diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6aee7555..bef98961 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -740,21 +740,6 @@ jobs: echo "version=$VERSION" >> $GITHUB_OUTPUT echo "build_number=$BUILD_NUMBER" >> $GITHUB_OUTPUT - - name: Refuse to overwrite a published release - env: - GH_TOKEN: ${{ github.token }} - VERSION: ${{ steps.version.outputs.version }} - run: | - if RELEASE_DRAFT=$(gh api "repos/$GITHUB_REPOSITORY/releases/tags/$VERSION" --jq '.draft' 2>&1); then - if [ "$RELEASE_DRAFT" != "true" ]; then - echo "::error::Release $VERSION is already published. Publish a new version instead of replacing immutable assets." - exit 1 - fi - elif [[ "$RELEASE_DRAFT" != *"HTTP 404"* ]]; then - echo "::error::Failed to check whether release $VERSION is already published: $RELEASE_DRAFT" - exit 1 - fi - - name: Download Android artifacts if: ${{ inputs.build_android }} uses: actions/download-artifact@v4 @@ -916,10 +901,8 @@ jobs: - name: Create Release uses: softprops/action-gh-release@v2 with: - tag_name: ${{ steps.version.outputs.version }} files: ${{ steps.release-files.outputs.files }} draft: true prerelease: false - generate_release_notes: true env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/scripts/check_build_workflow.py b/scripts/check_build_workflow.py index cf59837b..272e003b 100644 --- a/scripts/check_build_workflow.py +++ b/scripts/check_build_workflow.py @@ -192,29 +192,15 @@ for build_input in ( f"release publication must require {build_input}", ) -guard_name = "Refuse to overwrite a published release" -require(guard_name in release, "release job must reject published tag reuse") +require("draft: true" in release, "build output must remain a draft release") +require("tag_name:" not in release, "build output must not bind a release tag") require( - 'gh api "repos/$GITHUB_REPOSITORY/releases/tags/$VERSION"' in release, - "published release guard must query the exact version tag", + "generate_release_notes:" not in release, + "untagged draft releases must not request generated release notes", ) require( - '"$RELEASE_DRAFT" != "true"' in release, - "published release guard must allow only draft releases", -) -require( - "HTTP 404" in release and "Failed to check whether release" in release, - "published release guard must distinguish missing releases and fail closed", -) -guard_position = release.find(guard_name) -download_position = release.find("Download Android artifacts") -require( - guard_position >= 0 and download_position >= 0 and guard_position < download_position, - "published release guard must run before artifact downloads", -) -require( - "tag_name: ${{ steps.version.outputs.version }}" in release, - "release must explicitly use the pubspec version as its tag", + "Refuse to overwrite a published release" not in release, + "untagged draft creation must not inspect or block on published releases", ) if errors: