ci: retire legacy healthchat.ch desktop feed

.claude/skills/releasing-healthchat/SKILL.md

@@ -34,9 +34,9 @@ Releases are driven by git tags of the form `healthchat-v<semver>` pushed to
 - `.github/workflows/deploy-healthchat-desktop.yaml` (desktop deploy) — **manual
   dispatch only.** Fetches the staged archive for the requested version and mirrors it
   to the live feed at `https://packages.healthchat.ch/desktop/` over FTPS (the private
-  GitHub Release can serve neither end users nor the auto-updater), plus the legacy
+  GitHub Release can serve neither end users nor the auto-updater). The pre-1.6.0 feed
-  `https://healthchat.ch/packages/desktop/` path while clients built <= 1.5.0 are still
+  at `https://healthchat.ch/packages/desktop/` is retired and frozen at 1.5.0 — installs
-  in the field. This is what makes installed apps
+  that old must reinstall once from the new download URL. This is what makes installed apps
   self-update; see `apps/desktop/element.io/healthchat/README` for the feed layout and
   the two caveats (first install is manual; Windows auto-update needs the Setup.exe path,
   not the .msi).
@@ -341,7 +341,7 @@ release"):
 
 - [ ] Web deployed and `curl -fsS https://app.healthchat.ch/version` reports the new version.
 - [ ] Desktop feed deployed: the "Deploy HealthChat Desktop" run is green. Its own verify
-      step already asserts the feed URLs (canonical + legacy) return 200, so a green run is
+      step already asserts the feed URLs return 200, so a green run is
       the check.
 - [ ] `releases.json` now advertises the new version:
       `curl -fsS https://packages.healthchat.ch/desktop/update/macos/releases.json | jq -r '.releases[0].updateTo.version'`
@@ -356,7 +356,7 @@ Configured in repo Settings → Secrets and variables → Actions:
 |---|---|
 | `HEALTHCHAT_WORKSPACE_TOKEN` | PAT with read access to `Novaloop-AG/healthchat-workspace`. Needed by `actions/checkout` for the private plugin repo. |
 | `GITHUB_TOKEN` | Auto-provided. Used for ghcr.io login and GitHub Release creation. No manual setup required. |
-| `FTP_SERVER` / `FTP_USERNAME` / `FTP_PASSWORD` | Credentials for the healthchat.ch FTP(S) account (docroot of packages.healthchat.ch is `/public_html/packages`). Used by the `release` job of `build-healthchat-desktop.yaml` to stage the feed archive under `/public_html/packages/desktop-releases/<version>/`, and by `deploy-healthchat-desktop.yaml` to publish the live feed under `/public_html/packages/desktop/` plus, during the URL migration, the legacy `/public_html/healthchat.ch/packages/desktop/`. `FTP_SERVER` is the hostname only (explicit FTPS / AUTH TLS). |
+| `FTP_SERVER` / `FTP_USERNAME` / `FTP_PASSWORD` | Credentials for the healthchat.ch FTP(S) account (docroot of packages.healthchat.ch is `/public_html/packages`). Used by the `release` job of `build-healthchat-desktop.yaml` to stage the feed archive under `/public_html/packages/desktop-releases/<version>/`, and by `deploy-healthchat-desktop.yaml` to publish the live feed under `/public_html/packages/desktop/`. `FTP_SERVER` is the hostname only (explicit FTPS / AUTH TLS). |
 
 Desktop signing additionally requires two GitHub **environments** (Settings →
 Environments). Without them the desktop builds still run but produce

