Replace deleted_files with manifest-based updater cleanup, add release workflow

- Add manifest.json generation script (scripts/generate-manifest.php)
- Add Updater::cleanStaleFiles() that removes files not in manifest
- Add /api/v1/update/clean endpoint with backward compatibility
- Add configurable update_protected_paths in config/invoiceshelf.php
- Update frontend to use clean step instead of delete step
- Add GitHub Actions release workflow triggered on version tags
- Add .github/release.yml for auto-generated changelog categories
- Update Makefile to include manifest generation and scripts directory

Backport from v3.0 (e6452946). Adapted for master's existing structure: master uses one-controller-per-action under app/Http/Controllers/V1/Admin/Update/, so the new endpoint is implemented as a dedicated CleanFilesController matching the existing DeleteFilesController/CopyFilesController/etc. pattern instead of v3.0's unified UpdateController. The legacy /update/delete route and DeleteFilesController are retained for compatibility — only the frontend (resources/scripts/admin/views/settings/UpdateAppSetting.vue) is updated to call /update/clean. Updater service lives at app/Space/Updater.php on master (not yet refactored to app/Services/Update/Updater.php like v3.0).

.github/release.yml

@@ -0,0 +1,18 @@
+changelog:
+    categories:
+        - title: New Features
+          labels:
+              - enhancement
+              - feature
+        - title: Bug Fixes
+          labels:
+              - bug
+              - fix
+        - title: Maintenance
+          labels:
+              - chore
+              - dependencies
+              - ci
+        - title: Other Changes
+          labels:
+              - "*"

.github/workflows/release.yaml

@@ -0,0 +1,96 @@
+name: Release
+
+on:
+    push:
+        tags:
+            - "v*"
+
+permissions:
+    contents: write
+
+jobs:
+    release:
+        name: Build & Release
+        runs-on: ubuntu-latest
+        env:
+            extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_mysql, zip
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v4
+              with:
+                  fetch-depth: 0
+
+            - name: Setup PHP
+              uses: shivammathur/setup-php@v2
+              with:
+                  php-version: 8.4
+                  extensions: ${{ env.extensions }}
+                  tools: composer
+
+            - name: Install Composer dependencies
+              run: composer install --no-dev --optimize-autoloader --no-interaction
+
+            - name: Use Node.js 24
+              uses: actions/setup-node@v4
+              with:
+                  node-version: 24
+
+            - name: Install npm dependencies
+              run: npm ci
+
+            - name: Build frontend
+              run: npm run build
+
+            - name: Prepare release directory
+              run: |
+                  mkdir -p /tmp/InvoiceShelf/public
+
+                  cp -r app                    /tmp/InvoiceShelf/
+                  cp -r bootstrap              /tmp/InvoiceShelf/
+                  cp -r config                 /tmp/InvoiceShelf/
+                  cp -r database               /tmp/InvoiceShelf/
+                  cp -r public/build           /tmp/InvoiceShelf/public/
+                  cp -r public/favicons        /tmp/InvoiceShelf/public/
+                  cp    public/.htaccess       /tmp/InvoiceShelf/public/
+                  cp    public/index.php       /tmp/InvoiceShelf/public/
+                  cp    public/robots.txt      /tmp/InvoiceShelf/public/
+                  cp    public/web.config      /tmp/InvoiceShelf/public/
+                  cp -r resources              /tmp/InvoiceShelf/
+                  cp -r lang                   /tmp/InvoiceShelf/
+                  cp -r routes                 /tmp/InvoiceShelf/
+                  cp -r storage                /tmp/InvoiceShelf/
+                  cp -r vendor                 /tmp/InvoiceShelf/ 2>/dev/null || true
+                  cp -r scripts                /tmp/InvoiceShelf/
+                  cp    version.md             /tmp/InvoiceShelf/
+                  cp    .env.example           /tmp/InvoiceShelf/
+                  cp    artisan                /tmp/InvoiceShelf/
+                  cp    composer.json          /tmp/InvoiceShelf/
+                  cp    composer.lock          /tmp/InvoiceShelf/
+                  cp    LICENSE                /tmp/InvoiceShelf/
+                  cp    readme.md              /tmp/InvoiceShelf/
+                  cp    SECURITY.md            /tmp/InvoiceShelf/
+                  cp    server.php             /tmp/InvoiceShelf/
+
+                  # Clean up runtime artifacts
+                  find /tmp/InvoiceShelf -wholename '*/[Tt]ests/*' -delete
+                  find /tmp/InvoiceShelf -wholename '*/[Tt]est/*' -delete
+                  rm -rf /tmp/InvoiceShelf/storage/framework/cache/data/* 2>/dev/null || true
+                  rm -f  /tmp/InvoiceShelf/storage/framework/sessions/* 2>/dev/null || true
+                  rm -f  /tmp/InvoiceShelf/storage/framework/views/* 2>/dev/null || true
+                  rm -f  /tmp/InvoiceShelf/storage/logs/* 2>/dev/null || true
+                  touch  /tmp/InvoiceShelf/storage/logs/laravel.log
+
+            - name: Generate manifest
+              run: php scripts/generate-manifest.php /tmp/InvoiceShelf
+
+            - name: Create zip
+              working-directory: /tmp
+              run: zip -r InvoiceShelf.zip InvoiceShelf/
+
+            - name: Create GitHub Release
+              uses: softprops/action-gh-release@v2
+              with:
+                  files: /tmp/InvoiceShelf.zip
+                  generate_release_notes: true
+                  make_latest: true

