[sechan-netizen]

ELI5

A release can contain the right ZIP files while its updater manifest still points at an older version. The release gate now rejects that release before it becomes visible to users.

What Changed

• Verify every updater manifest's version matches the release tag.
• Verify versioned ZIP, DMG, DEB, and RPM references in manifests match the release version.
• Add regression coverage for a v1.4.230 manifest that still points to Orca-1.4.229-arm64-mac.zip.

Why

The existing gate only checked that every manifest-referenced asset existed. A stale asset could remain in the release and let the gate pass, while new clients received a 404 for the old filename under the new tag. Version consistency catches the mismatch before publication.

Linked Issue

Reported from the auto-update failure:
Cannot download .../v1.4.230/Orca-1.4.229-arm64-mac.zip, status 404

Visual Proof

N/A — release validation only; no UI changes.

Testing

• node --check config/scripts/verify-release-required-assets.mjs
• node --check config/scripts/verify-release-required-assets.test.mjs
• Smoke-verified that a current 1.4.230 manifest passes and a stale 1.4.229 manifest fails, including when the stale ZIP is still present.

AI Disclosure

Not applicable — internal contributor.

Review

Agent skill upstream boundary

• Not applicable, or this change copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

The existing draft-only publication gate remains the enforcement point. This change adds manifest/version integrity checks to that gate and does not alter updater behavior for valid releases.

Checklist

• This PR is small and focused
• I explained what changed and why
• Before/after screenshots or videos are not applicable
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (release metadata only)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (targeted validation run; full CI will cover the repository)

[coderabbitai]

📝 Walkthrough

Release verification now compares each manifest version with the release tag without its leading v. It also compares semantic versions in referenced asset names with the tag’s base version. Verification errors include manifest and asset version mismatches alongside existing missing, upload-state, and empty-asset errors. Tests cover manifest version extraction and rejection of a stale uploaded asset.

Priority: ➖ Normal

Severity of issue fixed: Low

Merge Risk: 🔵 Low · up to 09a0c

The release gate has a narrow regression-coverage gap: its new test would not catch a future failure to reject a stale ZIP reference. This is bounded merge risk; an asset-only test would close it.

Pre-merge checks: 3 · 2

Failed checks: 2 warnings

Check name	Status	Explanation	Resolution
Description check		The description explains the problem, changes, rationale, testing, and non-UI impact. However, the required Linked Issue section does not include an actual issue reference or Fixes # entry.	Add the linked issue reference in the required format, such as "Fixes #123", and ensure it points to the issue addressed by this pull request.
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: rejecting updater manifests with versions that do not match the release.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1466fb09-3961-4828-b891-01bd7d4f2373

📥 Commits

Reviewing files that changed from the base of the PR and between 907694d and 09a0cc5.

📒 Files selected for processing: 2

• config/scripts/verify-release-required-assets.mjs
• config/scripts/verify-release-required-assets.test.mjs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🔎 Supported by static analysis

🏁 Script executed:

sed -n '1,210p' config/scripts/verify-release-required-assets.test.mjs
sed -n '45,180p' config/scripts/verify-release-required-assets.mjs

Repository: stablyai/orca

Length of output: 10018

---

🏁 Script executed:

set -o pipefail
printf '%s\n' '--- helper and verifier context ---'
sed -n '1,115p' config/scripts/verify-release-required-assets.mjs
printf '%s\n' '--- current test ---'
sed -n '115,190p' config/scripts/verify-release-required-assets.test.mjs
printf '%s\n' '--- full PR diff for the test ---'
git diff 907694dcbb23b1d2f60805c102b0f2a0ff999e75f 09a0cc5d0e8677c0ba6c078c1b34ca246de3d5e5 -- config/scripts/verify-release-required-assets.test.mjs
printf '%s\n' '--- references to asset-version validation/tests ---'
rg -n -F -- 'Manifest asset version mismatch' config/scripts
rg -n -F -- 'extractAssetBaseVersion' config/scripts

Repository: stablyai/orca

Length of output: 8301

---

Make the stale-asset test isolate asset-version validation.

The test sets the manifest version to 1.4.229, so it fails on the manifest-version check. It does not verify rejection when the manifest version matches the release tag. Change the manifest version to 1.4.230 and assert the asset-version mismatch.

Suggested fix

-  it('rejects a stale manifest version even when the stale asset is still present', async () => {
+  it('rejects a stale referenced asset even when the stale asset is still present', async () => {
...
-            'version: 1.4.229',
+            'version: 1.4.230',
...
-    ).rejects.toThrow('Manifest version mismatch: latest-mac.yml=1.4.229 (expected 1.4.230)')
+    ).rejects.toThrow(
+      'Manifest asset version mismatch: latest-mac.yml -> Orca-1.4.229-arm64-mac.zip'
+    )

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	it('rejects a stale manifest version even when the stale asset is still present', async () => {
	const tag = 'v1.4.230'
	const required = getRequiredReleaseAssetNames(tag)
	const staleAsset = 'Orca-1.4.229-arm64-mac.zip'
	const release = releaseWithAssets(tag, [...required, staleAsset])
	const fetchMock = vi.fn(async (url) => {
	if (url.endsWith('/assets/3')) {
	return jsonResponse(
	[
	'version: 1.4.229',
	'files:',
	` - url: ${staleAsset}`,
	`path: ${staleAsset}`
	].join('\n')
	)
	}
	return url.endsWith('/releases?per_page=100')
	? jsonResponse([release])
	: jsonResponse('version: 1.4.230\n')
	})
	vi.stubGlobal('fetch', fetchMock)
	await expect(
	verifyRequiredReleaseAssets({ repo: 'stablyai/orca', tag, token: 'token' })
	).rejects.toThrow('Manifest version mismatch: latest-mac.yml=1.4.229 (expected 1.4.230)')
	})
	it('rejects a stale referenced asset even when the stale asset is still present', async () => {
	const tag = 'v1.4.230'
	const required = getRequiredReleaseAssetNames(tag)
	const staleAsset = 'Orca-1.4.229-arm64-mac.zip'
	const release = releaseWithAssets(tag, [...required, staleAsset])
	const fetchMock = vi.fn(async (url) => {
	if (url.endsWith('/assets/3')) {
	return jsonResponse(
	[
	'version: 1.4.230',
	'files:',
	` - url: ${staleAsset}`,
	`path: ${staleAsset}`
	].join('\n')
	)
	}
	return url.endsWith('/releases?per_page=100')
	? jsonResponse([release])
	: jsonResponse('version: 1.4.230\n')
	})
	vi.stubGlobal('fetch', fetchMock)
	await expect(
	verifyRequiredReleaseAssets({ repo: 'stablyai/orca', tag, token: 'token' })
	).rejects.toThrow(
	'Manifest asset version mismatch: latest-mac.yml -> Orca-1.4.229-arm64-mac.zip'
	)
	})

[OrcaWin]

Closing this related updater proposal as part of the cleanup following merged #34076. Thank you for investigating this failure pattern; your work is credited in the merged PR.

The reproduced URL mismatch was fixed in the client by pinning the fallback release. This PR's additional publication-time manifest checks were not included in that merge; they are separate release-integrity hardening.

Please reopen if the problem recurs on a build containing the fix, or if a concrete malformed-manifest case demonstrates that these additional checks are still needed. Include the release tag, manifest, and failing URL so the remaining cause can be distinguished from the fixed redirect race.