Replace deleted_files with manifest-based updater cleanup, add release workflow

- Add manifest.json generation script (scripts/generate-manifest.php)
- Add Updater::cleanStaleFiles() that removes files not in manifest
- Add /api/v1/update/clean endpoint with backward compatibility
- Add configurable update_protected_paths in config/invoiceshelf.php
- Update frontend to use clean step instead of delete step
- Add GitHub Actions release workflow triggered on version tags
- Add .github/release.yml for auto-generated changelog categories
- Update Makefile to include manifest generation and scripts directory

Backport from v3.0 (e6452946). Adapted for master's existing structure: master uses one-controller-per-action under app/Http/Controllers/V1/Admin/Update/, so the new endpoint is implemented as a dedicated CleanFilesController matching the existing DeleteFilesController/CopyFilesController/etc. pattern instead of v3.0's unified UpdateController. The legacy /update/delete route and DeleteFilesController are retained for compatibility — only the frontend (resources/scripts/admin/views/settings/UpdateAppSetting.vue) is updated to call /update/clean. Updater service lives at app/Space/Updater.php on master (not yet refactored to app/Services/Update/Updater.php like v3.0).

.github/release.yml

@@ -0,0 +1,18 @@
+changelog:
+    categories:
+        - title: New Features
+          labels:
+              - enhancement
+              - feature
+        - title: Bug Fixes
+          labels:
+              - bug
+              - fix
+        - title: Maintenance
+          labels:
+              - chore
+              - dependencies
+              - ci
+        - title: Other Changes
+          labels:
+              - "*"

.github/workflows/release.yaml

@@ -0,0 +1,96 @@
+name: Release
+
+on:
+    push:
+        tags:
+            - "v*"
+
+permissions:
+    contents: write
+
+jobs:
+    release:
+        name: Build & Release
+        runs-on: ubuntu-latest
+        env:
+            extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_mysql, zip
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v4
+              with:
+                  fetch-depth: 0
+
+            - name: Setup PHP
+              uses: shivammathur/setup-php@v2
+              with:
+                  php-version: 8.4
+                  extensions: ${{ env.extensions }}
+                  tools: composer
+
+            - name: Install Composer dependencies
+              run: composer install --no-dev --optimize-autoloader --no-interaction
+
+            - name: Use Node.js 24
+              uses: actions/setup-node@v4
+              with:
+                  node-version: 24
+
+            - name: Install npm dependencies
+              run: npm ci
+
+            - name: Build frontend
+              run: npm run build
+
+            - name: Prepare release directory
+              run: |
+                  mkdir -p /tmp/InvoiceShelf/public
+
+                  cp -r app                    /tmp/InvoiceShelf/
+                  cp -r bootstrap              /tmp/InvoiceShelf/
+                  cp -r config                 /tmp/InvoiceShelf/
+                  cp -r database               /tmp/InvoiceShelf/
+                  cp -r public/build           /tmp/InvoiceShelf/public/
+                  cp -r public/favicons        /tmp/InvoiceShelf/public/
+                  cp    public/.htaccess       /tmp/InvoiceShelf/public/
+                  cp    public/index.php       /tmp/InvoiceShelf/public/
+                  cp    public/robots.txt      /tmp/InvoiceShelf/public/
+                  cp    public/web.config      /tmp/InvoiceShelf/public/
+                  cp -r resources              /tmp/InvoiceShelf/
+                  cp -r lang                   /tmp/InvoiceShelf/
+                  cp -r routes                 /tmp/InvoiceShelf/
+                  cp -r storage                /tmp/InvoiceShelf/
+                  cp -r vendor                 /tmp/InvoiceShelf/ 2>/dev/null || true
+                  cp -r scripts                /tmp/InvoiceShelf/
+                  cp    version.md             /tmp/InvoiceShelf/
+                  cp    .env.example           /tmp/InvoiceShelf/
+                  cp    artisan                /tmp/InvoiceShelf/
+                  cp    composer.json          /tmp/InvoiceShelf/
+                  cp    composer.lock          /tmp/InvoiceShelf/
+                  cp    LICENSE                /tmp/InvoiceShelf/
+                  cp    readme.md              /tmp/InvoiceShelf/
+                  cp    SECURITY.md            /tmp/InvoiceShelf/
+                  cp    server.php             /tmp/InvoiceShelf/
+
+                  # Clean up runtime artifacts
+                  find /tmp/InvoiceShelf -wholename '*/[Tt]ests/*' -delete
+                  find /tmp/InvoiceShelf -wholename '*/[Tt]est/*' -delete
+                  rm -rf /tmp/InvoiceShelf/storage/framework/cache/data/* 2>/dev/null || true
+                  rm -f  /tmp/InvoiceShelf/storage/framework/sessions/* 2>/dev/null || true
+                  rm -f  /tmp/InvoiceShelf/storage/framework/views/* 2>/dev/null || true
+                  rm -f  /tmp/InvoiceShelf/storage/logs/* 2>/dev/null || true
+                  touch  /tmp/InvoiceShelf/storage/logs/laravel.log
+
+            - name: Generate manifest
+              run: php scripts/generate-manifest.php /tmp/InvoiceShelf
+
+            - name: Create zip
+              working-directory: /tmp
+              run: zip -r InvoiceShelf.zip InvoiceShelf/
+
+            - name: Create GitHub Release
+              uses: softprops/action-gh-release@v2
+              with:
+                  files: /tmp/InvoiceShelf.zip
+                  generate_release_notes: true
+                  make_latest: true

