fix(ci): verify every bundled plugin, require both update archives, and test the registry merge

[datlechin]

Three release-path checks that passed while covering less than they claimed.

verify-build.sh verified 3 of the 14 bundled plugins

REQUIRED_PLUGINS=(
  "MySQLDriver.tableplugin"
  "PostgreSQLDriver.tableplugin"
  "SQLiteDriver.tableplugin"
)

project.yml copies 14 plugins into the app bundle. A release missing any of the other eleven passed verification and then printed ✅ All bundled plugin bundles present, which was not true.

The list is now derived from project.yml's copy phase, which is what decides what ends up in the bundle. Cross-checked against a PyYAML parse of the same file: 14 and 14, same names, same order.

Parsed with a regex rather than PyYAML deliberately. This runs on the release path and PyYAML is not part of a stock runner image, so importing it would trade a silent gap for a hard failure at the worst moment. The shape being matched is fixed and small:

      - target: MySQLDriver
        embed: true
        copy: { destination: plugins }

The ZIP rename could not fail

if [ -f "artifacts/TablePro-arm64.zip" ]; then
  mv artifacts/TablePro-arm64.zip "artifacts/TablePro-${VERSION}-arm64.zip"
fi

No else, twice, followed by an unconditional ✅ Artifacts organized successfully. A missing or differently named ZIP meant no rename, no error, and a release publishing whatever the upload glob happened to match. Sparkle serves those ZIPs, so an absent one is an update nobody receives.

Both architectures are now required, and the matching DMG with them, and the step fails naming the file.

The registry retention policy had no test for the behaviour it exists for

--keep-kit-versions 2 exists so a user on the previous app version can still install a plugin. Nothing tested that. The one existing merge test starts from a legacy null-version binary, which is dropped rather than retained, so the surviving-binary path was never exercised at all.

Four tests added:

• publishing PluginKit 15 over an entry holding 14 keeps both, and the old download URLs survive
• a third version evicts the oldest and keeps two
• republishing the same version replaces its binaries rather than duplicating them
• publishing below the retained window refuses, instead of advertising a version whose binary the prune just discarded

Each was mutation-tested rather than just run. Breaking merged_binaries = surviving + new_binaries into merged_binaries = new_binaries, which is the exact regression that would give every user on the previous app version noCompatibleBinary, is caught only by the first of these:

AssertionError: [15, 15]   (expected [14, 14, 15, 15])

Removing the new-binary assertion is caught only by the fourth. Both pass again once restored.

Verification

test_update_registry.py passes and fails correctly under three separate mutations. actionlint is clean across all six workflows and shellcheck --severity=warning clean across all 43 scripts. verify-build.sh is not run end to end here, because it needs a signed and notarized .app; its plugin derivation was checked against the authoritative parse instead.

https://claude.ai/code/session_013MEaba8K1HQcyDNeq5wEFk

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.