[ryan-morris]

Fixes from a review of the release and CI workflows.

Release (release.yml, scripts/compute-version.sh)

• A dispatch from a branch other than main no longer publishes. The plan job's first step fails with an ::error:: when dry_run is off and github.ref is not refs/heads/main. Dry runs still work from any ref. Push runs only ever happen on main, so they are unaffected.
• The order is now tag, then packages, then GitHub release. The tag is pushed (as devenvy-bot, with the app-token step moved up) after verification and before the first NuGet upload. Before this, a run that uploaded some packages and then failed left nothing to show it had started. A later run after main moved computed the same version, and --skip-duplicate filled in the rest of the set from a different commit. Now that later run finds the tag at another commit and the existing refusal stops it before any upload. The error says to re-run the original run, which uses the same commit. The GitHub release is still created last, with --verify-tag, so it marks the version as finished. The ordering is explained in a comment in the workflow.
• A tag with no GitHub release now gets resumed instead of skipped. compute-version.sh still exits 3 for an upstream build that is already tagged, and now also prints that version on stdout. The planner then checks for a GitHub release (GET releases/tags/v<version>). A 404 means the version is unfinished, so it is planned again under the same version. Any other API error fails the plan rather than guessing. Every step is conditional on its own absence (tag already at this commit, --skip-duplicate, release already there), so a resume picks up where the failed run stopped. A resume never publishes from a commit other than the one the tag points at: the tag check runs before any upload.

Package verification (scripts/verify-packages.py)

• Packages are now classified by id as helper, .All meta or runtime, for a known cell and RID. An unrecognised id fails.
• Every runtime package must carry a native payload. Before, that assertion sat inside if payload and could never fire, so an empty runtime package passed. The lib/*.dll and notices checks now also run for every runtime package.
• --expect-complete now checks the full expected inventory: the helper, plus every cell's .All and all ALL_RIDS runtime packages. Cells and RIDs both come from gen-nuspec.sh (the SPDX table and ALL_RIDS). Before, the check only covered metas that happened to be present, so a cell that failed to pack entirely went unnoticed.
• New --cells: CI packs only LGPLv2 in full, so it now passes --expect-complete --cells LGPLv2. The release keeps checking all four cells.

I checked this with synthetic feeds built in memory (10 cases):

• Pass: a good complete feed, the CI shape, --cells with a subset, and a subset feed run without --expect-complete.
• Fail: an empty runtime package (RID and Apple), a missing cell, a missing RID, and missing metas.
• Against main, five of these cases give the wrong result: the empty-package, missing-cell and missing-metas feeds all pass there.

Update check (check-updates.yml)

• Upstream releases are now read with gh api --paginate repos/devenvy/ffmpeg/releases, with drafts and pre-releases filtered out. Before, only the newest 100 were read, so a quiet series could fall out of the window, match nothing and fail every run.

CI (ci.yml)

• The pack matrix now comes from versions.json through a small resolve job, the same source smoke-test.yml uses. result now needs resolve as well and is still the single required check.

Local checks

• shellcheck scripts/*.sh, actionlint and zizmor (offline) are all clean.
• I ran the plan script locally against the real tags and releases in three cases:
  • All series released: nothing planned.
  • A tag with no release: resumed under the same version.
  • A new upstream: released as a new version.

🤖 Generated with Claude Code