Makefile

@@ -29,6 +29,7 @@ dist-gen: clean composer npm-build
 	@cp -r routes                           InvoiceShelf
 	@cp -r storage                          InvoiceShelf
 	@cp -r vendor                           InvoiceShelf 2> /dev/null || true
+	@cp -r scripts                          InvoiceShelf
 	@cp -r version.md						InvoiceShelf
 	@cp -r .env.example                     InvoiceShelf
 	@cp -r artisan                          InvoiceShelf
@@ -47,6 +48,7 @@ dist-clean: dist-gen
 	@rm    InvoiceShelf/storage/framework/sessions/* 2> /dev/null || true
 	@rm    InvoiceShelf/storage/framework/views/* 2> /dev/null || true
 	@rm    InvoiceShelf/storage/logs/* 2> /dev/null || true
+	@php scripts/generate-manifest.php InvoiceShelf
 
 dist: dist-clean
 	@zip -r InvoiceShelf.zip InvoiceShelf

app/Http/Controllers/V1/Admin/Update/CleanFilesController.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Http\Controllers\V1\Admin\Update;
+
+use App\Http\Controllers\Controller;
+use App\Space\Updater;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+
+class CleanFilesController extends Controller
+{
+    /**
+     * Handle the incoming request.
+     *
+     * Removes any file that does not appear in the release manifest.json,
+     * replacing the legacy hardcoded deleted_files list. Falls back to the
+     * legacy deleteFiles() behaviour when the request still ships a
+     * deleted_files payload (backward compatibility for older release
+     * packages built before the manifest was introduced).
+     *
+     * @return Response
+     */
+    public function __invoke(Request $request)
+    {
+        if ((! $request->user()) || (! $request->user()->isOwner())) {
+            return response()->json([
+                'success' => false,
+                'message' => 'You are not allowed to update this app.',
+            ], 401);
+        }
+
+        // Backward compatibility: a release package built before the manifest
+        // was introduced may still ship a deleted_files list. Honour it.
+        if (isset($request->deleted_files) && ! empty($request->deleted_files)) {
+            Updater::deleteFiles($request->deleted_files);
+        }
+
+        $result = Updater::cleanStaleFiles();
+
+        return response()->json($result);
+    }
+}

app/Space/Updater.php

@@ -130,6 +130,80 @@ class Updater
         return true;
     }
 
+    public static function cleanStaleFiles(): array
+    {
+        $manifestPath = base_path('manifest.json');
+
+        if (! File::exists($manifestPath)) {
+            return ['success' => true, 'cleaned' => 0];
+        }
+
+        $manifest = json_decode(File::get($manifestPath), true);
+
+        if (! is_array($manifest)) {
+            return ['success' => false, 'error' => 'Invalid manifest'];
+        }
+
+        $manifestLookup = array_flip($manifest);
+        $protectedPaths = config('invoiceshelf.update_protected_paths', []);
+        $cleaned = 0;
+
+        $iterator = new \RecursiveIteratorIterator(
+            new \RecursiveDirectoryIterator(base_path(), \RecursiveDirectoryIterator::SKIP_DOTS),
+            \RecursiveIteratorIterator::CHILD_FIRST
+        );
+
+        foreach ($iterator as $file) {
+            $relativePath = substr($file->getPathname(), strlen(base_path()) + 1);
+
+            if (static::isProtectedPath($relativePath, $protectedPaths)) {
+                continue;
+            }
+
+            if ($file->isFile() && ! isset($manifestLookup[$relativePath])) {
+                File::delete($file->getPathname());
+                $cleaned++;
+            }
+        }
+
+        // Second pass: remove empty directories
+        $dirIterator = new \RecursiveIteratorIterator(
+            new \RecursiveDirectoryIterator(base_path(), \RecursiveDirectoryIterator::SKIP_DOTS),
+            \RecursiveIteratorIterator::CHILD_FIRST
+        );
+
+        foreach ($dirIterator as $item) {
+            if (! $item->isDir()) {
+                continue;
+            }
+
+            $relativePath = substr($item->getPathname(), strlen(base_path()) + 1);
+
+            if (static::isProtectedPath($relativePath, $protectedPaths)) {
+                continue;
+            }
+
+            $entries = scandir($item->getPathname());
+
+            if (count($entries) <= 2) {
+                @rmdir($item->getPathname());
+            }
+        }
+
+        return ['success' => true, 'cleaned' => $cleaned];
+    }
+
+    private static function isProtectedPath(string $relativePath, array $protectedPaths): bool
+    {
+        foreach ($protectedPaths as $protected) {
+            if ($relativePath === $protected || str_starts_with($relativePath, $protected.'/')) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     public static function migrateUpdate()
     {
         Artisan::call('migrate --force');

config/invoiceshelf.php

@@ -47,6 +47,25 @@ return [
     */
     'base_url' => 'https://invoiceshelf.com',
 