.github/workflows/deploy-healthchat-desktop.yaml

@@ -40,7 +40,7 @@ jobs:
     deploy:
         name: Publish update feed to packages.healthchat.ch
         runs-on: ubuntu-latest
-        # Fetches ~2 GiB from the archive and uploads it twice (canonical + legacy path).
+        # Fetches ~2 GiB from the archive and uploads it to the live feed.
         timeout-minutes: 60
         steps:
             - name: Resolve version
@@ -135,14 +135,6 @@ jobs:
                   # *.nupkg are preserved (Squirrel.Windows delta history) and only the staged files
                   # are written/overwritten. If the host's FTPS cert is untrusted, set
                   # ssl:verify-certificate to no.
-                  #
-                  # Dual-publish during the URL migration: /public_html/packages is the docroot of
-                  # packages.healthchat.ch (the canonical feed URL since builds > 1.5.0), while
-                  # /public_html/healthchat.ch/packages/desktop serves the legacy
-                  # healthchat.ch/packages/desktop URL that clients built <= 1.5.0 still poll —
-                  # they only learn the new URL by installing an update delivered over the old
-                  # feed. Drop the legacy mirror (and its verify checks below) once the installed
-                  # base is on a build carrying the new update_base_url.
                   lftp -u "$FTP_USERNAME" --env-password "$FTP_SERVER" <<LFTP
                   set cmd:fail-exit true
                   set ftp:ssl-force true
@@ -150,8 +142,6 @@ jobs:
                   set ssl:verify-certificate true
                   mkdir -pf /public_html/packages/desktop
                   mirror -R $MIRROR_OPTS feed/ /public_html/packages/desktop/
-                  mkdir -pf /public_html/healthchat.ch/packages/desktop
-                  mirror -R $MIRROR_OPTS feed/ /public_html/healthchat.ch/packages/desktop/
                   bye
                   LFTP
 
@@ -160,18 +150,12 @@ jobs:
               run: |
                   set -euo pipefail
                   base="https://packages.healthchat.ch/desktop"
-                  # The legacy healthchat.ch URLs keep clients built <= 1.5.0 updating; drop them
-                  # together with the legacy mirror above once the installed base has migrated.
-                  legacy="https://healthchat.ch/packages/desktop"
                   fail=0
                   for url in "$base/update/macos/releases.json" \
                              "$base/update/win32/x64/RELEASES" \
                              "$base/update/win32/arm64/RELEASES" \
                              "$base/install/macos/HealthChat.dmg" \
-                             "$base/install/win32/x64/HealthChat-Setup.exe" \
+                             "$base/install/win32/x64/HealthChat-Setup.exe"; do
-                             "$legacy/update/macos/releases.json" \
-                             "$legacy/update/win32/x64/RELEASES" \
-                             "$legacy/update/win32/arm64/RELEASES"; do
                     code=$(curl -fsS -o /dev/null -w '%{http_code}' -I "$url" 2>/dev/null || echo "000")
                     if [[ "$code" == "200" ]]; then echo "ok   $code  $url"; else echo "FAIL $code  $url"; fail=1; fi
                   done

HEALTHCHAT_CHANGES.md

@@ -18,9 +18,9 @@ One section per released version, newest on top. Upstream element-hq
 🧹 Internal
 
 - Desktop installers and the auto-update feed are now hosted at
-  `https://packages.healthchat.ch/desktop/`. Already-installed apps keep updating:
+  `https://packages.healthchat.ch/desktop/`; the old address is retired. Apps on
-  releases are also published to the legacy `https://healthchat.ch/packages/desktop/`
+  version 1.5.0 or older do not check the new address — download the current
-  feed until all clients are on a build that knows the new address.
+  installer once from the new URL, and updates resume automatically afterwards.
 
 ## Changes in 1.5.0 (2026-07-28)
 

apps/desktop/element.io/healthchat/README

@@ -128,11 +128,10 @@ Add these repo secrets:
   FTP_PASSWORD
 
 Caveats:
-  - URL migration: builds <= 1.5.0 poll the legacy feed at
+  - Builds <= 1.5.0 polled the retired feed at https://healthchat.ch/packages/desktop/, which
-    https://healthchat.ch/packages/desktop/ (docroot /public_html/healthchat.ch/packages/) —
+    is frozen at 1.5.0 — those installs never see newer versions. Users on them must download
-    they only learn the new URL by installing an update delivered over that old feed. The
+    the current installer once from the packages.healthchat.ch install/ URL; updates resume
-    deploy workflow therefore dual-publishes to both directories; drop the legacy mirror and
+    automatically afterwards.
-    its verify checks once the installed base is on a build carrying the new update_base_url.
   - First install is manual. Apps already installed without update_base_url (<= 1.1.2) cannot
     self-update to the first build that carries it; users must download once from the install/ URL.
     Every release after that updates automatically.