Use releaseTag with fallback to downloadUrl in updates.xml

[christophwille]

See #3707

Would need modification to

ILSpy/updates.xml

Line 4 in 5081163

<downloadUrl>https://github.com/icsharpcode/ILSpy/releases/tag/v10.0</downloadUrl>

to include releaseTag.

• releaseTag takes precedence over downloadUrl
• URLs from both of those inputs must conform to a specific base url (mitigate path traversal attempts and downloads from non-sanctioned sites)

[Copilot]

Pull request overview

Updates ILSpy’s update-check parsing to support a new releaseTag field in updates.xml (per #3707), enabling update links to be constructed from GitHub release tags with a fallback to the legacy downloadUrl.

Changes:

• Add support for <releaseTag> in UpdateService, constructing a GitHub releases/tag URL and falling back to <downloadUrl> when missing.
• Refactor update fetching to allow dependency injection of HttpClient/URL for testing.
• Add NUnit tests covering releaseTag behavior and wire the new test file into the test project.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
ILSpy/Updates/UpdateService.cs	Parses releaseTag and builds the GitHub tag URL; adds injectable overload for testability.
ILSpy.Tests/UpdateServiceTests.cs	Adds unit tests validating releaseTag handling and fallback behavior.
ILSpy.Tests/ILSpy.Tests.csproj	Includes the new test file in the explicit compile item list.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.