Harden release post-publication workflows (#134)

Prevent false-red release bookkeeping by writing JSON through an explicit UTF-8 file, retrying GitHub Release visibility and checksum download, and running the legacy artifact publisher only for an explicit verified publication request.

Author: masarray

.github/workflows/publish-verified-release.yml

@@ -5,8 +5,6 @@ on:
     branches: [ main ]
     paths:
       - ".release/publish-verified.json"
-      - "landing/release-notes.json"
-      - ".github/workflows/publish-verified-release.yml"
   push:
     branches: [ main ]
     paths:

.github/workflows/release-windows.yml

@@ -450,5 +450,10 @@ jobs:
           if ($existingSha) { $body.sha = $existingSha }
 
           $request = $body | ConvertTo-Json -Compress
-          $request | gh api --method PUT $apiPath --input - *> $null
+          $requestPath = Join-Path $env:RUNNER_TEMP "arsas-published-release-request.json"
+          [System.IO.File]::WriteAllText(
+            $requestPath,
+            $request,
+            [System.Text.UTF8Encoding]::new($false))
+          gh api --method PUT $apiPath --input $requestPath *> $null
           if ($LASTEXITCODE -ne 0) { throw "Failed to record verified release publication." }

.github/workflows/sync-release-documentation.yml

@@ -47,12 +47,38 @@ jobs:
         run: |
           set -euo pipefail
           mkdir -p _release-sync
-          gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" > _release-sync/release.json
-          gh release download "$RELEASE_TAG" \
-            --repo "$GITHUB_REPOSITORY" \
-            --dir _release-sync \
-            --pattern 'ARSAS-Windows-x64-SHA256SUMS.txt' \
-            --clobber
+          release_ready=false
+          for attempt in $(seq 1 30); do
+            if gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" > _release-sync/release.tmp.json 2>/dev/null; then
+              mv _release-sync/release.tmp.json _release-sync/release.json
+              release_ready=true
+              break
+            fi
+            echo "Release $RELEASE_TAG is not visible yet (attempt $attempt/30); retrying in 10 seconds."
+            sleep 10
+          done
+          if [[ "$release_ready" != "true" ]]; then
+            echo "Published release $RELEASE_TAG did not become visible within the synchronization window." >&2
+            exit 1
+          fi
+
+          checksum_ready=false
+          for attempt in $(seq 1 12); do
+            if gh release download "$RELEASE_TAG" \
+              --repo "$GITHUB_REPOSITORY" \
+              --dir _release-sync \
+              --pattern 'ARSAS-Windows-x64-SHA256SUMS.txt' \
+              --clobber; then
+              checksum_ready=true
+              break
+            fi
+            echo "Checksum asset is not downloadable yet (attempt $attempt/12); retrying in 10 seconds."
+            sleep 10
+          done
+          if [[ "$checksum_ready" != "true" ]]; then
+            echo "Checksum asset for $RELEASE_TAG did not become downloadable." >&2
+            exit 1
+          fi
           git fetch --tags --force
           source_commit="$(git rev-list -n 1 "$RELEASE_TAG")"
           if [[ ! "$source_commit" =~ ^[0-9a-f]{40}$ ]]; then