Repository navigation
ci: publish authenticated drafts and recover original verified release builds - #1199
Merged
Merged
Conversation
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
rowkav09
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub's REST by-tag endpoint returns 404 for the v0.2.1 draft, which prevents the final publication step after its builds succeed. Resolve authenticated drafts with
gh release viewand read their numeric release ID before applying the existing immutable-tag, asset checksum and downloaded-byte checks.Add a main-only recovery workflow that reuses a completed original tag build. It requires successful source and Windows jobs plus original provenance, downloads those exact run artifacts, verifies the original workflow/tag/commit attestations, then publishes with the corrected helper. It cannot rebuild or move the release tag.
Validation: 15 focused publisher/recovery/workflow tests pass, including by-tag 404, invalid release IDs, wrong build/run/tag, running builds, absent provenance, corrupt assets and published-release refusal. Independent review found no blocker; read-only validation correctly refuses recovery while the original release build is running.