fix: resolve immutable release workflow and VERSION file timing issues

.github/workflows/release.yml

@@ -272,19 +272,57 @@ jobs:
       - run: tar -C "$HOME" -xvf "dist/mise-$(./scripts/get-version.sh)-linux-x64.tar.zst"
       - run: echo "$HOME/mise/bin" >> "$GITHUB_PATH"
       - run: mise x -- scripts/release.sh
+      - name: Create Draft GitHub Release
+        if: startsWith(github.event.ref, 'refs/tags/v')
+        run: |
+          VERSION="$(./scripts/get-version.sh)"
+          # Extract full release notes from git tag message (including subject and body)
+          # Use %(contents) to get the full message, then skip the PGP signature if present
+          git tag -l --format='%(contents)' "$VERSION" | sed '/-----BEGIN PGP SIGNATURE-----/,$d' > /tmp/release-notes.txt
+          # Create draft release with all assets in a single command
+          # Use --notes-file to safely handle special characters and multi-line content
+          gh release create "$VERSION" \
+            --title "$VERSION" \
+            --notes-file /tmp/release-notes.txt \
+            --verify-tag \
+            --draft \
+            releases/$VERSION/*
+        env:
+          GH_TOKEN: ${{ secrets.RTX_GITHUB_BOT_TOKEN }}
+      - name: Publish Release Assets to CDN
+        if: startsWith(github.event.ref, 'refs/tags/v')
+        run: mise x -- scripts/publish-release.sh
         env:
           CLOUDFLARE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_ACCESS_KEY_ID }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
           CLOUDFLARE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_SECRET_ACCESS_KEY }}
+      - name: Publish npm @jdxcode/mise
+        if: startsWith(github.event.ref, 'refs/tags/v')
+        run: |
+          if [[ ${DRY_RUN:-0} != 1 ]]; then
+            NPM_PREFIX=@jdxcode/mise ./scripts/release-npm.sh
+          fi
+        env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-      - name: GitHub Release Assets
-        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2
+      - name: Deploy Cloudflare Worker
         if: startsWith(github.event.ref, 'refs/tags/v')
-        with:
-          fail_on_unmatched_files: true
-          draft: false
-          files: releases/${{github.ref_name}}/*
-          generate_release_notes: true
-          token: ${{ secrets.RTX_GITHUB_BOT_TOKEN }}
-      - run: gh release edit --draft=false "$(./scripts/get-version.sh)"
+        run: mise x -- scripts/deploy-worker.sh
+        env:
+          CLOUDFLARE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_ACCESS_KEY_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
+          CLOUDFLARE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_SECRET_ACCESS_KEY }}
+      - name: Update Redirect
         if: startsWith(github.event.ref, 'refs/tags/v')
+        run: mise x -- scripts/update-redirect.sh "$(./scripts/get-version.sh)"
+        continue-on-error: true
+        env:
+          CLOUDFLARE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_ACCESS_KEY_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
+          CLOUDFLARE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_SECRET_ACCESS_KEY }}
+      - name: Publish GitHub Release
+        if: startsWith(github.event.ref, 'refs/tags/v')
+        run: |
+          VERSION="$(./scripts/get-version.sh)"
+          gh release edit "$VERSION" --draft=false
+        env:
+          GH_TOKEN: ${{ secrets.RTX_GITHUB_BOT_TOKEN }}

mise.lock

@@ -34,6 +34,10 @@ backend = "core:bun"
 checksum = "blake3:cf519ce71d7c518e211001f428ae34c2ec2a4f0484787bdf28baf7f372c94860"
 size = 39128668
 
+[tools.bun.platforms.macos-arm64]
+checksum = "blake3:b5824ab4bf0afba1d27d55d4cbec1696c3d1070f6982cbf6b4fa0489892ec931"
+size = 22056420
+
 [tools.cargo-binstall]
 version = "1.15.3"
 backend = "aqua:cargo-bins/cargo-binstall"
@@ -43,6 +47,11 @@ checksum = "blake3:b6100a915a4531a7ea7e1d1d87a9e70ce4afc980d7e3bd420521a90b29bdc
 size = 6772799
 url = "https://github.com/cargo-bins/cargo-binstall/releases/download/v1.15.3/cargo-binstall-x86_64-unknown-linux-musl.tgz"
 
