[taliesin-ai]

Summary

• defer GitHub release creation in the nightly release task until desktop artifacts are ready
• pass curated release notes into the artifact workflow
• identify and wait for the dispatched Release v3 run, and recover a tagged commit with no release on the next nightly run
• add regression coverage and an unreleased changelog entry

Part of #5876

Root cause

The nightly release task published the GitHub release before dispatching Release v3. Repository release immutability then rejected Release v3's artifact upload with HTTP 422, even though all six binaries, checksums, and provenance had built successfully.

Impact

Future nightly releases are created atomically by Release v3 with their desktop binaries, SHA256SUMS, and provenance attached. A failed child publication now fails the orchestrator visibly and is retried when the tagged commit still has no release. Dry runs remain non-mutating, and direct/manual Release v3 dispatches retain their existing generated-notes fallback.

Validation

• go test ./tasks/release
• release script dry run for v3.0.0-beta.4
• YAML parse for both release workflows
• actionlint on both workflows (only the pre-existing actions/setup-go@v4 age diagnostic)
• git diff --check
• CodeRabbit plain review; its async-dispatch finding was addressed, then the follow-up review hit the free OSS quota
• broader go test ./... attempted; blocked by missing GTK4/WebKitGTK/glib/libsoup development packages and existing GUI/path-sensitive tests in this environment

No workflow, tag, or release was dispatched or published by this PR.

Summary by CodeRabbit

• New Features
  • Nightly releases can recover when publication is interrupted or missing.
  • GitHub releases are published after desktop binaries, checksums, and provenance are available.
  • Release workflows support optional curated release notes and improved run tracking.
• Bug Fixes
  • Improved release status reporting with clear success, failure, and tracking outcomes.
• Documentation
  • Clarified nightly release publication requirements in the unreleased changelog.
• Tests
  • Added coverage for deferred publication, recovery behavior, tag selection, and multiline release notes.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Nightly v3 releases defer GitHub release creation until desktop artifacts are published. The workflow detects missing releases, dispatches and tracks release-v3.yml, supports recovery, forwards release notes, and safely exports multiline output.

Changes

v3 release publication

Layer / File(s)	Summary
Release task deferral and output handling v3/tasks/release/release.go, v3/tasks/release/release_test.go	The release task accepts --defer-github-release, skips direct release creation after pushing, and writes multiline release notes to GITHUB_OUTPUT with collision-safe delimiters. Tests cover parsing and output handling.
Release v3 dispatch contract .github/workflows/release-v3.yml	The workflow accepts optional release notes and orchestrator run identifiers. It uses supplied notes or automatic note generation.
Nightly publication orchestration .github/workflows/nightly-release-v3.yml, v3/tasks/release/release_test.go, v3/UNRELEASED_CHANGELOG.md	The nightly workflow detects missing releases, selects reachable tags, dispatches and tracks publication, handles recovery, and reports completion or failure status. Tests cover the flow. The changelog records the deferred-publication rule.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related issues

• [v3 release] Beta-to-GA release tracker #5844: Covers the v3 release publication sequencing and immutable-release behavior addressed by the deferred publication and recovery flow.

Possibly related PRs

• wailsapp/wails#5318: Introduced the release-v3.yml workflow that this change extends.
• wailsapp/wails#5880: Modified the nightly-to-release-v3.yml artifact handoff extended here with recovery and tracking.
• wailsapp/wails#5882: Modified nightly release detection and no-change handling used by this recovery flow.

Suggested reviewers: leaanthony

Sequence Diagram(s)

sequenceDiagram
  participant NightlyReleaseV3
  participant ReleaseTask
  participant ReleaseV3Workflow
  participant GitHubRelease
  NightlyReleaseV3->>ReleaseTask: run with --defer-github-release
  ReleaseTask->>NightlyReleaseV3: return tag and release notes
  NightlyReleaseV3->>ReleaseV3Workflow: dispatch tag, notes, and orchestrator run
  ReleaseV3Workflow->>GitHubRelease: publish release after artifacts
  NightlyReleaseV3->>ReleaseV3Workflow: poll dispatched run
  ReleaseV3Workflow->>NightlyReleaseV3: return publication status

Loading

Poem

A rabbit checks the nightly tag,
Then waits for binaries in a bag.
Notes hop safely, line by line,
While artifacts arrive on time.
The release blooms, complete and bright.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: publishing desktop artifacts before creating immutable GitHub releases.
Description check	✅ Passed	The description explains the change, root cause, impact, linked issue, validation, and known test limitations, but omits the template checklists and wails doctor output.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/5876-immutable-release

