[Steel-tech]

Release artifacts previously relied on a narrower check path. Reuse the complete CI workflow on the exact release ref and require it to succeed before building artifacts or publishing. Existing PR/main CI triggers remain in place.

Manual dispatch builds and uploads artifacts with a safe dev-<SHA> version, including when dispatched on a version tag. Only pushed v* tags publish a GitHub release. Correct the macOS checksum command to ignore archives that were not downloaded.

Validation

• Actionlint, workflow event/needs/permissions self-checks, and git diff --check: PASS.
• Prior implementation validation: just check, four-platform cross-compilation, native darwin arm64 version check, branch-slash failure reproduction, and checksum valid/tampered fixtures: PASS.
• Frozen three-file content hash verified before and after commit; no source changes during delivery.
• Nonpublishing GitHub runtime validation: PASS. workflow_dispatch ran on exact head 594f03ce7d67b760c216ba81cdac729b9cc699a6; reusable CI (Linux, macOS, UI, aggregate check) and Cross-compiled binaries succeeded. Publish the release was SKIPPED.
• Parent verified all four platform archive checksums against the actual SHA256SUMS from artifact jig-binaries (ID 12932419287). The native darwin/arm64 binary ran in a sanitized environment and printed jig dev-594f03ce7d67b760c216ba81cdac729b9cc699a6. No release object or tag was created.

Soul Loop

• Rounds: 1 with gpt-6.1-sol
• Verdict: PASS
• Unresolved: None

Summary by CodeRabbit

• Release Process

  • Releases now wait for the full CI suite to pass before building artifacts.
  • Manual release runs build and upload development-labeled artifacts without publishing a release.
  • Publishing is limited to builds triggered by a version tag.

• Documentation

  • Updated checksum verification instructions with separate commands for macOS and other platforms.

[coderabbitai]

Walkthrough

The CI workflow can now be called by the release workflow. The release workflow waits for CI before building artifacts and publishes only for pushed version tags. The README updates its checksum instructions.

Changes: Release pipeline

Layer / File(s)	Summary
Reusable CI and release gate .github/workflows/ci.yml, .github/workflows/release.yml	The CI workflow accepts calls from other workflows. The release workflow waits for CI to succeed before continuing.
Release build and publishing .github/workflows/release.yml, README.md	The build uses the tag name for pushed version tags and dev-<commit SHA> otherwise. Publishing uses the same pushed-tag condition. The checksum instructions show shasum as a separate commented alternative to sha256sum.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: Minimal · up to 594f0

The release workflow requires CI before building and publishes only for pushed version tags. Manual runs remain nonpublishing. No concrete merge-blocking issue was found; GitHub runtime execution remains unverified.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: requiring full validation before release publishing.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Steel-tech]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.