From 3a599eadb6770004ead9cc0901944bef39a4912d Mon Sep 17 00:00:00 2001
From: webadderall <131426131+webadderall@users.noreply.github.com>
Date: Sat, 28 Mar 2026 21:06:41 +1100
Subject: [PATCH] fix(ci): publish release assets deterministically

---
 .github/workflows/release.yml | 89 +++++++++++++++++++++++++++++------
 1 file changed, 74 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8f154120..fa0cc073 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -139,7 +139,7 @@ jobs:
         run: |
           npx tsc
           npx vite build
-          npx electron-builder --mac dmg zip --x64 --publish always
+          npx electron-builder --mac dmg zip --x64 --publish never
 
       - name: Upload macOS x64 artifacts
         uses: actions/upload-artifact@v4
@@ -148,6 +148,7 @@ jobs:
           path: |
             release/*.dmg
             release/*.zip
+            release/*.blockmap
             release/latest-mac.yml
           if-no-files-found: error
 
@@ -218,7 +219,7 @@ jobs:
         run: |
           npx tsc
           npx vite build
-          npx electron-builder --mac dmg zip --arm64 --publish always
+          npx electron-builder --mac dmg zip --arm64 --publish never
 
       - name: Upload macOS arm64 artifacts
         uses: actions/upload-artifact@v4
@@ -227,6 +228,7 @@ jobs:
           path: |
             release/*.dmg
             release/*.zip
+            release/*.blockmap
             release/latest-mac.yml
           if-no-files-found: error
 
@@ -295,15 +297,12 @@ jobs:
           )
           PY
 
-      - name: Upload merged latest-mac.yml to release
-        shell: bash
-        run: |
-          gh release upload "${{ needs.prepare-release.outputs.tag_name }}" \
-            release-assets/merged/latest-mac.yml \
-            --repo "${{ github.repository }}" \
-            --clobber
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload merged latest-mac.yml artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: macos-merged-metadata
+          path: release-assets/merged/latest-mac.yml
+          if-no-files-found: error
 
   build-windows-x64:
     name: Build Windows x64
@@ -365,7 +364,7 @@ jobs:
           npm run build:platform-native-helpers
           npx tsc
           npx vite build
-          npx electron-builder --win nsis --x64 --publish always
+          npx electron-builder --win nsis --x64 --publish never
 
       - name: Upload Windows x64 artifacts
         uses: actions/upload-artifact@v4
@@ -412,7 +411,7 @@ jobs:
           npm run build:platform-native-helpers
           npx tsc
           npx vite build
-          npx electron-builder --linux AppImage --x64 --publish always
+          npx electron-builder --linux AppImage --x64 --publish never
 
       - name: Upload Linux x64 artifacts
         uses: actions/upload-artifact@v4
@@ -424,8 +423,8 @@ jobs:
             release/latest-linux.yml
           if-no-files-found: error
 
-  trigger-homebrew-update:
-    name: Trigger Homebrew tap update
+  publish-release-assets:
+    name: Publish release assets
     needs:
       - prepare-release
       - build-macos-x64
@@ -434,6 +433,66 @@ jobs:
       - build-windows-x64
       - build-linux-x64
     runs-on: ubuntu-latest
+    steps:
+      - name: Download macOS x64 artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: macos-x64-release
+          path: release-assets/macos-x64
+
+      - name: Download macOS arm64 artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: macos-arm64-release
+          path: release-assets/macos-arm64
+
+      - name: Download merged macOS metadata
+        uses: actions/download-artifact@v4
+        with:
+          name: macos-merged-metadata
+          path: release-assets/macos-merged
+
+      - name: Download Windows x64 artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: windows-x64-release
+          path: release-assets/windows-x64
+
+      - name: Download Linux x64 artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: linux-x64-release
+          path: release-assets/linux-x64
+
+      - name: Upload release assets to GitHub
+        shell: bash
+        run: |
+          set -euo pipefail
+          gh release upload "${{ needs.prepare-release.outputs.tag_name }}" \
+            release-assets/macos-x64/*.dmg \
+            release-assets/macos-x64/*.zip \
+            release-assets/macos-x64/*.blockmap \
+            release-assets/macos-arm64/*.dmg \
+            release-assets/macos-arm64/*.zip \
+            release-assets/macos-arm64/*.blockmap \
+            release-assets/macos-merged/latest-mac.yml \
+            release-assets/windows-x64/*.exe \
+            release-assets/windows-x64/*.blockmap \
+            release-assets/windows-x64/latest*.yml \
+            release-assets/linux-x64/*.AppImage \
+            release-assets/linux-x64/*.blockmap \
+            release-assets/linux-x64/latest-linux.yml \
+            --repo "${{ github.repository }}" \
+            --clobber
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  trigger-homebrew-update:
+    name: Trigger Homebrew tap update
+    needs:
+      - prepare-release
+      - publish-release-assets
+    runs-on: ubuntu-latest
     if: needs.prepare-release.outputs.prerelease != 'true'
     steps:
       - name: Dispatch Homebrew tap workflow