Makefile

@@ -29,6 +29,7 @@ dist-gen: clean composer npm-build
 	@cp -r routes                           InvoiceShelf
 	@cp -r storage                          InvoiceShelf
 	@cp -r vendor                           InvoiceShelf 2> /dev/null || true
+	@cp -r scripts                          InvoiceShelf
 	@cp -r version.md						InvoiceShelf
 	@cp -r .env.example                     InvoiceShelf
 	@cp -r artisan                          InvoiceShelf
@@ -47,6 +48,7 @@ dist-clean: dist-gen
 	@rm    InvoiceShelf/storage/framework/sessions/* 2> /dev/null || true
 	@rm    InvoiceShelf/storage/framework/views/* 2> /dev/null || true
 	@rm    InvoiceShelf/storage/logs/* 2> /dev/null || true
+	@php scripts/generate-manifest.php InvoiceShelf
 
 dist: dist-clean
 	@zip -r InvoiceShelf.zip InvoiceShelf

app/Http/Controllers/V1/Admin/Report/ExpensesReportController.php

@@ -7,11 +7,12 @@ use App\Models\Company;
 use App\Models\CompanySetting;
 use App\Models\Currency;
 use App\Models\Expense;
+use Barryvdh\DomPDF\Facade\Pdf;
 use Carbon\Carbon;
-use Illuminate\Http\JsonResponse;
+use Illuminate\Contracts\View\View;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 use Illuminate\Support\Facades\App;
-use PDF;
 
 class ExpensesReportController extends Controller
 {
@@ -19,7 +20,7 @@ class ExpensesReportController extends Controller
      * Handle the incoming request.
      *
      * @param  string  $hash
-     * @return JsonResponse
+     * @return View|Response
      */
     public function __invoke(Request $request, $hash)
     {
@@ -31,14 +32,26 @@ class ExpensesReportController extends Controller
 
         App::setLocale($locale);
 
-        $expenseCategories = Expense::with('category')
+        // Fetch individual expenses (filtered and ordered by date), then group by category
+        $expenses = Expense::with('category')
             ->whereCompanyId($company->id)
-            ->applyFilters($request->only(['from_date', 'to_date']))
-            ->expensesAttributes()
+            ->applyFilters($request->only(['from_date', 'to_date', 'expense_category_id']))
+            ->orderBy('expense_date', 'asc')
             ->get();
-        $totalAmount = 0;
-        foreach ($expenseCategories as $category) {
-            $totalAmount += $category->total_amount;
+
+        $totalAmount = $expenses->sum('base_amount');
+
+        $grouped = $expenses->groupBy(function ($item) {
+            return $item->category ? $item->category->name : trans('expenses.uncategorized');
+        });
+
+        $expenseGroups = collect();
+        foreach ($grouped as $categoryName => $group) {
+            $expenseGroups->push([
+                'name' => $categoryName,
+                'expenses' => $group,
+                'total' => $group->sum('base_amount'),
+            ]);
         }
 
         $dateFormat = CompanySetting::getSetting('carbon_date_format', $company->id);
@@ -62,7 +75,7 @@ class ExpensesReportController extends Controller
             ->get();
 
         view()->share([
-            'expenseCategories' => $expenseCategories,
+            'expenseGroups' => $expenseGroups,
             'colorSettings' => $colorSettings,
             'totalExpense' => $totalAmount,
             'company' => $company,
@@ -70,7 +83,7 @@ class ExpensesReportController extends Controller
             'to_date' => $to_date,
             'currency' => $currency,
         ]);
-        $pdf = PDF::loadView('app.pdf.reports.expenses');
+        $pdf = Pdf::loadView('app.pdf.reports.expenses');
 
