fix: add checksums.txt fallback for SHA256 verification

Try per-binary .sha256 sidecar file first, then fall back to
goreleaser's checksums.txt if the sidecar isn't available. Adds
resilience for future changes to the release artifact structure.

Author: zach-snell

action.yml

@@ -103,20 +103,31 @@ runs:
         BINARY: ${{ steps.platform.outputs.binary }}
       run: |
         mkdir -p "$RUNNER_TEMP/mockd-bin"
-        URL="https://github.com/getmockd/mockd/releases/download/v${VERSION}/${BINARY}"
-        CHECKSUM_URL="${URL}.sha256"
+        BASE_URL="https://github.com/getmockd/mockd/releases/download/v${VERSION}"
+        URL="${BASE_URL}/${BINARY}"
         echo "Downloading mockd v${VERSION} from ${URL}"
         curl -fsSL -o "$RUNNER_TEMP/mockd-bin/mockd" "$URL"
-        curl -fsSL -o "$RUNNER_TEMP/mockd-bin/mockd.sha256" "$CHECKSUM_URL"
 
-        # Verify checksum
-        EXPECTED=$(awk '{print $1}' "$RUNNER_TEMP/mockd-bin/mockd.sha256")
-        ACTUAL=$(sha256sum "$RUNNER_TEMP/mockd-bin/mockd" | awk '{print $1}')
-        if [ "$EXPECTED" != "$ACTUAL" ]; then
-          echo "::error::SHA256 checksum mismatch! Expected: $EXPECTED, Got: $ACTUAL"
-          exit 1
+        # Try per-binary .sha256 sidecar first, fall back to checksums.txt
+        EXPECTED=""
+        if curl -fsSL -o "$RUNNER_TEMP/mockd-bin/mockd.sha256" "${URL}.sha256" 2>/dev/null; then
+          EXPECTED=$(awk '{print $1}' "$RUNNER_TEMP/mockd-bin/mockd.sha256")
+          echo "Using per-binary checksum sidecar"
+        elif curl -fsSL -o "$RUNNER_TEMP/mockd-bin/checksums.txt" "${BASE_URL}/checksums.txt" 2>/dev/null; then
+          EXPECTED=$(grep "  ${BINARY}$" "$RUNNER_TEMP/mockd-bin/checksums.txt" | awk '{print $1}')
+          echo "Using checksums.txt (sidecar not found)"
+        fi
+
+        if [ -z "$EXPECTED" ]; then
+          echo "::warning::No checksum found for ${BINARY} — skipping verification"
+        else
+          ACTUAL=$(sha256sum "$RUNNER_TEMP/mockd-bin/mockd" | awk '{print $1}')
+          if [ "$EXPECTED" != "$ACTUAL" ]; then
+            echo "::error::SHA256 checksum mismatch! Expected: $EXPECTED, Got: $ACTUAL"
+            exit 1
+          fi
+          echo "Checksum verified: $ACTUAL"
         fi
-        echo "Checksum verified: $ACTUAL"
         chmod +x "$RUNNER_TEMP/mockd-bin/mockd"
 
     - name: Install mockd