Smoke-test the assembled release before it is published

[BunsDev]

Refs #356 (plan Task 5). This adds the release smoke test the issue lists as absent. It follows the release owner's decisions recorded on #356: the updater stays off, and the unsigned state is reported rather than hidden.

Gap

Each build job smoke-tests its own installers, and publish checksums whatever it downloaded. Nothing checked the assembled set as a whole. A missing platform, a stale file from another version, or a checksum that no longer matches would reach gh release create.

scripts/release-smoke.mjs

This runs in publish, after Generate and verify SHA256SUMS and before Publish GitHub release, on dry runs and real runs alike. It fails if any of the following does not hold.

• Installers. All six are present exactly once and non-empty. The names match those the v0.0.1 rehearsal (run 35174981698) actually produced:
  • _aarch64.dmg and _x64.dmg
  • _x64_en-US.msi and _x64-setup.exe
  • _amd64.AppImage and _amd64.deb
• No unexpected assets. Any other file fails, for example an installer from another version.
• SHA256SUMS. It covers every other asset exactly once, lists nothing that is absent, has no malformed or duplicate lines, and every digest matches the bytes.
• Versions. The tag, package.json, tauri.conf.json and the Cargo.toml [package] version all agree.
• Identity. productName is OpenCoven Chat and identifier is ai.opencoven.chat.
• Updater state follows createUpdaterArtifacts.
  • While it is off (today), any updater archive, .sig or latest.json is a failure.
  • Once it is on, every archive needs a non-empty signature, and latest.json must carry the version and exactly the platforms of the present archives.

It prints a JSON report, which goes to the job summary. The report states updater: disabled and a signing state. The signing state is unsigned on an allow_unsigned rehearsal, so the summary cannot read as signed when it was not. Code signatures themselves are still verified in the build jobs.

Tests

• src/release-smoke.test.ts, 24 tests. A clean unsigned release with the updater off passes against the real configuration. Each rule above has a failing case: each missing installer, an empty installer, a stray asset, a digest mismatch, missing and extra coverage, malformed and duplicate lines, a missing SHA256SUMS, tag and config version drift, a changed identifier, and updater assets while off. There are also enabled-updater cases: pass, missing signature, missing platform, nothing produced. Finally, the CLI exits 0 or 1 accordingly.
• src/release-workflow.test.ts pins the step between SHA256SUMS and publication, including the allow_unsigned flag.

Notes

• The plan names tests/release-smoke.spec.ts under Playwright. This follows the repository's convention instead: scripts/*.mjs plus .d.mts, with vitest in src/.
• release-context.mjs stays inline in release.yml, where src/release-workflow.test.ts already covers it.
• release.yml is not a governed Phase 1 file, so no harness repin is needed.

Validation

• Lint and typecheck are clean.
• The release, verifier, spec-guard and workflow tests pass.
• Normal suite: 1189 passed. Two unrelated files, phase1-schema-v2-evidence and windows-supervisor-source, timed out at load average 41 and pass when run alone.
• Pushed over SSH, since this touches .github/workflows.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Moderate issues remain in workflow reporting, updater validation, checksum parsing, and signing-state reporting.

Review effort: Lite
Findings: 2

Open (2)

• Smoke test failure skips GitHub step summary · New
• Duplicate Windows platform mappings break manifest generation · New

What changed in this PR

Adds an assembled-release smoke test before publication, validating artifacts, checksums, versions, identity, updater state, and signing status.

Changes:

• Added validation logic, type declarations, and comprehensive tests.
• Integrated the smoke test into the release workflow.
• Documented the release validation process.

File	Description
src/​release-workflow.test.ts	Verifies workflow ordering and flags.
src/​release-smoke.test.ts	Tests release validation scenarios.
scripts/​release-smoke.mjs	Implements assembled-release validation.
scripts/​release-smoke.d.mts	Declares validator types.
docs/​releasing.md	Documents release validation.
.github/​workflows/​release.yml	Runs validation before publication.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.