ci(v3): publish artifacts before immutable releases

[taliesin-ai]

Summary

• defer GitHub release creation in the nightly release task until desktop artifacts are ready
• pass curated release notes into the artifact workflow
• identify and wait for the dispatched Release v3 run, and recover a tagged commit with no release on the next nightly run
• add regression coverage and an unreleased changelog entry

Part of #5876

Root cause

The nightly release task published the GitHub release before dispatching Release v3. Repository release immutability then rejected Release v3's artifact upload with HTTP 422, even though all six binaries, checksums, and provenance had built successfully.

Impact

Future nightly releases are created atomically by Release v3 with their desktop binaries, SHA256SUMS, and provenance attached. A failed child publication now fails the orchestrator visibly and is retried when the tagged commit still has no release. Dry runs remain non-mutating, and direct/manual Release v3 dispatches retain their existing generated-notes fallback.

Validation

• go test ./tasks/release
• release script dry run for v3.0.0-beta.4
• YAML parse for both release workflows
• actionlint on both workflows (only the pre-existing actions/setup-go@v4 age diagnostic)
• git diff --check
• CodeRabbit plain review; its async-dispatch finding was addressed, then the follow-up review hit the free OSS quota
• broader go test ./... attempted; blocked by missing GTK4/WebKitGTK/glib/libsoup development packages and existing GUI/path-sensitive tests in this environment

No workflow, tag, or release was dispatched or published by this PR.

Summary by CodeRabbit

• New Features
  • Nightly releases can recover when publication is interrupted or missing.
  • GitHub releases are published after desktop binaries, checksums, and provenance are available.
  • Release workflows support optional curated release notes and improved run tracking.
• Bug Fixes
  • Improved release status reporting, including clear success, failure, and tracking outcomes.
• Documentation
  • Updated the unreleased changelog to clarify nightly release publication requirements.
• Tests
  • Added coverage for deferred publication, recovery behavior, tag selection, and multiline release notes.

[coderabbitai]

Walkthrough

Nightly v3 releases now defer GitHub release creation until desktop artifacts are published. The workflow detects missing releases, dispatches and tracks release-v3.yml, supports recovery, forwards release notes, and safely exports multiline output.

Changes

v3 release publication

Layer / File(s)	Summary
Release task deferral and output handling v3/tasks/release/release.go, v3/tasks/release/release_test.go	The release task accepts --defer-github-release, skips direct release creation after pushing, and writes multiline release notes to GITHUB_OUTPUT with collision-safe delimiters. Tests cover parsing and output handling.
Release v3 dispatch contract .github/workflows/release-v3.yml	The workflow accepts optional release notes and orchestrator run identifiers. It uses supplied notes or automatic note generation.
Nightly publication orchestration .github/workflows/nightly-release-v3.yml, v3/tasks/release/release_test.go, v3/UNRELEASED_CHANGELOG.md	The nightly workflow detects missing releases, selects reachable tags, dispatches and tracks publication, handles recovery, and reports completion or failure status. Tests cover the flow. The changelog records the deferred-publication rule.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• wailsapp/wails#5318: Introduced the release-v3.yml workflow that this change extends.
• wailsapp/wails#5880: Added the nightly-to-release-v3.yml artifact handoff extended here with recovery and tracking.
• wailsapp/wails#5882: Modified nightly release detection and no-change handling used by this recovery flow.

Suggested reviewers: leaanthony

Sequence Diagram(s)

sequenceDiagram
  participant NightlyReleaseV3
  participant ReleaseTask
  participant ReleaseV3Workflow
  participant GitHubRelease
  NightlyReleaseV3->>ReleaseTask: run with --defer-github-release
  ReleaseTask->>NightlyReleaseV3: return tag and release notes
  NightlyReleaseV3->>ReleaseV3Workflow: dispatch tag, notes, and orchestrator run
  ReleaseV3Workflow->>GitHubRelease: publish release after artifacts
  NightlyReleaseV3->>ReleaseV3Workflow: poll dispatched run
  ReleaseV3Workflow->>NightlyReleaseV3: return publication status

Loading

Poem

A rabbit checks the nightly tag,
Then waits for binaries in a bag.
Notes hop safely, line by line,
While artifacts arrive on time.
The release blooms, complete and bright.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR improves publication ordering, but it does not satisfy the linked issue's signing policy, artifact evidence, installation verification, or release-plan updates.	Link this PR to a narrower automation issue, or complete and document the remaining #5876 acceptance criteria before claiming the issue is fixed.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The workflow, Go code, tests, and changelog changes all support the stated v3 release-publication and recovery objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly summarizes the main change: publishing artifacts before immutable v3 releases.
Description check	✅ Passed	The description provides clear context, impact, validation details, issue linkage, and scope, but omits the template checklists and wails doctor output.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/5876-immutable-release

