feat(nightly): enable Velopack deltas on win/mac nightlies

[mhglover]

What

Enables Velopack delta updates on the win/mac Nightly channel, so testers download ~10–50 MB instead of a full ~1.5 GB nupkg every night. CI-only change to .github/workflows/nightly.yml. Part of the nightly-slimming effort (got-feedBack/feedBack#122), targeting recurring update bandwidth.

Problem: the publish job deletes + recreates the rolling nightly release each run, wiping the prior full nupkg that vpk needs as a delta base — so Velopack can never emit deltas.

Change (win + mac): a build-job step before each vpk pack:

1. vpk download github --channel <rid>-nightly -o release/velopack pulls the current rolling feed (last night's full) so vpk pack diffs against it and emits a *-delta.nupkg. build finishes before publish recreates the release, so the prior full is still downloadable at pack time. First run / empty feed degrades to a full-only pack.
2. Prune to the single newest prior full as the base. vpk pack has no prune, and --keepMaxReleases is s3/az/local-only (not pack, not upload github), so without this the rolling release would accumulate full nupkgs forever. After pack the release holds exactly the two most recent fulls + the latest delta — bounded and manifest-consistent.

permissions: contents: read added to the build job for the feed read. Publish job otherwise unchanged — its velopack/** glob already sweeps the new delta.

Design: keeps the intentional single rolling-release from #80 (the JS SDK's GitHub AutoSource reads only non-prerelease releases); deltas live inside it rather than switching to per-version vpk upload github. Retention and the three per-platform downloads (portable zip + installer + nupkg) are deliberately unchanged. Linux stays on its home-grown updater — the Velopack SDK's Linux .node requires GLIBC_2.39 (verified on pinned 0.0.1589 and latest 1.2.110), which would regress Ubuntu 22.04 / Debian 12 / older SteamOS; separate/shelved.

Result: win/mac Nightly update ~1.5 GB → ~10–50 MB most nights; laggards fall back to full via the client's MaximumDeltasBeforeFallback.

feedpak surface

• This PR does not change how the app reads/writes feedpaks (manifest keys, pack files, folder layout) — CI / update-packaging only.

Checklist

• CHANGELOG.md [Unreleased] updated — N/A: feedBack-desktop has no CHANGELOG.md.
• Tests added/updated — N/A: CI-workflow change (nightly.yml), no unit-test harness. Validated by two consecutive nightly runs (full base → full+delta); prune logic self-checked locally.
• Commits are DCO signed off (git commit -s)

Verification (CI-only — why this is a draft)

Needs two consecutive nightly runs:

1. Run A packs a full (no base yet) — expected.
2. Run B should publish both *-full.nupkg and *-delta.nupkg for win + mac.
3. An installed win/mac tester on the Nightly channel should pull the delta (tens of MB, not 1.5 GB) and apply/relaunch cleanly.

The one genuine unknown is whether the hand-rolled gh release feed round-trips cleanly through vpk download — only a live run confirms it. Holding as draft until validated.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ef605d4c-7dd8-44f1-9ba8-e55b8668a837

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}