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/nightly-release-v3.yml:
- Around line 71-83: Update publication_check to resolve the latest active v3
tag reachable from HEAD rather than relying only on steps.check_tag.outputs.tag,
then check that tag with gh release view and preserve needs_recovery output
behavior. Ensure the workflow still handles the existing tag gating and add a
regression case covering a bookkeeping-only commit after an unpublished tag.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1e5706d2-a44b-4f9b-b7ad-e7a01ece2381

📥 Commits

Reviewing files that changed from the base of the PR and between 2014eb6 and fb19ab0.

📒 Files selected for processing (5)

• .github/workflows/nightly-release-v3.yml
• .github/workflows/release-v3.yml
• v3/UNRELEASED_CHANGELOG.md
• v3/tasks/release/release.go
• v3/tasks/release/release_test.go

[taliesin-ai]

Updated the branch in 833e336dd with current master (5469ff45f) and resolved the changelog-only conflict without dropping the #5882 bookkeeping exclusions.

Publication recovery now:

• selects the latest active v3 tag reachable from HEAD, including after bookkeeping-only commits;
• treats only an API 404 as a missing release and fails closed on auth/network/API errors;
• publishes a missing older tag before allowing a newer tag to be created;
• skips artifact dispatch when the release task exits successfully without producing a tag, preventing the empty-tag dispatch seen in run 30926135808;
• uses the reachable recovery tag for the artifact workflow when no new tag was produced.

Regression coverage creates a tagged commit, an unreachable higher active-series tag, and a following bookkeeping commit, then proves recovery still selects the reachable tag.

Validation:

• GOWORK=off go test ./tasks/release -run 'TestNightly(DefersPublicationToArtifactWorkflow|PublicationRecoveryFindsReachableTagAfterBookkeeping)$' -count=1
• GOWORK=off go test ./tasks/release -count=1
• GOWORK=off go test ./tasks/... -count=1
• both changed workflows parse as YAML
• actionlint is clean with only the existing actions/setup-go@v4 deprecation diagnostic ignored (the unfiltered run reports that one baseline diagnostic)
• release task --dry-run --defer-github-release completed without modifying the worktree
• live read-only API classification returned published for v3.0.0-beta.3 and recovery for a deliberately missing tag
• git diff --check

The installed CodeRabbit CLI no longer supports --plain (plain text is the default), so I ran coderabbit review --uncommitted. Its two workflow findings were addressed; a second review attempt hit the free OSS review limit.

[taliesin-ai]

Morning release-cycle refresh:

• merged current master into the branch at 67765ba82, preserving the [v3 release] Restore Beta desktop artifacts and signing evidence #5876 changelog entry and current post-beta.4 entries;
• normalized CRLF in the workflow fixture before assertions at a7031fa9a, fixing the Windows-only failure from run 30984738838;
• fresh run 31079893418 has 27 successful jobs and one Linux template job still running; the Windows Go v3 job, including the formerly failing release test, passed;
• local go test ./tasks/... -count=1 from v3/, focused release tests, YAML parsing, and git diff --check pass;
• the installed CodeRabbit CLI rejects the requested legacy --plain flag, so the supported plain-text review was run and produced no findings; actionlint reports only the pre-existing actions/setup-go@v4 age diagnostic.

The PR is current and mergeable, with required maintainer review still outstanding. I also changed the description from Fixes #5876 to Part of #5876: publication repair alone must not auto-close the parent signing/install blocker. Project 16 remains In Progress pending review, final CI, merge, and post-merge release evidence.

[taliesin-ai]

Morning release-cycle handoff: refreshed this branch onto current master at bd139c00a and pushed merge commit 441497b64. The merge is conflict-free and adds only master’s generated sponsor asset change outside the focused five-file release diff.

Validation on the refreshed head: go test ./tasks/release, go test ./tasks/..., YAML parsing for both workflows, beta.4 release dry run, git diff --check, and supported CodeRabbit review all pass. coderabbit --plain was attempted exactly but this installed CLI treats plain text as the default and rejects the flag; actionlint is not installed. Fresh CI is pending.

The in-window Nightly run 31117548329 failed before any workflow step because GitHub returned Service Unavailable while resolving action downloads after retries; that is external runner infrastructure and does not invalidate this workflow fix.

