From e838e92d73347883f1b5c219b71d1a4ec5746d5f Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Wed, 11 Nov 2026 09:26:35 +0800
Subject: [PATCH] fix: publish reviewed daily renderer scripts with the package

Co-Authored-By: Codex <noreply@openai.com>
---
 .github/workflows/release-digest-package.yml | 45 +++++++++++++++++++-
 docs/unified-daily-notification.md           | 10 +++--
 2 files changed, 50 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release-digest-package.yml b/.github/workflows/release-digest-package.yml
index d7d73892..be12a3f8 100644
--- a/.github/workflows/release-digest-package.yml
+++ b/.github/workflows/release-digest-package.yml
@@ -20,14 +20,55 @@ on:
           - rollback
 permissions: {}
 jobs:
+  prepare:
+    if: github.ref == 'refs/heads/main' && inputs.operation != 'rollback'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Require successful validation of this main commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          result="$(gh run list --repo "$GITHUB_REPOSITORY" --commit "$GITHUB_SHA" \
+            --workflow validate.yml --event push --limit 1 --json status,conclusion \
+            --jq '.[0] | .status == "completed" and .conclusion == "success"')"
+          if [ "$result" != true ]; then
+            echo "This main commit must pass Validate before package publication." >&2
+            exit 1
+          fi
+      - name: Prepare the two reviewed digest scripts
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/digest-source/python/scripts"
+          cp python/scripts/account_daily_digest.py python/scripts/cloud_run_daily_digest.py \
+            "$RUNNER_TEMP/digest-source/python/scripts/"
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: daily-digest-source
+          path: ${{ runner.temp }}/digest-source/
+          if-no-files-found: error
+          retention-days: 1
   release:
-    if: github.ref == 'refs/heads/main'
+    needs: prepare
+    if: >-
+      always() && !cancelled() && github.ref == 'refs/heads/main' &&
+      (needs.prepare.result == 'success' ||
+       (inputs.operation == 'rollback' && needs.prepare.result == 'skipped'))
     permissions:
       id-token: write
-    uses: QuantStrategyLab/.github/.github/workflows/deploy-azure-blob.yml@5fe59a371186e25aa64b4a7a37582bf582996d92
+      actions: read
+    uses: QuantStrategyLab/.github/.github/workflows/deploy-azure-blob.yml@6b0581a02e419f4534886c27df5d99b951c23178
     with:
       environment: ${{ inputs.target }}
       operation: ${{ inputs.operation }}
+      source-artifact: ${{ inputs.operation != 'rollback' && 'daily-digest-source' || '' }}
     secrets:
       DEPLOY_CLIENT_ID: ${{ secrets.DEPLOY_CLIENT_ID }}
       DEPLOY_TENANT_ID: ${{ secrets.DEPLOY_TENANT_ID }}
diff --git a/docs/unified-daily-notification.md b/docs/unified-daily-notification.md
index 08f6ebb9..32da3e11 100644
--- a/docs/unified-daily-notification.md
+++ b/docs/unified-daily-notification.md
@@ -395,9 +395,13 @@ runtime, broker, deployment or notification authority.
 ## Shared Azure package release
 
 Run `Central digest package release` from the default branch. Select the
-protected package environment and start with `verify`. For a release, stage
-the reviewed ZIP by its SHA-256 in the private container, configure the two
-digests, then select `deploy`. The shared workflow verifies the backup,
+protected package environment and configure the fixed previous and candidate
+digests. Start with `verify`. The caller requires successful validation of its
+exact main commit and uploads the two reviewed digest scripts as a same-run
+artifact. The shared workflow rebuilds the ZIP from the authenticated active
+package, changing only those existing scripts. Verify checks the candidate
+digest without writes. Select `deploy` to stage that exact ZIP in the private
+container and release it. The shared workflow verifies the backup,
 updates the live package conditionally, and reads it back. Use `rollback`
 with the same digest pair when the candidate is still live. The Azure
 send and check schedules keep their existing package path and runtime identity.