From 70fce2435848a0e6b99a067a56201bf5dea22999 Mon Sep 17 00:00:00 2001
From: Jon Langevin <codingsloth@pm.me>
Date: Sun, 31 May 2026 16:08:54 -0400
Subject: [PATCH] fix: verify release packaged manifest

---
 .github/workflows/release.yml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7a1a42e..b00a896 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -65,8 +65,18 @@ jobs:
             jq '.[] | {name, type, goos, goarch, path}' dist/artifacts.json
             exit 0
           fi
+          ARCHIVE=$(jq -r --arg arch "$RUNNER_ARCH" \
+            '[.[] | select(.type=="Archive" and .goos=="linux" and .goarch==$arch and (.name|startswith("workflow-plugin-okta")))] | .[0].path // ""' \
+            dist/artifacts.json)
+          if [ -z "$ARCHIVE" ] || [ "$ARCHIVE" = "null" ]; then
+            echo "::warning::No matching linux/$RUNNER_ARCH archive in dist/artifacts.json; skipping verify-capabilities"
+            jq '.[] | {name, type, goos, goarch, path}' dist/artifacts.json
+            exit 0
+          fi
+          VERIFY_DIR=$(mktemp -d)
+          tar -xzf "$ARCHIVE" -C "$VERIFY_DIR" plugin.json plugin.contracts.json LICENSE
           chmod +x "$BIN"
-          "${{ runner.temp }}/wfctl-bin/wfctl" plugin verify-capabilities --binary "$BIN" .
+          "${{ runner.temp }}/wfctl-bin/wfctl" plugin verify-capabilities --binary "$BIN" "$VERIFY_DIR"
       - name: Publish GitHub release
         uses: actions/github-script@v7
         with: