From d9dfa795ae40633de032a4ce11fcc547ce08810a Mon Sep 17 00:00:00 2001 From: Zack Whitson Date: Thu, 6 Aug 2026 22:50:28 -0500 Subject: [PATCH] Point the release job at the artifacts the build actually writes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v0.2.30 tagged cleanly and then failed at attestation with "Could not find subject at path release/codetruss-cli-0.2.30.tgz". Typecheck, tests, release:artifact, release:verify, and test:install had all passed; only the subject path was wrong. build-release.mjs writes into public/downloads/, not release/ — the directory moved when the script was rewritten, and release.yml was not updated with it. The script also no longer emits release-manifest.json; the equivalent metadata is public/downloads/codetruss-cli-latest.json, which is not a release asset. Resolve the three artifact paths under public/downloads/ and drop the manifest from the upload list. No other workflow behaviour changes: the archive is still built fresh, byte-compared against the immutable published copy by release:verify, and attested before the release is created. Co-Authored-By: Claude Opus 5 --- .github/workflows/release.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1c2c9ab..71a28ae 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -56,9 +56,9 @@ jobs: id: artifact run: | VERSION="$(node -p "require('./packages/cli/package.json').version")" - echo "archive=release/codetruss-cli-${VERSION}.tgz" >> "$GITHUB_OUTPUT" - echo "checksum=release/codetruss-cli-${VERSION}.tgz.sha256" >> "$GITHUB_OUTPUT" - echo "sbom=release/codetruss-cli-${VERSION}.sbom.cdx.json" >> "$GITHUB_OUTPUT" + echo "archive=public/downloads/codetruss-cli-${VERSION}.tgz" >> "$GITHUB_OUTPUT" + echo "checksum=public/downloads/codetruss-cli-${VERSION}.tgz.sha256" >> "$GITHUB_OUTPUT" + echo "sbom=public/downloads/codetruss-cli-${VERSION}.sbom.cdx.json" >> "$GITHUB_OUTPUT" - name: Attest package build provenance uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 with: @@ -83,6 +83,5 @@ jobs: gh release upload "$GITHUB_REF_NAME" \ "$ARCHIVE" \ "$CHECKSUM" \ - "$SBOM" \ - release/release-manifest.json + "$SBOM" gh release edit "$GITHUB_REF_NAME" --draft=false