+    /*
+    * Paths protected from cleanup during updates.
+    * The updater will never delete files under these prefixes.
+    */
+    'update_protected_paths' => [
+        '.env',
+        'storage',
+        'vendor',
+        'node_modules',
+        'Modules',
+        'public/storage',
+        '.git',
+        'bootstrap/cache',
+        'manifest.json',
+        'android',
+        'ios',
+        'mobile',
+    ],
+
     /*
     * List of languages supported by InvoiceShelf.
     */

lang/en.json

@@ -1323,6 +1323,7 @@
       "unzipping_package": "Unzipping Package",
       "copying_files": "Copying Files",
       "deleting_files": "Deleting Unused files",
+      "cleaning_stale_files": "Cleaning stale files",
       "running_migrations": "Running Migrations",
       "finishing_update": "Finishing Update",
       "update_failed": "Update Failed",

resources/scripts/admin/views/settings/UpdateAppSetting.vue

@@ -263,8 +263,8 @@ const updateSteps = reactive([
     completed: false,
   },
   {
-    translationKey: 'settings.update_app.deleting_files',
+    translationKey: 'settings.update_app.cleaning_stale_files',
-    stepUrl: '/api/v1/update/delete',
+    stepUrl: '/api/v1/update/clean',
     time: null,
     started: false,
     completed: false,

routes/api.php

@@ -82,6 +82,7 @@ use App\Http\Controllers\V1\Admin\Settings\UpdateCompanySettingsController;
 use App\Http\Controllers\V1\Admin\Settings\UpdateSettingsController;
 use App\Http\Controllers\V1\Admin\Settings\UpdateUserSettingsController;
 use App\Http\Controllers\V1\Admin\Update\CheckVersionController;
+use App\Http\Controllers\V1\Admin\Update\CleanFilesController;
 use App\Http\Controllers\V1\Admin\Update\CopyFilesController;
 use App\Http\Controllers\V1\Admin\Update\DeleteFilesController;
 use App\Http\Controllers\V1\Admin\Update\DownloadUpdateController;
@@ -435,6 +436,8 @@ Route::prefix('/v1')->group(function () {
 
         Route::post('/update/delete', DeleteFilesController::class);
 
+        Route::post('/update/clean', CleanFilesController::class);
+
         Route::post('/update/migrate', MigrateUpdateController::class);
 
         Route::post('/update/finish', FinishUpdateController::class);

scripts/generate-manifest.php

@@ -0,0 +1,61 @@
+<?php
+
+/**
+ * Generate manifest.json for the InvoiceShelf updater.
+ *
+ * Usage: php scripts/generate-manifest.php [base-directory]
+ *
+ * Outputs a sorted JSON array of all relative file paths in the given
+ * directory. The manifest is written to {base-directory}/manifest.json
+ * and is used by the updater to detect and remove stale files after
+ * copying a new release.
+ */
+$basePath = rtrim($argv[1] ?? '.', '/');
+
+if (! is_dir($basePath)) {
+    fwrite(STDERR, "Error: '{$basePath}' is not a directory.\n");
+    exit(1);
+}
+
+$excludedPrefixes = [
+    '.env',
+    '.git/',
+    'storage/',
+    'vendor/',
+    'node_modules/',
+    'Modules/',
+    'bootstrap/cache/',
+    'public/storage/',
+];
+
+$files = [];
+
+$iterator = new RecursiveIteratorIterator(
+    new RecursiveDirectoryIterator($basePath, RecursiveDirectoryIterator::SKIP_DOTS),
+    RecursiveIteratorIterator::SELF_FIRST
+);
+
+foreach ($iterator as $file) {
+    if (! $file->isFile()) {
+        continue;
+    }
+
+    $relativePath = substr($file->getPathname(), strlen($basePath) + 1);
+
+    foreach ($excludedPrefixes as $prefix) {
+        if (str_starts_with($relativePath, $prefix)) {
+            continue 2;
+        }
+    }
+
+    $files[] = $relativePath;
+}
+
+sort($files);
+
+$json = json_encode($files, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
+
+file_put_contents($basePath.'/manifest.json', $json."\n");
+
+$count = count($files);
+fwrite(STDOUT, "manifest.json written with {$count} files.\n");