From 4efe2c4afc983b75d58db3a6170a36be6bcafe01 Mon Sep 17 00:00:00 2001
From: wiiiii123 <hong95402@st.vimaru.edu.vn>
Date: Mon, 27 Apr 2026 15:41:25 +0700
Subject: [PATCH] ci: stage release assets before upload

---
 .github/workflows/release.yml | 38 +++++++++++++++++------------------
 1 file changed, 18 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 493be50d..5787afbf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -554,12 +554,13 @@ jobs:
           name: linux-x64-release
           path: release-assets/linux-x64
 
-      - name: Generate release asset checksums
+      - name: Stage release assets
         shell: bash
         run: |
           set -euo pipefail
           shopt -s nullglob
 
+          mkdir -p release-assets/upload
           assets=(
             release-assets/macos-x64/*.dmg
             release-assets/macos-x64/*.zip
@@ -581,17 +582,27 @@ jobs:
             exit 1
           fi
 
-          : > release-assets/SHA256SUMS.txt
           for file in "${assets[@]}"; do
-            digest="$(sha256sum "$file" | awk '{print $1}')"
-            printf '%s  %s\n' "$digest" "$(basename "$file")" >> release-assets/SHA256SUMS.txt
+            target="release-assets/upload/$(basename "$file")"
+            if [ -e "$target" ]; then
+              echo "Duplicate release asset name: $(basename "$file")"
+              exit 1
+            fi
+            cp "$file" "$target"
           done
-          sort -k2,2 release-assets/SHA256SUMS.txt -o release-assets/SHA256SUMS.txt
+
+      - name: Generate release asset checksums
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd release-assets/upload
+          sha256sum * | sort -k2,2 > SHA256SUMS.txt
+          sha256sum -c SHA256SUMS.txt
 
       - name: Attest release assets
         uses: actions/attest@v4
         with:
-          subject-checksums: release-assets/SHA256SUMS.txt
+          subject-checksums: release-assets/upload/SHA256SUMS.txt
 
       - name: Upload release assets to GitHub
         shell: bash
@@ -600,20 +611,7 @@ jobs:
           shopt -s nullglob
 
           assets=(
-            release-assets/macos-x64/*.dmg
-            release-assets/macos-x64/*.zip
-            release-assets/macos-x64/*.blockmap
-            release-assets/macos-arm64/*.dmg
-            release-assets/macos-arm64/*.zip
-            release-assets/macos-arm64/*.blockmap
-            release-assets/macos-merged/latest-mac.yml
-            release-assets/windows-x64/*.exe
-            release-assets/windows-x64/*.blockmap
-            release-assets/windows-x64/latest*.yml
-            release-assets/linux-x64/*.AppImage
-            release-assets/linux-x64/*.blockmap
-            release-assets/linux-x64/latest-linux.yml
-            release-assets/SHA256SUMS.txt
+            release-assets/upload/*
           )
 
           if [ ${#assets[@]} -eq 0 ]; then