From a10092ae0aac7e184a86dd9b42a1a49ae1d13fac Mon Sep 17 00:00:00 2001 From: JUN Date: Tue, 22 Sep 2026 23:08:55 +0900 Subject: [PATCH] fix(release): publish the GitHub release only after its verified assets attach GitHub freezes a release when it is published, so the attach step's upload came back HTTP 422 "Cannot upload assets to an immutable release". Every release from v2.55.0 to v2.60.0 therefore shipped with zero assets and the desktop updater had nothing to download. Create the release as a draft and flip it to published in attach-release, after the verified bundle is uploaded. Release notes still come from the validated notes file written at creation. --- .github/workflows/release.yml | 19 +++++++++++++++++-- tests/ci-workflows/ci-workflows.test.ts | 9 ++++++++- .../release-pipeline-contract.test.ts | 16 ++++++++++++++++ 3 files changed, 41 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e62765c5358..4c06619bddd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -578,7 +578,19 @@ jobs: # run: source. tests/ci-workflows.test.ts enforces this repo-wide. RELEASE_VERSION: ${{ inputs.version }} run: | - gh release upload "v${RELEASE_VERSION}" dist/release/* --clobber + set -euo pipefail + release_tag="v${RELEASE_VERSION}" + gh release upload "$release_tag" dist/release/* --clobber + + # A published release is immutable: GitHub rejects every later asset upload + # with HTTP 422, which is why v2.55.0 through v2.60.0 shipped with zero + # assets and left the desktop updater without anything to download. The + # release is therefore created as a draft and becomes public here, once the + # verified bundle is attached. The only edit permitted is this flip — the + # notes still come from the validated notes file written at creation. + if [ "$(gh release view "$release_tag" --json isDraft --jq .isDraft)" = "true" ]; then + gh release edit "$release_tag" --draft=false + fi publish: needs: [validate-dispatch, verify-release] @@ -981,6 +993,9 @@ jobs: exit 1 fi else - gh release create "$release_tag" --target "$GITHUB_SHA" --title "$release_tag" \ + # Draft first. Publication freezes a release under GitHub's immutable + # releases, so attach-release attaches the verified bundle to the draft + # and publishes it afterwards. + gh release create "$release_tag" --draft --target "$GITHUB_SHA" --title "$release_tag" \ --notes-file "$notes_file" ${prerelease_flag:+$prerelease_flag} fi diff --git a/tests/ci-workflows/ci-workflows.test.ts b/tests/ci-workflows/ci-workflows.test.ts index 6d3d2841baa..a7212745fbf 100644 --- a/tests/ci-workflows/ci-workflows.test.ts +++ b/tests/ci-workflows/ci-workflows.test.ts @@ -1033,7 +1033,14 @@ describe("GitHub Actions hardening", () => { expect(releaseNotesBuilder).toContain("release changelog failed coverage validation"); expect(workflow).toMatch(/gh release create[\s\S]*?--notes-file "\$notes_file"/); - expect(workflow).not.toContain("gh release edit"); + // The release is created as a draft and published only after the verified + // bundle is attached, because a published release is immutable and rejects + // every later upload. That draft flip is the one edit allowed: notes still + // come from the validated notes file, never from an edit or a regeneration. + for (const edit of workflow.match(/gh release edit[^\n]*/g) ?? []) { + expect(edit).toContain("--draft=false"); + expect(edit).not.toContain("--notes"); + } expect(workflow).not.toContain("--generate-notes"); const createStep = workflow diff --git a/tests/ci-workflows/release-pipeline-contract.test.ts b/tests/ci-workflows/release-pipeline-contract.test.ts index 8f474ae4b25..d2a90449fab 100644 --- a/tests/ci-workflows/release-pipeline-contract.test.ts +++ b/tests/ci-workflows/release-pipeline-contract.test.ts @@ -153,6 +153,22 @@ describe("release pipeline contract", () => { expect(upload).toBeGreaterThan(receiptCheck); }); + test("the release is a draft until the verified assets are attached", () => { + // GitHub freezes a release the moment it is published: every later asset upload + // comes back HTTP 422 "Cannot upload assets to an immutable release". Creating + // the release published and uploading afterwards is what left v2.55.0 through + // v2.60.0 with zero assets and the desktop updater with nothing to fetch. + const releaseText = readFileSync(repoPath(".github", "workflows", "release.yml"), "utf8"); + const createStep = releaseText.split("- name: Create GitHub release")[1] ?? ""; + expect(createStep).toMatch(/gh release create "\$release_tag" --draft/); + + const attachRun = (release.jobs?.["attach-release"]?.steps ?? []) + .map(candidate => candidate.run ?? "") + .find(run => run.includes("gh release upload")) ?? ""; + expect(attachRun).toContain("--draft=false"); + expect(attachRun.indexOf("gh release upload")).toBeLessThan(attachRun.indexOf("--draft=false")); + }); + test("a partial publication has a recorded, explicit recovery path", () => { const releaseText = readFileSync(repoPath(".github", "workflows", "release.yml"), "utf8"); // The only way npm publish is ever skipped: an explicit recovery input, requiring