From 314c6e5a4c5c5cd6932638d84aac04559b639cb9 Mon Sep 17 00:00:00 2001
From: Lincoln Stein <lincoln.stein@gmail.com>
Date: Sun, 12 Jul 2026 16:51:21 -0400
Subject: [PATCH] fix(ci): refuse to attach OSSign artifacts that don't match
 the release tag

The OSSign single_check action exposes no success/failure signal, and
when the polled signing run has failed it returns the previous
successful run's artifacts. This let a failed v1.8.2-rc.1 signing run
silently attach June's 1.8.1 test build to the draft release. Verify
the version in the returned latest.yml against the target ref before
attaching, and fail loudly on mismatch or missing metadata.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/wait-signature.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/wait-signature.yml b/.github/workflows/wait-signature.yml
index bcae878..25573bf 100644
--- a/.github/workflows/wait-signature.yml
+++ b/.github/workflows/wait-signature.yml
@@ -92,6 +92,28 @@ jobs:
             dist/*.yaml
           retention-days: 90
 
+      - name: Verify artifacts match the target ref
+        # The OSSign action has no success/failure output: when the polled signing run has
+        # FAILED, single_check has been observed to return the project's *previous* successful
+        # artifacts instead of nothing (2026-07-12: a failed v1.8.2-rc.1 run yielded June's
+        # 1.8.1 build, which was silently attached to the draft release). Guard by checking
+        # that the electron-updater metadata version matches the tag before attaching.
+        if: steps.check.outputs.signed_artifacts != '' && startsWith(inputs.target_ref, 'v')
+        run: |
+          set -euo pipefail
+          expected="${{ inputs.target_ref }}"
+          expected="${expected#v}"
+          if [ ! -f dist/latest.yml ]; then
+            echo "::error::No latest.yml among signed artifacts; cannot verify they belong to ${{ inputs.target_ref }}. Refusing to attach."
+            exit 1
+          fi
+          actual=$(awk '/^version:/ {print $2; exit}' dist/latest.yml)
+          if [ "${actual}" != "${expected}" ]; then
+            echo "::error::OSSign returned artifacts for version '${actual}' but the target ref is '${{ inputs.target_ref }}'. The OSSign build likely failed and stale artifacts were returned. Refusing to attach."
+            exit 1
+          fi
+          echo "Artifact version ${actual} matches ${{ inputs.target_ref }}."
+
       - name: Attach signed artifacts to the release
         # Only for vX.Y.Z tags — the release is created by the linux/macOS publish jobs. For
         # non-tag (manual test) runs there is no release, so we stop at the workflow artifact above.