fix: verify Windows release artifact namespace

[seonghobae]

Purpose

Repair the PR-executable release artifact verifier after the merged actions/download-artifact v8 compatibility line exposed an exact platform-namespace mismatch.

Exact failure and root cause

On PR #214 exact head a6cfd32e1c56ea12bddcfdd3f5caff9d6f95e9f6, Release run 32936765719 built and uploaded Linux, Windows, and macOS artifact sets successfully. The download-artifact-pr-compat job 98083412428 downloaded the v8 artifact family successfully and then failed only in Verify downloaded release artifact contract.

The release matrix uploads artifacts under release-disksage-${{ matrix.os }}-${{ github.run_attempt }} and the Windows matrix key is windows-2022. The verifier instead required release-disksage-windows-latest-${run_attempt}, so a correct downloaded artifact set could never satisfy the directory contract.

Test-first repair

1. Add a real Vitest regression that materializes the complete 17-file release artifact set under the exact current matrix namespaces (ubuntu-22.04, windows-2022, macos-latest) and executes the source-controlled Bash verifier.
2. Change only the Windows expected namespace in .github/scripts/verify-release-artifacts.sh from windows-latest to windows-2022.

The verifier's exact file cardinality, bundle types, six operational CLI artifacts, six adjacent SHA-256 records, checksum validation, non-regular-path rejection, and read-only PR compatibility authority remain unchanged.

Authority boundary

This adds no tag, release-publication, package-publication, attestation, secret, or write authority to pull requests. It only repairs the read-only compatibility proof already introduced by the merged #230 line.

Addresses #242.

Required before integration

Keep Draft until the unchanged exact head proves the real download-artifact-pr-compat job succeeds on the downloaded Linux/Windows/macOS release artifacts, all applicable current Test/Release/Security/SAST and central required workflows are terminal-success, current valid findings are addressed, live review/ruleset requirements are satisfied, and repository-wide exact production coverage requirements are not weakened. Pending, skipped-required, failed, stale, predecessor, status-only, or synthetic evidence is non-passing.

Summary by CodeRabbit

• 개선 사항

  • 릴리스 아티팩트를 플랫폼별 예상 디렉터리에서 정확히 검증하도록 개선했습니다.
  • 아티팩트 검증에 실패하면 SBOM 및 출처 정보 생성·업로드가 진행되지 않습니다.
  • Windows 릴리스 아티팩트 경로 검증을 최신 실행 환경에 맞게 조정했습니다.

• 테스트

  • 잘못 배치된 번들, CLI 및 체크섬 파일을 감지하는 검증 테스트를 추가했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 531dfb30-1e5a-4daf-b743-8397357e0161

📥 Commits

Reviewing files that changed from the base of the PR and between 79067c1 and 5e7b33d.

📒 Files selected for processing (4)

• .github/scripts/verify-release-artifacts.sh
• .github/workflows/release.yml
• src/lib/releaseArtifactVerifierDirectoryContract.test.ts
• src/lib/releaseTagArtifactVerifierContract.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

릴리스 아티팩트 검증이 플랫폼별 디렉터리 범위로 제한됩니다. attest-release 작업은 SBOM 생성 전에 검증 스크립트를 실행합니다. 디렉터리 배치와 워크플로 실행 순서를 계약 테스트로 확인합니다.

Changes

릴리스 아티팩트 검증

Layer / File(s)	Summary
플랫폼별 디렉터리 검증 .github/scripts/verify-release-artifacts.sh	검증 스크립트가 예상 플랫폼 디렉터리에서 번들, 운영 CLI, .sha256 파일을 각각 정확히 하나씩 확인합니다. Windows 디렉터리 이름을 windows-2022로 변경합니다.
워크플로 검증 게이트 .github/workflows/release.yml, src/lib/releaseArtifactVerifierDirectoryContract.test.ts, src/lib/releaseTagArtifactVerifierContract.test.ts	attest-release 작업이 SBOM 생성 전에 검증 스크립트를 실행합니다. 올바른 디렉터리 배치와 잘못된 Windows 파일 배치를 테스트합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 5e7b3

The PR corrects Windows release-artifact namespace validation and adds regression coverage without changing release authority; no actionable merge-blocking risk remains beyond normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant attest-release
  participant verify-release-artifacts.sh
  participant release-artifacts
  participant SBOMGeneration
  attest-release->>verify-release-artifacts.sh: 다운로드한 아티팩트 검증
  verify-release-artifacts.sh->>release-artifacts: 플랫폼별 디렉터리와 파일 확인
  release-artifacts-->>verify-release-artifacts.sh: 검증 결과 반환
  alt 검증 성공
    verify-release-artifacts.sh-->>attest-release: 성공 상태 반환
    attest-release->>SBOMGeneration: SBOM 생성 진행
  else 검증 실패
    verify-release-artifacts.sh-->>attest-release: 실패 상태 반환
    attest-release-->>SBOMGeneration: 후속 단계 중단
  end

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 3 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 Windows 릴리스 아티팩트 네임스페이스 검증 수정이라는 주요 변경 사항을 정확하고 간결하게 설명합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 3 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/release-artifact-windows-namespace-v1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

Devin Review found 1 new potential issue.