Bug Fixes
create-releasenow reads the GitHub release back from GitHub instead of trustinggh's exit status, so the tag handed to apost-release-workflowis one that was verified: on the expected tag, published rather than drafted, flagged and titled as this run asked, and carrying theSHA256SUMSmanifest at the size that was built. A re-run over a tag that already has a release verifies it the same way rather than treating any existing release as success — a missing or stale manifest is attached again (the one partial state a re-run can finish by itself), and a release that is drafted, flagged or titled differently stops the job for a human instead of being passed off as this version's release. A failed read is kept distinct from an absent release — a not-found is believed only once the repository itself reads back, so a rate-limited or unauthenticated read can no longer pass for a tag that has no release yet. (#6927)
Miscellaneous
- Stop the gated publish job from warning about its (deliberately) empty workspace, and log the no-op lockstep pin without annotating the run. (#6965)