From 9c4982ed4cde74ce0561199ef17cf059e39ac857 Mon Sep 17 00:00:00 2001 From: Ngo Quoc Dat Date: Tue, 20 Oct 2026 12:06:10 +0700 Subject: [PATCH 1/2] fix(release): wait for the release attestation before verifying it --- .github/workflows/release.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6c2024c48f..4482f37c6c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -268,7 +268,12 @@ jobs: - name: Verify the release run: | set -euo pipefail - gh release verify "$TAG" + # GitHub writes the release attestation a few seconds after the release publishes. + for attempt in 1 2 3 4 5 6; do + gh release verify "$TAG" && break + [ "$attempt" -lt 6 ] || exit 1 + sleep 10 + done for asset in dist/*; do gh release verify-asset "$TAG" "$asset" done From 76709e8478ffd98047907b7dd493c414d99745a2 Mon Sep 17 00:00:00 2001 From: Ngo Quoc Dat Date: Tue, 20 Oct 2026 12:06:27 +0700 Subject: [PATCH 2/2] docs(ci): name release/0.83 among the lines on the old checks --- .claude/rules/ci.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.claude/rules/ci.md b/.claude/rules/ci.md index cbbfc418f2..9f6de3ffb8 100644 --- a/.claude/rules/ci.md +++ b/.claude/rules/ci.md @@ -17,7 +17,7 @@ paths: - main and `release/*` require `CI`, the last job of `ci.yml`, and `PR title` (`pr-title.yml`). Strict is off. Admins can bypass in pull_request mode. - `CI` fails when a job it needs failed or was cancelled. A skipped job passes. -- `release/0.82` keeps its own workflow files and the old per-workflow checks. +- `release/0.82` and `release/0.83` were cut before `ci.yml`: they keep their own workflow files and the old per-workflow checks (ruleset 23957966). - Tags never move (ruleset 25308039, no bypass). Only admins create `release/*` and the `v*`, `ios-v*`, `linux-v*`, `libs-*` and `plugin-*` tags. ## Reading a red check