+[tools.cargo-binstall.platforms.macos-arm64]
+checksum = "blake3:8fb84239a9f54c0107faa2cf6ac12c658572b943356e1291c4cf39f34af6ceaf"
+size = 6004746
+url = "https://github.com/cargo-bins/cargo-binstall/releases/download/v1.15.3/cargo-binstall-aarch64-apple-darwin.zip"
+
 [tools."cargo:cargo-edit"]
 version = "0.13.7"
 backend = "cargo:cargo-edit"
@@ -104,6 +113,11 @@ checksum = "blake3:426758a535d7e359bcd1e9f2f598a8aa01e518587a8141fc3b33f17617dfd
 size = 6873815
 url = "https://github.com/jdx/hk/releases/download/v1.10.7/hk-x86_64-unknown-linux-gnu.tar.gz"
 
+[tools.hk.platforms.macos-arm64]
+checksum = "blake3:2990ec4745178df124c26dcef643a14d362fe8ca24759feba4bdf61e71bf4a63"
+size = 5928348
+url = "https://github.com/jdx/hk/releases/download/v1.10.7/hk-aarch64-apple-darwin.tar.gz"
+
 [tools.jq]
 version = "1.8.1"
 backend = "aqua:jqlang/jq"
@@ -139,6 +153,11 @@ checksum = "blake3:8b26122653f2b25453211286c68f96eb53373763dc743bf8ff6c2c8091784
 size = 103994144
 url = "https://github.com/apple/pkl/releases/download/0.29.1/pkl-linux-amd64"
 
+[tools.pkl.platforms.macos-arm64]
+checksum = "blake3:5160399295c75f15f6b2b1e2925945a5d42a66793aa4eec821ab2dc60a5ae4ea"
+size = 104874656
+url = "https://github.com/apple/pkl/releases/download/0.29.1/pkl-macos-aarch64"
+
 [tools.pre-commit]
 version = "4.3.0"
 backend = "aqua:pre-commit/pre-commit"

scripts/publish-release.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+# This script runs after the GitHub release is successfully created
+# It updates the VERSION file and publishes to R2
+
+BASE_DIR="$(pwd)"
+MISE_VERSION=$(./scripts/get-version.sh)
+RELEASE_DIR=releases
+export BASE_DIR MISE_VERSION RELEASE_DIR
+
+echo "::group::Create VERSION file"
+pushd "$RELEASE_DIR"
+echo "$MISE_VERSION" | tr -d 'v' >VERSION
+popd
+
+if [[ ${DRY_RUN:-0} != 1 ]]; then
+	echo "::group::Publish r2"
+	./scripts/publish-r2.sh
+fi

scripts/release.sh

@@ -50,7 +50,6 @@ done
 
 echo "::group::Checksums"
 pushd "$RELEASE_DIR"
-echo "$MISE_VERSION" | tr -d 'v' >VERSION
 cp mise-latest-linux-x64 mise-latest-linux-amd64
 cp mise-latest-macos-x64 mise-latest-macos-amd64
 sha256sum ./mise-latest-* >SHASUMS256.txt
@@ -85,17 +84,4 @@ curl -L -o "$TMP_FILE" "https://github.com/jdx/mise/archive/refs/tags/$MISE_VERS
 gpg --detach-sign -u 8B81C9D17413A06D <"$TMP_FILE" >"$RELEASE_DIR/$MISE_VERSION/$MISE_VERSION.tar.gz.sig"
 rm "$TMP_FILE"
 
-if [[ $DRY_RUN != 1 ]]; then
-	echo "::group::Publish npm @jdxcode/mise"
-	NPM_PREFIX=@jdxcode/mise ./scripts/release-npm.sh
-	#  echo "::group::Publish npm mise-cli"
-	#  NPM_PREFIX=mise-cli ./scripts/release-npm.sh
-	echo "::group::Publish r2"
-	./scripts/publish-r2.sh
-	echo "::group::Deploy Cloudflare Worker"
-	./scripts/deploy-worker.sh
-	echo "::group::Update redirect"
-	./scripts/update-redirect.sh "$MISE_VERSION" || true
-	echo "::group::Publish GitHub releases as draft"
-	gh release edit --draft=true "$MISE_VERSION"
-fi
+# Publishing is now done after GitHub release is created

xtasks/release-plz

@@ -17,7 +17,6 @@ if [[ $cur_version != "$latest_version" ]]; then
 	changelog="$(echo "$changelog" | tail -n +3)"
 	git tag "v$cur_version" -s -m "$changelog"
 	git push --tags
-	gh release create "v$cur_version" --title "v$cur_version" --notes "$changelog" --draft
 	exit 0
 fi