This repository was archived by the owner on Nov 11, 2026. It is now read-only.
Repository navigation
ci: replace Actions artifacts with verified draft Release handoff - #7
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace binaries Actions artifact transfers with authenticated draft Release assets. Producer outputs pin the release ID, producer attempt and manifest SHA-256; consumers enforce repository/source SHA/run/attempt/kind, the checked-in exact filename/platform contract, allowed producer platform, and every file size/digest before publication.
Existing build/tests and CDN/installer gates remain. Binary candidate verification now finishes before any npm publication. The existing prepublishOnly build is retained explicitly, then one tarball is packed for both channels. npm same-version replay skips publication only when SHA-1 and SHA-512 match the candidate; only structured E404 permits a new publish, and other lookup errors or byte conflicts stop. Final GitHub Release publication now distinguishes an absent release from lookup errors. An existing published release is a no-op only when the full asset set and downloaded byte digests match. Conflicts, partial releases, lookup failures and creation failures stop without overwriting assets.
The handoff uses existing contents:write and no new credentials/permissions. Drafts remain available for failed-job reruns. A documented, dry-run-first cleanup script targets one exact draft ID, enforces completed-run/identity/age checks, and requires an explicit apply; failed/cancelled runs also require abandoning reruns. This change executes no cleanup and does not touch existing Actions artifacts or public releases.
Validation: 15 transfer contract/isolation cases plus mocked immutable-publication and cleanup cases pass locally and run in Linux CI alongside existing Linux/Windows project checks. These are mocked transport tests, not live Release acceptance. Live authenticated transfer and anonymous denial must be validated on a reviewed SHA already merged into default; do not broaden PAT permissions to work around GitHub's workflow-difference restriction. No product tag or version publication was triggered.
Scope: main via this PR. Historical branches still need to incorporate the migration before release. CI rejects reintroduced upload/download-artifact actions. See .github/RELEASE-HANDOFF.md for retention and operational boundaries.