[Juliusolsson05]

Problem

Releases need a manual workflow_dispatch with a version-matching tag, and every asset name carries the version. So users sit on stale builds, and no URL for "the current build" survives a bump (#1011).

Implemented

• .github/workflows/nightly.yml, scheduled 05:00 UTC plus dispatch with a force input:
  1. validate the signing secrets;
  2. decide: skip only if the triggering SHA already has a complete nightly;
  3. build through the shared pipeline;
  4. rename to fixed names (Agent.Code-nightly-<arch>.dmg/.zip) and drop the updater metadata;
  5. publish the rolling nightly prerelease with a marker-less body;
  6. only after every upload succeeds, record the built-from: <sha> marker.
• scripts/release/nightly.mjs (decide, rename, notes; Node built-ins only). It is the single implementation of the workflow's logic, so it is testable.
• .github/workflows/reusable-app-build-macos.yml: release.yml's build and package jobs, extracted verbatim (three documented deltas). release.yml gains only a comment pointing at the mirror.
• .gitignore: release anchored to /release/. The unanchored rule silently ignored scripts/release/ and testing/system/release/, which would have shipped the workflow without its script.

Review (2026-09-19, two independent reviewers, CHANGES REQUESTED) → resolved

Finding	Resolution
Marker written before the uploads, so a failed upload is skipped forever (major)	Publish without the marker; gh release edit writes it last. A skip also requires all 4 assets uploaded.
CRLF body → \r kept → never skips → git log crash (major)	CRLF-safe, exact-40-hex parse. Reproduced with a real CRLF body: the old sed parse returned fd5a2a1f…$'\r' ≠ HEAD.
Unreachable previous SHA crashes git log after a full build (major)	git cat-file -e guard, falling back to recent history.
Pre-merge branch dispatch is impossible (process)	Plan corrected: workflow_dispatch needs the file on the default branch, so verification runs after merge.
"Queues, never cancels" is false; could cancel a pending release.yml (minor)	Own group, release-nightly.
"Stable outranks by date" is false; softprops sends make_latest on every update (minor)	The nightly is a prerelease with make_latest: false. The stable release owns "latest".
Tag lands on the default-branch HEAD, not the built commit (nit)	target_commitish: head-sha. The body links the exact tree and states that the tag and "Source code" archives are frozen at the first nightly.
nullglob, any API error treated as a 404, unused env (nits)	Fixed. Only a 404 means "no nightly"; a real 401 fails loudly.
Delete→upload 404 window (minor)	Documented as an accepted trade-off. A fresh page falls back to Releases.
Drift warning in one direction only (minor)	Comment pointer added in release.yml.

Verification

• testing/system/release/nightly.test.ts: 16 system tests, written before the script, all failing first, now passing.
  • They run the real script as a process.
  • A stub gh replays recorded payloads (testing/fixtures/release-nightly, provenance in its README): our v0.0.2-beta.1 release, the real 404 for nightly, a real 401, and a real CRLF release body.
  • Notes run against a real git repo, and rename runs on the real published artifact names.
• actionlint is clean on all three workflow files.
• End-to-end after merge: gh workflow run nightly.yml publishes the first nightly prerelease, and a second dispatch with no new commits must skip. The run link will be added here.

Follow-ups

• Adopt the reusable jobs in release.yml once a nightly has run green.
• Stamp the version on nightlies.
• Landing-page status line for stable vs. nightly (release-readiness Stage 8).

Refs #1011

🤖 Generated with Claude Code