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/nightly-release-v3.yml:
- Around line 71-83: Update publication_check to resolve the latest active v3
tag reachable from HEAD rather than relying only on steps.check_tag.outputs.tag,
then check that tag with gh release view and preserve needs_recovery output
behavior. Ensure the workflow still handles the existing tag gating and add a
regression case covering a bookkeeping-only commit after an unpublished tag.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1e5706d2-a44b-4f9b-b7ad-e7a01ece2381

📥 Commits

Reviewing files that changed from the base of the PR and between 2014eb6 and fb19ab0.

📒 Files selected for processing (5)

• .github/workflows/nightly-release-v3.yml
• .github/workflows/release-v3.yml
• v3/UNRELEASED_CHANGELOG.md
• v3/tasks/release/release.go
• v3/tasks/release/release_test.go

[taliesin-ai]

Updated the branch in 833e336dd with current master (5469ff45f) and resolved the changelog-only conflict without dropping the #5882 bookkeeping exclusions.

Publication recovery now:

• selects the latest active v3 tag reachable from HEAD, including after bookkeeping-only commits;
• treats only an API 404 as a missing release and fails closed on auth/network/API errors;
• publishes a missing older tag before allowing a newer tag to be created;
• skips artifact dispatch when the release task exits successfully without producing a tag, preventing the empty-tag dispatch seen in run 30926135808;
• uses the reachable recovery tag for the artifact workflow when no new tag was produced.

Regression coverage creates a tagged commit, an unreachable higher active-series tag, and a following bookkeeping commit, then proves recovery still selects the reachable tag.

Validation:

• GOWORK=off go test ./tasks/release -run 'TestNightly(DefersPublicationToArtifactWorkflow|PublicationRecoveryFindsReachableTagAfterBookkeeping)$' -count=1
• GOWORK=off go test ./tasks/release -count=1
• GOWORK=off go test ./tasks/... -count=1
• both changed workflows parse as YAML
• actionlint is clean with only the existing actions/setup-go@v4 deprecation diagnostic ignored (the unfiltered run reports that one baseline diagnostic)
• release task --dry-run --defer-github-release completed without modifying the worktree
• live read-only API classification returned published for v3.0.0-beta.3 and recovery for a deliberately missing tag
• git diff --check

The installed CodeRabbit CLI no longer supports --plain (plain text is the default), so I ran coderabbit review --uncommitted. Its two workflow findings were addressed; a second review attempt hit the free OSS review limit.

[taliesin-ai]

Morning release-cycle refresh:

• merged current master into the branch at 67765ba82, preserving the [v3 release] Restore Beta desktop artifacts and signing evidence #5876 changelog entry and current post-beta.4 entries;
• normalized CRLF in the workflow fixture before assertions at a7031fa9a, fixing the Windows-only failure from run 30984738838;
• fresh run 31079893418 has 27 successful jobs and one Linux template job still running; the Windows Go v3 job, including the formerly failing release test, passed;
• local go test ./tasks/... -count=1 from v3/, focused release tests, YAML parsing, and git diff --check pass;
• the installed CodeRabbit CLI rejects the requested legacy --plain flag, so the supported plain-text review was run and produced no findings; actionlint reports only the pre-existing actions/setup-go@v4 age diagnostic.

The PR is current and mergeable, with required maintainer review still outstanding. I also changed the description from Fixes #5876 to Part of #5876: publication repair alone must not auto-close the parent signing/install blocker. Project 16 remains In Progress pending review, final CI, merge, and post-merge release evidence.

[taliesin-ai]

Morning release-cycle handoff: refreshed this branch onto current master at bd139c00a and pushed merge commit 441497b64. The merge is conflict-free and adds only master’s generated sponsor asset change outside the focused five-file release diff.

Validation on the refreshed head: go test ./tasks/release, go test ./tasks/..., YAML parsing for both workflows, beta.4 release dry run, git diff --check, and supported CodeRabbit review all pass. coderabbit --plain was attempted exactly but this installed CLI treats plain text as the default and rejects the flag; actionlint is not installed. Fresh CI is pending.

The in-window Nightly run 31117548329 failed before any workflow step because GitHub returned Service Unavailable while resolving action downloads after retries; that is external runner infrastructure and does not invalidate this workflow fix.