         if ($request->has('preview')) {
             return view('app.pdf.reports.expenses');

app/Http/Controllers/V1/Admin/Update/CleanFilesController.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Http\Controllers\V1\Admin\Update;
+
+use App\Http\Controllers\Controller;
+use App\Space\Updater;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+
+class CleanFilesController extends Controller
+{
+    /**
+     * Handle the incoming request.
+     *
+     * Removes any file that does not appear in the release manifest.json,
+     * replacing the legacy hardcoded deleted_files list. Falls back to the
+     * legacy deleteFiles() behaviour when the request still ships a
+     * deleted_files payload (backward compatibility for older release
+     * packages built before the manifest was introduced).
+     *
+     * @return Response
+     */
+    public function __invoke(Request $request)
+    {
+        if ((! $request->user()) || (! $request->user()->isOwner())) {
+            return response()->json([
+                'success' => false,
+                'message' => 'You are not allowed to update this app.',
+            ], 401);
+        }
+
+        // Backward compatibility: a release package built before the manifest
+        // was introduced may still ship a deleted_files list. Honour it.
+        if (isset($request->deleted_files) && ! empty($request->deleted_files)) {
+            Updater::deleteFiles($request->deleted_files);
+        }
+
+        $result = Updater::cleanStaleFiles();
+
+        return response()->json($result);
+    }
+}

app/Space/Updater.php

@@ -130,6 +130,80 @@ class Updater
         return true;
     }
 
+    public static function cleanStaleFiles(): array
+    {
+        $manifestPath = base_path('manifest.json');
+
+        if (! File::exists($manifestPath)) {
+            return ['success' => true, 'cleaned' => 0];
+        }
+
+        $manifest = json_decode(File::get($manifestPath), true);
+
+        if (! is_array($manifest)) {
+            return ['success' => false, 'error' => 'Invalid manifest'];
+        }
+
+        $manifestLookup = array_flip($manifest);
+        $protectedPaths = config('invoiceshelf.update_protected_paths', []);
+        $cleaned = 0;
+
+        $iterator = new \RecursiveIteratorIterator(
+            new \RecursiveDirectoryIterator(base_path(), \RecursiveDirectoryIterator::SKIP_DOTS),
+            \RecursiveIteratorIterator::CHILD_FIRST
+        );
+
+        foreach ($iterator as $file) {
+            $relativePath = substr($file->getPathname(), strlen(base_path()) + 1);
+
+            if (static::isProtectedPath($relativePath, $protectedPaths)) {
+                continue;
+            }
+
+            if ($file->isFile() && ! isset($manifestLookup[$relativePath])) {
+                File::delete($file->getPathname());
+                $cleaned++;
+            }
+        }
+
+        // Second pass: remove empty directories
+        $dirIterator = new \RecursiveIteratorIterator(
+            new \RecursiveDirectoryIterator(base_path(), \RecursiveDirectoryIterator::SKIP_DOTS),
+            \RecursiveIteratorIterator::CHILD_FIRST
+        );
+
+        foreach ($dirIterator as $item) {
+            if (! $item->isDir()) {
+                continue;
+            }
+
+            $relativePath = substr($item->getPathname(), strlen(base_path()) + 1);
+
+            if (static::isProtectedPath($relativePath, $protectedPaths)) {
+                continue;
+            }
+
+            $entries = scandir($item->getPathname());
+
+            if (count($entries) <= 2) {
+                @rmdir($item->getPathname());
+            }
+        }
+
+        return ['success' => true, 'cleaned' => $cleaned];
+    }
+
+    private static function isProtectedPath(string $relativePath, array $protectedPaths): bool
+    {
+        foreach ($protectedPaths as $protected) {
+            if ($relativePath === $protected || str_starts_with($relativePath, $protected.'/')) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     public static function migrateUpdate()
     {
         Artisan::call('migrate --force');

config/invoiceshelf.php

@@ -47,6 +47,25 @@ return [
     */
     'base_url' => 'https://invoiceshelf.com',
 
