From 19e8aab4fdd6dfc67e324d41ff3b7cf359c5690c Mon Sep 17 00:00:00 2001
From: chichuan <haofeng.hf@alibaba-inc.com>
Date: Thu, 13 Aug 2026 16:05:31 +0800
Subject: [PATCH] fix(release): use trusted verifier during recovery

---
 .github/workflows/release.yml       | 10 +++++++++-
 test/scripts/package_script_test.go |  9 +++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 08e83fd8..e6596b9e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1061,7 +1061,15 @@ jobs:
         run: ./scripts/release/verify-release-artifacts.sh "$RELEASE_VERSION"
 
       - name: Verify npm package before sealing GitHub Release
-        run: ./scripts/release/verify-package-managers.sh --npm-only --expected-version "$RELEASE_VERSION"
+        # Build inputs stay pinned to the sealed commit, but recovery validation
+        # must use the reviewed current tooling. Otherwise a verifier fix on
+        # main can never repair a failed immutable release.
+        env:
+          DWS_PACKAGE_DIST_DIR: ${{ github.workspace }}/dist
+        run: |
+          "$GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-package-managers.sh" \
+            --npm-only \
+            --expected-version "$RELEASE_VERSION"
 
       - name: Reverify remote tag before sealing GitHub Release
         env:
diff --git a/test/scripts/package_script_test.go b/test/scripts/package_script_test.go
index 62b51c6c..e83fe605 100644
--- a/test/scripts/package_script_test.go
+++ b/test/scripts/package_script_test.go
@@ -1583,6 +1583,15 @@ func TestReleaseWorkflowRecoveryReusesGuardedJobs(t *testing.T) {
 			t.Errorf("%s must not fork into a recovery-specific publisher", name)
 		}
 	}
+	releaseSection := sections["release"]
+	for _, required := range []string{
+		`tmp/trusted-release-tooling/scripts/release/verify-package-managers.sh`,
+		`DWS_PACKAGE_DIST_DIR: ${{ github.workspace }}/dist`,
+	} {
+		if !strings.Contains(releaseSection, required) {
+			t.Errorf("release must verify sealed artifacts with trusted recovery tooling %q", required)
+		}
+	}
 	if strings.Count(workflow, "name: Build signed release artifacts") != 1 ||
 		strings.Count(workflow, "name: Verify Apple Developer ID signatures") != 1 ||
 		strings.Count(workflow, "name: Publish immutable GitHub Release") != 1 ||