fix(release): narrow release asset glob to finished packages - #9

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n -A25 'softprops/action-gh-release@' .github/workflows/release-candidate.yml \
  | rg -q 'fail_on_unmatched_files:\s*true'

Repository: Deko-sudo/Racoon-Typper

Length of output: 161

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== release-candidate release action block =="
rg -n -A80 -B40 'softprops/action-gh-release@' .github/workflows/release-candidate.yml || true

echo
echo "== fail_on_unmatched_files references =="
rg -n 'fail_on_unmatched_files|unmatched_files|upload-release-assets|actions/gh-release|release.*assets' .github/workflows || true

echo
echo "== pinned action.yml input definition (if internet available) =="
curl -sL "https://raw.githubusercontent.com/softprops/action-gh-release/c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda/action.yml" \
  | sed -n '1,220p' | rg -n 'fail_on_unmatched_files|inputs:|files:' -A8 -B2 || true

Repository: Deko-sudo/Racoon-Typper

Length of output: 4600

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow files =="
git ls-files '.github/workflows/*' | sed -n '1,120p'

echo
echo "== release-candidate workflow excerpt =="
if [ -f .github/workflows/release-candidate.yml ]; then
  sed -n '1,280p' .github/workflows/release-candidate.yml | cat -n
fi

echo
echo "== search for SHA256SUMS and artifacts =="
rg -n "SHA256SUMS|artifacts/|download-artifact|upload-artifact|sha256sum|release.*asset|action/release" .github/workflows/release-candidate.yml .github/workflows 2>/dev/null || true

Repository: Deko-sudo/Racoon-Typper

Length of output: 17265

🌐 Web query:

softprops action-gh-release files globs basename upload behavior

💡 Result:

The softprops/action-gh-release action uses the files input to determine which assets to upload to a GitHub release. This input accepts a newline-delimited list of glob patterns [1][2][3]. Key behaviors regarding file selection and uploading include: Glob Handling: The action uses glob matching to resolve file paths [2][4]. Because of this, any literal filenames containing glob metacharacters (such as [ or ]) must be escaped in the pattern to be matched correctly [1][2]. Working Directory: The action provides an optional working_directory input, which serves as the base directory for resolving the files glob patterns [1][2][5]. If this is omitted, the action defaults to resolving paths from the runner's workspace root (${{ github.workspace }}) [1][2][3]. Basename and Naming: The action uploads files as-is based on the matches found. However, GitHub itself controls the final storage and presentation of asset filenames [2][4]. GitHub may normalize or rewrite filenames that contain special or non-ASCII characters; while the action attempts to restore the asset label, it cannot guarantee the final download name, especially for complex characters like 4-byte Unicode (emojis) [2][4]. The action does not control the final ordering of assets as displayed on the GitHub release page [2][6]. Additional Notes: - On Windows, both forward slashes (/) and backslashes () are accepted as path separators [1][2]. - You can toggle whether the action should fail if a glob pattern finds no matching files using the fail_on_unmatched_files input (defaults to false) [1][3][7]. - Existing files can be overwritten by default (overwrite_files: true) if a release with the same tag name already exists [1].

Citations:

• 1: https://github.com/softprops/action-gh-release/blob/master/action.yml
• 2: https://github.com/softprops/action-gh-release/blob/master/README.md
• 3: https://github.com/softprops/action-gh-release/blob/v2/README.md
• 4: https://github.com/softprops/action-gh-release?tab=readme-ov-file
• 5: feat(action): respect working_directory for files globs softprops/action-gh-release#667
• 6: https://github.com/marketplace/actions/gh-release
• 7: https://github.com/softprops/action-gh-release/tree/refs/tags/v2.6.0

🌐 Web query:

actions download-artifact v4 path named artifacts merge flatten

💡 Result:

In GitHub Actions, the actions/download-artifact@v4 action does not use an input named "flatten" or "merge". Instead, it uses the input merge-multiple to control whether downloaded artifacts are placed into a single directory [1][2]. Here is how you can use it: - merge-multiple: When set to 'true', multiple artifacts matched by a pattern (or all artifacts if no name/pattern is specified) are downloaded into the same directory specified by the path input [1][3]. - Default behavior: When merge-multiple is 'false' (the default), each artifact is extracted into its own individual subdirectory within the specified path [1][2]. Example configuration to merge multiple artifacts into one directory: - uses: actions/download-artifact@v4 with: path: my-destination-directory merge-multiple: true Note: 1. If files within different artifacts share the same name while merge-multiple: true is enabled, the "last writer wins" (the last file processed will overwrite any existing file with the same name) [4]. 2. When downloading a single specific artifact (by name or ID), it is always extracted directly to the specified path, regardless of the merge-multiple setting [3][2].

Citations:

• 1: https://github.com/actions/download-artifact/blob/v4.1.0/README.md
• 2: https://github.com/actions/download-artifact/
• 3: https://github.com/marketplace/actions/download-a-build-artifact
• 4: https://github.com/actions/download-artifact/blob/main/docs/MIGRATION.md

🌐 Web query:

actions/download-artifact v4 single named artifact basename file output

💡 Result:

When using actions/download-artifact@v4 to download a single named artifact, the files are extracted directly into the specified destination path without creating a subdirectory named after the artifact [1][2]. Key details regarding this behavior: 1. Single Artifact Download: By providing the name input, the action targets exactly one artifact. It downloads the contents of that artifact directly to the path defined in your workflow (or the default $GITHUB_WORKSPACE if no path is provided) [1][3][2]. 2. Distinction from Multiple/All Artifacts: If you do not specify a name, the action attempts to download all artifacts from the workflow run. By default (with merge-multiple: false), downloading all artifacts creates individual subdirectories for each artifact within your destination path [1][3][4]. 3. Consistency: This direct extraction behavior for single artifacts is consistent across v4 versions [3][4][2]. If you find that your files are being placed in unexpected locations when downloading, ensure you are providing the correct name input. If you need to enforce a specific directory structure for a single artifact, you should explicitly include that directory in the path input (e.g., path: my-artifact-dir/) [4][5].