+    /*
+    * Paths protected from cleanup during updates.
+    * The updater will never delete files under these prefixes.
+    */
+    'update_protected_paths' => [
+        '.env',
+        'storage',
+        'vendor',
+        'node_modules',
+        'Modules',
+        'public/storage',
+        '.git',
+        'bootstrap/cache',
+        'manifest.json',
+        'android',
+        'ios',
+        'mobile',
+    ],
+
     /*
     * List of languages supported by InvoiceShelf.
     */

lang/en.json

@@ -652,6 +652,7 @@
     "currency": "Currency",
     "contact": "Contact",
     "category": "Category",
+    "uncategorized": "Uncategorized",
     "from_date": "From Date",
     "to_date": "To Date",
     "expense_date": "Date",
@@ -1322,6 +1323,7 @@
       "unzipping_package": "Unzipping Package",
       "copying_files": "Copying Files",
       "deleting_files": "Deleting Unused files",
+      "cleaning_stale_files": "Cleaning stale files",
       "running_migrations": "Running Migrations",
       "finishing_update": "Finishing Update",
       "update_failed": "Update Failed",
@@ -1649,6 +1651,7 @@
   "pdf_total_tax_label": "TOTAL TAX",
   "pdf_tax_types_label": "Tax Types",
   "pdf_expenses_label": "Expenses",
+  "pdf_expense_group_total_label": "Group total:",
   "pdf_bill_to": "Bill to,",
   "pdf_ship_to": "Ship to,",
   "pdf_received_from": "Received from:",

resources/scripts/admin/views/settings/UpdateAppSetting.vue

@@ -263,8 +263,8 @@ const updateSteps = reactive([
     completed: false,
   },
   {
-    translationKey: 'settings.update_app.deleting_files',
-    stepUrl: '/api/v1/update/delete',
+    translationKey: 'settings.update_app.cleaning_stale_files',
+    stepUrl: '/api/v1/update/clean',
     time: null,
     started: false,
     completed: false,

resources/views/app/pdf/reports/expenses.blade.php

@@ -33,7 +33,7 @@
         .heading-date-range {
             font-weight: normal;
             font-size: 15px;
-            color: #A5ACC1;
+            color: #606060;
             width: 100%;
             text-align: right;
             padding: 0px;
@@ -41,7 +41,7 @@
         }
 
         .sub-heading-text {
-            font-weight: normal;
+            font-weight: bold;
             font-size: 16px;
             color: #595959;
             padding: 0px;
@@ -50,8 +50,7 @@
         }
 
         .expenses-title {
-            margin-top: 60px;
-            padding-left: 3px;
+            margin-top: 30px;
             font-size: 16px;
             line-height: 21px;
             color: #040405;
@@ -133,6 +132,84 @@
             line-height: 21px;
             color: #5851D8;
         }
+        
+        /* -- Items Table -- */
+
+        .items-table {
+            margin-top: 35px;
+            padding: 0px 30px 10px 30px;
+            page-break-before: avoid;
+            page-break-after: auto;
+        }
+
+        .items-table hr {
+            height: 0.1px;
+        }
+
+        .item-table-heading-left {
+            font-size: 13.5;
+            text-align: left;
+            color: rgba(0, 0, 0, 0.85);
+            padding: 5px;
+            padding-bottom: 10px;
+        }
+        
+        .item-table-heading-right {
+            font-size: 13.5;
+            text-align: right;
+            color: rgba(0, 0, 0, 0.85);
+            padding: 5px;
+            padding-bottom: 10px;
+        }
+
+        tr.item-table-heading-row th {
+            border-bottom: 0.620315px solid #E8E8E8;
+            font-size: 12px;
+            line-height: 18px;
+        }
+
+        .item-table-heading-row {
+            margin-bottom: 10px;
+        }
+
+        tr.item-row td {
+            font-size: 12px;
+            line-height: 18px;
+        }
+
+        .item-cell-left {
+            font-size: 13;
+            color: #040405;
+            text-align: left;
+            padding: 5px;
+            padding-top: 10px;
+            border-color: #d9d9d9;
+        }
+        
+        .item-cell-right {
+            font-size: 13;
+            color: #040405;
+            text-align: right;
+            padding: 5px;
+            padding-top: 10px;
+            border-color: #d9d9d9;
+        }
+
+        .item-description {
+            color: #595959;
+            font-size: 9px;
+            line-height: 12px;
+        }
+        
+        .item-table-group-total {
+            font-size: 14px;
+            font-weight: bold;
+            text-align: right;
+            color: rgba(0, 0, 0, 0.85);
+            padding: 5px;
+            padding-bottom: 10px;
+        }
+        
     </style>
 
