From 4b25e643952c8da2e2771ab7e60cbc34e67f427d Mon Sep 17 00:00:00 2001 From: Maximilian Roos Date: Thu, 23 Jul 2026 12:31:18 -0700 Subject: [PATCH] fix(release): preserve signed Windows zip filename, match checksum format MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit skip-decompress defaults to false, so the SignPath action was extracting the returned zip's contents as loose files instead of saving back the signed worktrunk-x86_64-pc-windows-msvc.zip — the checksum step would have silently hashed the still-unsigned zip. Also add sha256sum -b to match cargo-dist's own * checksum format. --- .github/workflows/release.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index b364b3e56d..dba1688c53 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -173,12 +173,18 @@ jobs: github-artifact-id: '${{ steps.upload-unsigned-windows-artifact.outputs.artifact-id }}' wait-for-completion: true output-artifact-directory: 'target/distrib' + # Without this, the action extracts the zip's contents as loose + # files instead of saving back the signed zip under its original + # name, silently breaking the checksum step and the release upload. + skip-decompress: true - name: Recompute checksum for signed Windows artifact if: contains(matrix.targets, 'x86_64-pc-windows-msvc') shell: bash run: | cd target/distrib - sha256sum worktrunk-x86_64-pc-windows-msvc.zip > worktrunk-x86_64-pc-windows-msvc.zip.sha256 + # -b matches cargo-dist's own checksum format (` *`); + # sha256sum's default text mode omits the asterisk. + sha256sum -b worktrunk-x86_64-pc-windows-msvc.zip > worktrunk-x86_64-pc-windows-msvc.zip.sha256 - id: cargo-dist name: Post-build # We force bash here just because github makes it really hard to get values up