release: publish smokes the binary it is about to ship

The asset check proved names and checksums; nothing proved the bytes were programs. The linux binary is native to the publish runner, so it speaks for the matrix: it must print the release's own version and emit completions before the draft becomes real. Co-authored-by: Hanzo Dev <[email protected]>
2026-10-25 03:23:33 +00:00 · 2026-08-19 09:52:07 -07:00
parent a63f07ec96
commit 7d65c52a4e
1 changed files with 7 additions and 0 deletions
@@ -206,6 +206,13 @@ jobs:
          done
          (cd dist && for s in *.sha256; do sha256sum -c "$s" >/dev/null; done)
          echo "28 assets present and checksum-clean"
+          # The release runs what it ships: the linux binary is native to this
+          # runner, so it answers for the whole matrix that the artifacts are
+          # programs, not just well-named bytes.
+          x=$(mktemp -d); tar -xzf dist/dev-linux-amd64.tar.gz -C "$x"
+          "$x/dev" --version | grep -qF "$V" || { echo "::error::the shipped binary does not say $V"; "$x/dev" --version; exit 1; }
+          "$x/dev" completion bash >/dev/null
+          echo "smoked: $("$x/dev" --version)"
          curl -s -X PATCH "${auth[@]}" "https://api.github.com/repos/hanzoai/dev/releases/$REL" \
            -d '{"draft":false}' | jq -r '"published: " + .html_url'
      - name: Mirror the release to the forge