     @if (App::isLocale('th'))
@@ -158,33 +235,28 @@
             </tr>
         </table>
         <p class="expenses-title">@lang('pdf_expenses_label')</p>
-        <div class="expenses-table-container">
-            <table class="expenses-table">
-                @foreach ($expenseCategories as $expenseCategory)
-                <tr>
-                    <td>
-                        <p class="expense-title">
-                            {{ $expenseCategory->category->name }}
-                        </p>
-                    </td>
-                    <td>
-                        <p class="expense-amount">
-                            {!! format_money_pdf($expenseCategory->total_amount, $currency) !!}
-                        </p>
-                    </td>
+            @foreach ($expenseGroups as $group)
+            <p class="expense-title">{{ $group['name'] }}</p>
+              <table width="100%" style="margin-bottom:18px;">
+                <tr class="item-table-heading-row">
+                    <th style="width: 15%;" class="text-left item-table-heading-left">@lang('Date')</th>
+                    <th style="width: 70%;" class="text-left item-table-heading-left">@lang('Note')</th>
+                    <th style="width: 15%;" class="text-right item-table-heading-right">@lang('Amount')</th>
+                </tr>
+                @foreach ($group['expenses'] as $expense)
+                <tr class="item-row">
+                    <td style="width: 15%;" class="text-left item-cell-left">{{ $expense->formatted_expense_date }}</td>
+                    <td style="width: 70%;" class="text-left item-cell-left">{{ $expense->notes ? $expense->notes : '-' }}</td>
+                    <td style="width: 15%;" class="text-right item-cell-right">{!! format_money_pdf($expense->base_amount, $currency) !!}</td>
                 </tr>
                 @endforeach
-            </table>
-        </div>
-    </div>
 
-    <table class="expense-total-table">
-        <tr>
-            <td class="expense-total-cell">
-                <p class="expense-total">{!! format_money_pdf($totalExpense, $currency) !!}</p>
-            </td>
-        </tr>
-    </table>
+              </table>
+               <div class="item-table-group-total">
+                <p>@lang('pdf_expense_group_total_label')&nbsp;&nbsp;&nbsp;<span style="color: #5851D8;">{!! format_money_pdf($group['total'], $currency) !!}</span></p>
+               </div>
+            @endforeach
+    </div>
     <table class="report-footer">
         <tr>
             <td>

routes/api.php

@@ -82,6 +82,7 @@ use App\Http\Controllers\V1\Admin\Settings\UpdateCompanySettingsController;
 use App\Http\Controllers\V1\Admin\Settings\UpdateSettingsController;
 use App\Http\Controllers\V1\Admin\Settings\UpdateUserSettingsController;
 use App\Http\Controllers\V1\Admin\Update\CheckVersionController;
+use App\Http\Controllers\V1\Admin\Update\CleanFilesController;
 use App\Http\Controllers\V1\Admin\Update\CopyFilesController;
 use App\Http\Controllers\V1\Admin\Update\DeleteFilesController;
 use App\Http\Controllers\V1\Admin\Update\DownloadUpdateController;
@@ -435,6 +436,8 @@ Route::prefix('/v1')->group(function () {
 
         Route::post('/update/delete', DeleteFilesController::class);
 
+        Route::post('/update/clean', CleanFilesController::class);
+
         Route::post('/update/migrate', MigrateUpdateController::class);
 
         Route::post('/update/finish', FinishUpdateController::class);

scripts/generate-manifest.php

@@ -0,0 +1,61 @@
+<?php
+
+/**
+ * Generate manifest.json for the InvoiceShelf updater.
+ *
+ * Usage: php scripts/generate-manifest.php [base-directory]
+ *
+ * Outputs a sorted JSON array of all relative file paths in the given
+ * directory. The manifest is written to {base-directory}/manifest.json
+ * and is used by the updater to detect and remove stale files after
+ * copying a new release.
+ */
+$basePath = rtrim($argv[1] ?? '.', '/');
+
+if (! is_dir($basePath)) {
+    fwrite(STDERR, "Error: '{$basePath}' is not a directory.\n");
+    exit(1);
+}
+
+$excludedPrefixes = [
+    '.env',
+    '.git/',
+    'storage/',
+    'vendor/',
+    'node_modules/',
+    'Modules/',
+    'bootstrap/cache/',
+    'public/storage/',
+];
+
+$files = [];
+
+$iterator = new RecursiveIteratorIterator(
+    new RecursiveDirectoryIterator($basePath, RecursiveDirectoryIterator::SKIP_DOTS),
+    RecursiveIteratorIterator::SELF_FIRST
+);
+
+foreach ($iterator as $file) {
+    if (! $file->isFile()) {
+        continue;
+    }
+
+    $relativePath = substr($file->getPathname(), strlen($basePath) + 1);
+
+    foreach ($excludedPrefixes as $prefix) {
+        if (str_starts_with($relativePath, $prefix)) {
+            continue 2;
+        }
+    }
+
+    $files[] = $relativePath;
+}
+
+sort($files);
+
+$json = json_encode($files, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
+
+file_put_contents($basePath.'/manifest.json', $json."\n");
+
+$count = count($files);
+fwrite(STDOUT, "manifest.json written with {$count} files.\n");