feat: gzipped arweave deploys and a staging channel on arweave

.github/workflows/production.yaml

@@ -54,15 +54,41 @@ jobs:
           firebaseServiceAccount: '${{ secrets.FIREBASE_CI_SERVICE_ACCOUNT }}'
           channelId: live
 
-      # Deploy to Arweave
+      # Source maps are for Firebase, which has deployed above. On Arweave they
+      # would only add 11 MB to pay for.
+      - name: Leave source maps out of the Arweave deploy
+        run: find build/web -name '*.map' -delete
+
+      # Deploy to Arweave, gzipped: each file is stored compressed with a
+      # `Content-Encoding: gzip` tag, which gateways send with the bytes, so a
+      # first visit downloads about 20 MB instead of 77 MB. Library pages load
+      # this bundle by its manifest ID (docs/LIBRARY_PAGES.md). Pinned to the
+      # v2.1.2 commit, the first to install the newest Node 22 rather than
+      # the runner's cached one (CVE-2026-111497, the brotli decoder); the
+      # action installs @ar.io/deploy@^2 itself.
       - name: Deploy to Arweave
-        uses: ar-io/ar-io-deploy@v1
+        id: arweave
+        uses: ar-io/ar-io-deploy@a7290af1906eeea3acc4f4a96d2a53cd7eb625bd # v2.1.2
         with:
           deploy-key: ${{ secrets.DEPLOY_KEY }}
           arns-key: ${{ secrets.ARNS_KEY }}
           arns-name: ${{ secrets.ARNS_NAME }}
           undername: ${{ secrets.DEPLOY_ANT_UNDERNAME }}
           deploy-folder: ./build/web
+          compress: gzip
+
+      - name: Record the Arweave manifest
+        env:
+          MANIFEST_ID: ${{ steps.arweave.outputs.tx-id }}
+        run: |
+          echo "Production on Arweave ($GITHUB_SHA): [$MANIFEST_ID](https://turbo-gateway.com/$MANIFEST_ID/)" >> "$GITHUB_STEP_SUMMARY"
+
+      # A miss here does not undo the deploy, so it is reported, not fatal.
+      - name: Warm the gateways
+        continue-on-error: true
+        env:
+          MANIFEST_ID: ${{ steps.arweave.outputs.tx-id }}
+        run: bash tool/warm_arweave_manifest.sh "$MANIFEST_ID"
 
 
   build-ios:

.github/workflows/staging-arweave.yaml

@@ -0,0 +1,85 @@
+name: 'Staging build to Arweave'
+
+# Uploads a staging build of the chosen branch to Arweave, gzipped, for
+# trying library mode on Arweave before a release (docs/LIBRARY_PAGES.md).
+# Manual only: every run is paid for by the deploy wallet, and pushes to dev
+# deploy staging.ardrive.io through staging.yaml, not here. There is no ArNS
+# name; the manifest ID is in the job summary.
+on:
+  workflow_dispatch:
+
+jobs:
+  upload:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    concurrency:
+      group: staging-arweave
+      cancel-in-progress: false
+    # Every action is pinned by commit: this job holds DEPLOY_KEY, and any
+    # step before the upload can change what it uploads.
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      # Set Flutter version from fvm
+      - uses: kuhnroyal/flutter-fvm-config-action@6ffa30473b346f7d7c63cf9e03e6a886f940a72b # v1.2.0
+
+      # Install Flutter
+      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
+        with:
+          channel: ${{ env.FLUTTER_CHANNEL }}
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+
+      - name: Install script_runner
+        run: flutter pub global activate script_runner
+
+      # The staging build, without source maps: on Arweave they would only
+      # add 11 MB to pay for.
+      - name: Build app
+        run: |
+          scr setup
+          flutter config --enable-web
+          flutter build web --dart-define=environment=staging --release --pwa-strategy=none --no-web-resources-cdn --dart2js-optimization=O1
+
+      # An exact, patched Node: '22' alone can resolve to an older 22.x the
+      # runner image already has, and the CLI decodes brotli responses
+      # (CVE-2026-111497, fixed in 22.23.4 and 24.22.1).
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '24.22.1'
+
+      # The action has no upload-only mode (it always updates an ArNS name),
+      # so this runs the CLI at an exact version. --incremental reuses files
+      # this wallet already uploaded, so a run pays mostly for main.dart.js.
+      - name: Upload to Arweave
+        id: upload
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
+          NO_COLOR: '1'
+        run: |
+          # Without a `shell:`, steps run without pipefail, and `tee` would
+          # hide a failed upload.
+          set -o pipefail
+          # The CLI takes an Arweave JWK base64-encoded, as the action does.
+          if [[ "$DEPLOY_KEY" =~ ^\{.*\}$ ]]; then
+            DEPLOY_KEY=$(printf '%s' "$DEPLOY_KEY" | base64 -w0)
+          fi
+          export DEPLOY_KEY
+          npx --yes @ar.io/deploy@2.1.2 upload --deploy-folder build/web \
+            --compress gzip --incremental | tee upload.log
+          id=$(sed -n 's/^Tx ID: \([A-Za-z0-9_-]\{43\}\)$/\1/p' upload.log | head -1)
+          if [ -z "$id" ]; then
+            echo "::error::The upload printed no Tx ID."
+            exit 1
+          fi
+          echo "tx-id=$id" >> "$GITHUB_OUTPUT"
+          echo "Staging on Arweave ($GITHUB_REF_NAME, $GITHUB_SHA): [$id](https://turbo-gateway.com/$id/)" >> "$GITHUB_STEP_SUMMARY"
+
+      # A miss here does not undo the upload, so it is reported, not fatal.
+      - name: Warm the gateways
+        continue-on-error: true
+        env:
+          MANIFEST_ID: ${{ steps.upload.outputs.tx-id }}
+        run: bash tool/warm_arweave_manifest.sh "$MANIFEST_ID"

CLAUDE.md

@@ -324,6 +324,17 @@ Users see "deployment" for an Arweave manifest the app creates or updates (New d
   breaks the shared history and makes the next release PR conflict.
 - `dev`'s `pubspec.yaml` version is not bumped after releases, so staging reports an
   older version than production.
+- Production also puts the build on Arweave **gzipped** (`--compress gzip`: each file is
+  stored compressed with a `Content-Encoding: gzip` tag, about 20 MB instead of 77) and
+  without source maps, with `ar-io/ar-io-deploy` (pinned by commit), and moves the ArNS
+  name. Pushes to `dev` never touch Arweave. To try library mode on Arweave before a
+  release, run *Staging build to Arweave* (`staging-arweave.yaml`) by hand on a branch: it
+  uploads a staging build the same way, paid by the deploy wallet, with no ArNS name, and
+  puts the manifest ID in the job summary (`docs/LIBRARY_PAGES.md`).
+  Each upload then reads every path through turbo-gateway.com and ardrive.net with
+  `tool/warm_arweave_manifest.sh <manifest-id>`, which also fails on a gateway sending gzip
+  bytes without the header. A new upload can 404 on a gateway other than
+  turbo-gateway.com for a while after it lands: that's propagation, not a broken deploy.
 
 ## Working alongside other agents