Citations:

• 1: https://github.com/actions/download-artifact/
• 2: https://github.com/actions/download-artifact/tree/v4.1.6
• 3: https://github.com/actions/download-artifact/blob/v4.1.0/README.md
• 4: https://github.com/actions/download-artifact/blob/v4.0.0/README.md
• 5: https://github.com/actions/download-artifact/blob/ada9446619b84dd8a557aaaec3b79b58c4986cdf/README.md

🌐 Web query:

softprops/action-gh-release action.yml files input implementation release assets basename

💡 Result:

In the softprops/action-gh-release action, the release asset filenames are determined using the path basename [1][2]. The action accepts a files input, which takes a newline-delimited list of glob patterns to identify assets for upload [3][4][5]. When processing these files, the action's implementation utilizes the Node.js path module's basename function (imported as basename(path)) to extract the filename from the provided path [1][2]. This extracted basename is subsequently used as the name for the uploaded release asset [1][2]. While the action attempts to use this basename as the asset label, it notes that GitHub may normalize raw asset filenames containing special characters [3][4][6]. Although the action attempts to restore the asset label where possible, the final download name of the asset remains under GitHub's control [3][7][5].

Citations:

• 1: https://github.com/softprops/action-gh-release/blob/master/src/github.ts
• 2: https://git.seepine.com/softprops/action-gh-release/src/commit/e6a400341a1b9bd1c3509e283a1bc165ae996fce/src/github.ts
• 3: https://github.com/softprops/action-gh-release/blob/master/action.yml
• 4: https://github.com/softprops/action-gh-release?tab=readme-ov-file
• 5: https://github.com/marketplace/actions/gh-release
• 6: https://github.com/softprops/action-gh-release/blob/v2/README.md
• 7: https://github.com/softprops/action-gh-release/tree/refs/tags/v2

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import pathlib, os

roots = [
    "target/release/bundle/deb/racoon-typper_1.2.3_amd64/deb/build/racoon-typper_1.2.3_amd64.deb",
    "racoon-typper-v1.2.3-x86_64.tar.gz",
    "target/release/bundle/nsis/racoon-typper-setup.exe",
    "artifacts/release-evidence/racoon-typper.sbom.cdx.json",
]

patterns = [
    "artifacts/**/*.deb",
    "artifacts/**/*.rpm",
    "artifacts/**/*.AppImage",
    "artifacts/**/*.tar.gz",
    "artifacts/**/*.torrent",
    "artifacts/**/*.exe",
    "artifacts/SHA256SUMS",
    "artifacts/release-evidence/*",
]
entries = [pathlib.Path("artifacts") / p.replace("target/", "") for p in roots]

def matches(p):
    p = pathlib.Path(p)
    return any(p.match(pat) or pathlib.Path(*p.parts[1:]).match(pat) for pat in patterns)

for entry in entries:
    print(f"path={entry.relative_to('artifacts')} sha_entry=./{entry} sha_hash={} release_asset={entry.name} matched={matches(entry)}")

print("sha256sum verify behavior against downloaded basename:")
print("If download-artifact v4 extracts single artifacts directly under artifacts, verify uses: sha256sum -c SHA256SUMS; sha256sums may list files under artifacts/racoon-typper-linux/racoon-typper-*.deb while user downloads artifacts/racoon-typper.deb")
PY

Repository: Deko-sudo/Racoon-Typper

Length of output: 511

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import pathlib

roots = [
    "racoon-typper-linux/target/release/bundle/deb/racoon-typper_1.2.3_amd64/deb/build/racoon-typper_1.2.3_amd64.deb",
    "racoon-typper-linux/racoon-typper-v1.2.3-x86_64.tar.gz",
    "racoon-typper-windows/target/release/bundle/nsis/racoon-typper-setup.exe",
    "racoon-typper-windows/release-evidence/racoon-typper.sbom.cdx.json",
]

patterns = [
    "artifacts/**/*.deb",
    "artifacts/**/*.rpm",
    "artifacts/**/*.AppImage",
    "artifacts/**/*.tar.gz",
    "artifacts/**/*.torrent",
    "artifacts/**/*.exe",
    "artifacts/SHA256SUMS",
    "artifacts/release-evidence/*",
]
entries = [pathlib.Path("artifacts") / p for p in roots]

def matches(p):
    return any(p.match(pat) or pathlib.Path(*p.parts[1:]).match(pat) for pat in patterns)

print("release-candidate SHA256SUMS vs release asset names:")
for entry in entries:
    print(f"path={entry.relative_to('artifacts')} sha_entry=./{entry} release_asset={entry.name} matched={matches(entry)}")

print("\nsha256sum behavior:")
print("Users download basename assets from GitHub releases, then run sha256sum -c SHA256SUMS. Entries with leading directory paths do not match files in the current build directory, so verification can fail for the released basename asset.")
PY

Repository: Deko-sudo/Racoon-Typper

Length of output: 1418