: actions/checkout@v7
+      - uses: Screenly/edge-apps-actions/update@v26.10.0
         with:
           screenly_api_token: ${{ secrets.SCREENLY_API_TOKEN }}
           environment: stage
           delete_missing_settings: 'true'
-          edge_app_id: ${{ secrets.EDGE_APP_ID || vars.STAGE_EDGE_APP_ID }}
+          edge_app_id: ${{ vars.STAGE_EDGE_APP_ID }}
 
   deploy-production:
     name: Updating RSS Reader in production
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: github.event_name == 'push' && !github.event.deleted && startsWith(github.ref, 'refs/tags/v')
     environment: production
     steps:
-      - uses: actions/checkout@v6
-      - uses: Screenly/edge-apps-actions/update@f4ccd2bd50db5fb0a5147d287ac03cafe552d29b
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Verify tag is on the default branch
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          git fetch --no-tags origin "$DEFAULT_BRANCH"
+          if ! git merge-base --is-ancestor HEAD FETCH_HEAD; then
+            echo "Tag $GITHUB_REF_NAME is not on $DEFAULT_BRANCH; refusing to deploy to production."
+            exit 1
+          fi
+      - uses: Screenly/edge-apps-actions/update@v26.10.0
         with:
           screenly_api_token: ${{ secrets.SCREENLY_API_TOKEN }}
           environment: production
           delete_missing_settings: 'true'
-          edge_app_id: ${{ secrets.EDGE_APP_ID || vars.PRODUCTION_EDGE_APP_ID }}
+          edge_app_id: ${{ vars.PRODUCTION_EDGE_APP_ID }}

README.md

@@ -1,3 +1,5 @@
+[![Version](https://img.shields.io/github/v/release/Screenly/rss-reader-app)](https://github.com/Screenly/rss-reader-app/releases/latest)
+
 # RSS Reader
 
 Displays the latest entries from any RSS feed on your Screenly digital signage screens.
@@ -44,6 +46,22 @@ bun run deploy
 screenly edge-app instance create
 ```
 
+### Releasing
+
+Pushes to `main` deploy to stage automatically. To release to production, tag a commit on `main` and push the tag (the workflow refuses tags not on `main`):
+
+```bash
+git checkout main && git pull
+git tag v26.10.0
+git push origin v26.10.0
+```
+
+Then publish a GitHub Release whose notes list the pull requests merged since the previous release. Add `--draft` to review the notes before publishing:
+
+```bash
+gh release create v26.10.0 --verify-tag --generate-notes --title v26.10.0
+```
+
 ## Configuration
 
 | Setting             | Description                                                          | Type     | Default                                |