From 3f25ffa2132c9bc1669302b54b8349b7dc455ac5 Mon Sep 17 00:00:00 2001
From: MotherSphere <mothersphere.colony@gmail.com>
Date: Thu, 27 Aug 2026 23:19:04 +0200
Subject: [PATCH] fix(release): let a recovery dispatch actually reach the
 build

The first dispatch for v0.10.0 resolved the tag and then built nothing: `target`
succeeded, and `build`, `sign` and `aur` were all skipped.

A skipped job propagates transitively. `release-please` is skipped on a
dispatch, and `target` survives that only because of its own status-function
`if:` - which does not clear the inherited skip for the jobs downstream of it.
So they saw a skipped ancestor and skipped in turn, while the run reported
success.

Each job now states the dependencies it actually requires:

    build:  needs.target.result == 'success'
    sign:   needs.target.result == 'success' && needs.build.result == 'success'
    aur:    needs.target.result == 'success' && needs.sign.result == 'success'

Naming every dependency matters as much as the fix. Guarding `sign` on `target`
alone would let it run after a FAILED build and try to sign assets that do not
exist, and guarding `aur` the same way would bump the AUR package to a release
with no signatures. The old `if:` conditions had that property for free by
hanging off `release_created`; the rewrite to a `target` job lost it.

Costs nothing on the push path, where all three ancestors succeed anyway - and
that path is already verified green on run 33117309249.
---
 .github/workflows/release-please.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index fe008f5..89afbf7 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -109,6 +109,12 @@ jobs:
   build:
     name: Build ${{ matrix.asset }}
     needs: target
+    # Explicit, because a SKIPPED job propagates transitively: `target` runs on
+    # a dispatch thanks to its own status-function `if:`, but that does not
+    # clear the skip inherited from `release-please` for the jobs after it.
+    # Without this, a recovery dispatch resolves the tag and then silently
+    # builds nothing - which is exactly what the first v0.10.0 dispatch did.
+    if: ${{ needs.target.result == 'success' }}
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -229,6 +235,9 @@ jobs:
   sign:
     name: Sign release assets
     needs: [target, build]
+    # Every dependency named explicitly. Guarding on `target` alone would let
+    # this run after a FAILED build and try to sign assets that do not exist.
+    if: ${{ needs.target.result == 'success' && needs.build.result == 'success' }}
     runs-on: ubuntu-latest
     env:
       # Single source of truth for the four launcher assets. Declared once so the
@@ -321,6 +330,9 @@ jobs:
   aur:
     name: Publish colony-bin to AUR
     needs: [target, sign]
+    # `sign` too: without it, a failed signing job would still bump the AUR
+    # package to a release that has no signatures.
+    if: ${{ needs.target.result == 'success' && needs.sign.result == 'success' }}
     uses: ./.github/workflows/aur-publish.yml
     with:
       tag: ${{ needs.target.outputs.tag }}