fix(notify): read draft assets by release ID

[psimaker]

Summary

• resolve staged helper releases through GraphQL so a private draft is visible before finalization;
• download every required pre-rollout asset through its validated numeric REST asset ID and verify its server-recorded SHA-256 locally;
• keep finalization retries draft-aware when rollout evidence was uploaded before a later failure.

Failure evidence

Recovery publication run 29339718813 was bound to main@f3a823d5b9c29764c2e89e90c23254736e4598c7. Policy, notify, owner, immutable image, binary attestation, and binary staging gates succeeded. The private draft received exactly nine expected pre-rollout assets with verified digests.

Published Helper Rollout then failed in its first read-only step because gh release download notify-v2.0.0 uses a tag-based REST lookup that does not see draft releases. No helper container, upgrade, downgrade, forward recovery, rollout evidence, finalization, or public release occurred. Draft 353712477 remains private with those nine assets.

Security and compatibility

• rollout permissions remain contents: read; finalization permissions and every owner/ref/predecessor gate are unchanged;
• release IDs and asset IDs must be positive decimal values, every asset name must be in the immutable release specification, every API digest must be canonical SHA-256, and every downloaded byte stream is rehashed before use;
• the safety policy forbids reintroducing tag-based draft downloads in rollout or finalization retry paths;
• no image, tag, binary, attestation, release note, runtime, wire format, pairing, namespace, Decision 024, or existing-user behavior changes;
• upload, download, and roundtrip product evidence remain unset.

Verification

• ruby -c .github/scripts/notify-publish-safety.rb
• ruby .github/scripts/notify-publish-safety.rb
• cd notify && GOTOOLCHAIN=local go test ./... -count=1
• Actionlint 1.7.12 with ShellCheck 0.10.0
• zizmor --offline .github/workflows/docker.yml 1.26.1: no findings
• Trivy 0.70.0 filesystem vulnerability and secret scan: no HIGH/CRITICAL vulnerabilities or secret findings
• live read-only proof against draft 353712477: nine asset-ID downloads, API/local digest equality, all five SHA256SUMS checks, and exact manifest source/image binding
• git diff --check

Release truth

Helper publication remains incomplete. The release is still a private draft and the real published-image upgrade, rollback, forward-recovery, finalization, and public verification gates must still succeed.

[coderabbitai]

📝 Walkthrough

Walkthrough

Release rollout and finalization now retrieve individual assets through GraphQL-resolved IDs and validate their digests. Publish-safety checks enforce these read-only retrieval patterns and reject bulk release downloads.

Changes

Release asset safety

Layer / File(s)	Summary
GraphQL asset retrieval and digest validation .github/workflows/docker.yml	rollout-verify and finalize-release resolve asset IDs, download raw assets through the GitHub Assets API, and validate expected digests.
Publish-safety policy assertions .github/scripts/notify-publish-safety.rb	Policy checks require asset IDs, octet-stream headers, exact matches, canonical SHA-256 digests, and prohibit gh release download.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• psimaker/vaultsync#111: Introduces the related publish-safety script and CI integration.
• psimaker/vaultsync#116: Tightens the same GraphQL-based per-asset verification behavior.
• psimaker/vaultsync#117: Expands related finalization and asset verification checks.

Suggested reviewers: dependabot[bot]

Poem

Assets by ID, through GraphQL they glide,
Their octet-stream bytes arrive.
SHA sums guard each staged file,
Safety scripts inspect the while.
No bulk downloads cross the tide.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Private Note Leakage	✅ Passed	Changed workflow/code only fetches release assets by ID and verifies digests; it doesn’t log or transmit Obsidian notes, vault paths, bookmarks, or secret tokens.
Bounded Ios Background Work	✅ Passed	No Swift/iOS background-execution code changed; the diff only touches GitHub script/workflow files, so the bounded-background-work check is not applicable.
Bridge Contract Compatibility	✅ Passed	No Go/Swift bridge files changed; the PR only edits publish-safety and workflow scripts, so the Swift-Go bridge contract is unaffected.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title uses a conventional-commit style prefix and accurately summarizes the main change around reading draft assets by release ID.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/helper-publication-draft-rollout-recovery

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[psimaker]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[psimaker]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.