[taliesin-ai]

Morning release-cycle handoff: refreshed the branch with current master (6a76dd2cd) using non-force merge commit d120eb852 and pushed it to agent/5876-immutable-release. The sole conflict was v3/UNRELEASED_CHANGELOG.md; the #5888 entry was retained while the three beta.5-consumed entries were removed. The focused PR diff remains exactly five files.

Beta.5 Release v3 run 31192135957 confirms the blocker: all six desktop binaries were built, SHA256SUMS and provenance attestation 39449314 were created, then the first release-asset upload failed HTTP 422 because beta.5 had already been published as an immutable release. This PR prevents that ordering by deferring release creation until the artifact workflow creates the release with its assets; recovery intentionally leaves an already-existing immutable release untouched.

Validation at the pushed head:

• focused publication/recovery/output tests, full go test ./tasks/release, and go test ./tasks/... pass;
• both changed workflows parse as YAML;
• beta.6 --dry-run --defer-github-release produced the expected tag/notes outputs without modifying the worktree;
• live read-only classification reports beta.5 as published and a deliberately missing tag as recovery-required;
• git diff --check passes;
• coderabbit --plain was attempted but this CLI version rejects the legacy flag because plain text is now default; the supported review completed with no findings;
• actionlint is not installed.

The PR is mergeable. All three required checks are green; CodeQL, CodeRabbit, FOSSA, Snyk, Semgrep, docs, runtime verification, JS, and master-platform Go checks also pass. The three hosted v3 Go jobs are still running. Cloudflare Pages failed as an external status but gh pr checks --required confirms it is not a required check. Maintainer review remains outstanding. No workflow, tag, release, or merge was dispatched.

[taliesin-ai]

Morning release-cycle verification against exact-window Nightly Release v3 run 31263736047:

• the scheduled run used current base commit 6a76dd2cd; the release script reported an empty unreleased changelog and produced no tag, then the old workflow dispatched release-v3.yml with tag="", which GitHub rejected with HTTP 422;
• this PR prevents that exact failure because desktop publication now requires a non-empty steps.release.outputs.release_tag or an explicitly detected recovery tag; with the observed empty output and no recovery, the dispatch step is skipped;
• the branch is current with master and remains mergeable. The prior full CI head had all required checks green, all three hosted v3 Go jobs green, and only non-required Cloudflare Pages failed; review remains required, with the sole CodeRabbit thread resolved.

The supported local CodeRabbit review found that a dispatch failure before dispatched=true was invisible in the always-run summary. Pushed 598888d88 to report that case and added a regression assertion.

Validation: focused nightly publication/recovery/output tests, full go test ./tasks/release, go test ./tasks/..., both workflow YAML parses, beta.6 dry run with no worktree mutation, and git diff --check pass. coderabbit --plain is unsupported because plain text is now the default; the supported follow-up review was attempted before commit but hit the free OSS quota. actionlint is not installed. Fresh CI is pending.

No workflow, tag, release, merge, or gate was dispatched or changed.

[taliesin-ai]

Refreshed this branch onto current master (2a462f3d8) and pushed merge commit 89dde433f. The only merge conflict was v3/UNRELEASED_CHANGELOG.md; both the immutable-release fix and current-master event entry were preserved.

CodeRabbit 0.7.2 rejected the legacy coderabbit --plain spelling (unknown option '--plain'; plain text is now the default). The supported review found one valid PR-owned issue: the quick-check exact-HEAD path could accept a stray legacy tag. The workflow now restricts that path to active alpha2/beta/rc tags, with a git-backed regression test. The other findings concerned unrelated current-master changes or unsupported recovery/run-ID behavior and were not applied.

Validation passed:

• go test ./tasks/release
• go test ./tasks/...
• PyYAML parse of .github/workflows/nightly-release-v3.yml and .github/workflows/release-v3.yml
• go run . --dry-run --defer-github-release --version v3.0.0-beta.7
• git diff --check and staged diff check
• supported plain CodeRabbit review, plus focused follow-up review

Remote SHA is verified at 89dde433f. The PR is now mergeable against current master; fresh CI is running and maintainer review remains required. No workflow, tag, release, merge, force-push, or master push was performed.

[taliesin-ai]

Closing unmerged: the asset pipeline this fixes is being removed rather than repaired.

Maintainer decision is that v3 releases are tag-only for now, so ordering release creation after artifact upload is no longer needed. #5946 deletes release-v3.yml and the nightly dispatch step outright. The diagnosis here was right and the work is preserved in this branch if binary releases are picked up again.