ci(v3): publish artifacts before immutable releases - #5888

No actionable comments were generated in the recent review. 🎉

Walkthrough

Nightly v3 releases defer GitHub release creation until desktop artifacts are published. The workflow detects missing releases, dispatches and tracks release-v3.yml, supports recovery, forwards release notes, and safely exports multiline output.

Changes

v3 release publication

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related issues

• [v3 release] Restore Beta desktop artifacts and signing evidence #5876: The change defers or recovers publication until desktop artifacts, checksums, and provenance are attached.

Possibly related PRs

• wailsapp/wails#5318: Introduced the release-v3.yml workflow that this change extends.
• wailsapp/wails#5880: Added the nightly-to-release-v3.yml artifact handoff extended here with recovery and tracking.
• wailsapp/wails#5882: Modified nightly release detection and no-change handling used by this recovery flow.

Suggested reviewers: leaanthony

Sequence Diagram(s)

sequenceDiagram
  participant NightlyReleaseV3
  participant ReleaseTask
  participant ReleaseV3Workflow
  participant GitHubRelease
  NightlyReleaseV3->>ReleaseTask: run with --defer-github-release
  ReleaseTask->>NightlyReleaseV3: return tag and release notes
  NightlyReleaseV3->>ReleaseV3Workflow: dispatch tag, notes, and orchestrator run
  ReleaseV3Workflow->>GitHubRelease: publish release after artifacts
  NightlyReleaseV3->>ReleaseV3Workflow: poll dispatched run
  ReleaseV3Workflow->>NightlyReleaseV3: return publication status

Poem

A rabbit checks the nightly tag,
Then waits for binaries in a bag.
Notes hop safely, line by line,
While artifacts arrive on time.
The release blooms, complete and bright.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Updated the branch in 833e336dd with current master (5469ff45f) and resolved the changelog-only conflict without dropping the #5882 bookkeeping exclusions.

Publication recovery now:

• selects the latest active v3 tag reachable from HEAD, including after bookkeeping-only commits;
• treats only an API 404 as a missing release and fails closed on auth/network/API errors;
• publishes a missing older tag before allowing a newer tag to be created;
• skips artifact dispatch when the release task exits successfully without producing a tag, preventing the empty-tag dispatch seen in run 30926135808;
• uses the reachable recovery tag for the artifact workflow when no new tag was produced.

Regression coverage creates a tagged commit, an unreachable higher active-series tag, and a following bookkeeping commit, then proves recovery still selects the reachable tag.

Validation:

• GOWORK=off go test ./tasks/release -run 'TestNightly(DefersPublicationToArtifactWorkflow|PublicationRecoveryFindsReachableTagAfterBookkeeping)$' -count=1
• GOWORK=off go test ./tasks/release -count=1
• GOWORK=off go test ./tasks/... -count=1
• both changed workflows parse as YAML
• actionlint is clean with only the existing actions/setup-go@v4 deprecation diagnostic ignored (the unfiltered run reports that one baseline diagnostic)
• release task --dry-run --defer-github-release completed without modifying the worktree
• live read-only API classification returned published for v3.0.0-beta.3 and recovery for a deliberately missing tag
• git diff --check

The installed CodeRabbit CLI no longer supports --plain (plain text is the default), so I ran coderabbit review --uncommitted. Its two workflow findings were addressed; a second review attempt hit the free OSS review limit.

Morning release-cycle refresh:

• merged current master into the branch at 67765ba82, preserving the [v3 release] Restore Beta desktop artifacts and signing evidence #5876 changelog entry and current post-beta.4 entries;
• normalized CRLF in the workflow fixture before assertions at a7031fa9a, fixing the Windows-only failure from run 30984738838;
• fresh run 31079893418 has 27 successful jobs and one Linux template job still running; the Windows Go v3 job, including the formerly failing release test, passed;
• local go test ./tasks/... -count=1 from v3/, focused release tests, YAML parsing, and git diff --check pass;
• the installed CodeRabbit CLI rejects the requested legacy --plain flag, so the supported plain-text review was run and produced no findings; actionlint reports only the pre-existing actions/setup-go@v4 age diagnostic.

The PR is current and mergeable, with required maintainer review still outstanding. I also changed the description from Fixes #5876 to Part of #5876: publication repair alone must not auto-close the parent signing/install blocker. Project 16 remains In Progress pending review, final CI, merge, and post-merge release evidence.

Morning release-cycle handoff: refreshed this branch onto current master at bd139c00a and pushed merge commit 441497b64. The merge is conflict-free and adds only master’s generated sponsor asset change outside the focused five-file release diff.

Validation on the refreshed head: go test ./tasks/release, go test ./tasks/..., YAML parsing for both workflows, beta.4 release dry run, git diff --check, and supported CodeRabbit review all pass. coderabbit --plain was attempted exactly but this installed CLI treats plain text as the default and rejects the flag; actionlint is not installed. Fresh CI is pending.

The in-window Nightly run 31117548329 failed before any workflow step because GitHub returned Service Unavailable while resolving action downloads after retries; that is external runner infrastructure and does not invalidate this workflow fix.

Morning release-cycle handoff: refreshed the branch with current master (6a76dd2cd) using non-force merge commit d120eb852 and pushed it to agent/5876-immutable-release. The sole conflict was v3/UNRELEASED_CHANGELOG.md; the #5888 entry was retained while the three beta.5-consumed entries were removed. The focused PR diff remains exactly five files.

Beta.5 Release v3 run 31192135957 confirms the blocker: all six desktop binaries were built, SHA256SUMS and provenance attestation 39449314 were created, then the first release-asset upload failed HTTP 422 because beta.5 had already been published as an immutable release. This PR prevents that ordering by deferring release creation until the artifact workflow creates the release with its assets; recovery intentionally leaves an already-existing immutable release untouched.

Validation at the pushed head:

• focused publication/recovery/output tests, full go test ./tasks/release, and go test ./tasks/... pass;
• both changed workflows parse as YAML;
• beta.6 --dry-run --defer-github-release produced the expected tag/notes outputs without modifying the worktree;
• live read-only classification reports beta.5 as published and a deliberately missing tag as recovery-required;
• git diff --check passes;
• coderabbit --plain was attempted but this CLI version rejects the legacy flag because plain text is now default; the supported review completed with no findings;
• actionlint is not installed.

The PR is mergeable. All three required checks are green; CodeQL, CodeRabbit, FOSSA, Snyk, Semgrep, docs, runtime verification, JS, and master-platform Go checks also pass. The three hosted v3 Go jobs are still running. Cloudflare Pages failed as an external status but gh pr checks --required confirms it is not a required check. Maintainer review remains outstanding. No workflow, tag, release, or merge was dispatched.