fix(release): use trusted verifier during recovery

2026-08-13 16:05:31 +08:00
2 changed files with 18 additions and 1 deletions
@@ -1061,7 +1061,15 @@ jobs:
        run: ./scripts/release/verify-release-artifacts.sh "$RELEASE_VERSION"

      - name: Verify npm package before sealing GitHub Release
-        run: ./scripts/release/verify-package-managers.sh --npm-only --expected-version "$RELEASE_VERSION"
+        # Build inputs stay pinned to the sealed commit, but recovery validation
+        # must use the reviewed current tooling. Otherwise a verifier fix on
+        # main can never repair a failed immutable release.
+        env:
+          DWS_PACKAGE_DIST_DIR: ${{ github.workspace }}/dist
+        run: |
+          "$GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-package-managers.sh" \
+            --npm-only \
+            --expected-version "$RELEASE_VERSION"

      - name: Reverify remote tag before sealing GitHub Release
        env:
@@ -1583,6 +1583,15 @@ func TestReleaseWorkflowRecoveryReusesGuardedJobs(t *testing.T) {
 			t.Errorf("%s must not fork into a recovery-specific publisher", name)
 		}
 	}
+	releaseSection := sections["release"]
+	for _, required := range []string{
+		`tmp/trusted-release-tooling/scripts/release/verify-package-managers.sh`,
+		`DWS_PACKAGE_DIST_DIR: ${{ github.workspace }}/dist`,
+	} {
+		if !strings.Contains(releaseSection, required) {
+			t.Errorf("release must verify sealed artifacts with trusted recovery tooling %q", required)
+		}
+	}
 	if strings.Count(workflow, "name: Build signed release artifacts") != 1 ||
 		strings.Count(workflow, "name: Verify Apple Developer ID signatures") != 1 ||
 		strings.Count(workflow, "name: Publish immutable GitHub Release") != 1 ||