fix: verify Windows release artifact namespace

[seonghobae]

Purpose

Canonical release foundation for DiskSage. This line combines the hosted-runner/Vitest prerequisite inherited from #341 with the release artifact namespace, failed-job rerun, verifier, attestation, and publication repair. Pull requests gain no tag/publication/secret authority; exact-head evidence remains fail closed.

Current exact state — 2026-09-07

• protected main: 0e90f9cebadbd7f59606baaec4ca1d2f178c899a;
• exact fix: verify Windows release artifact namespace #264 head: fea9144a15234035fbdf37e9fa914e5fd51efdec;
• exact main→fix: verify Windows release artifact namespace #264 comparison: ahead 52 / behind 0, merge base exactly protected main;
• current semantic surface is 20 release/test/doctoring files;
• open, Ready-for-review and mechanically mergeable. Ready state is not merge authorization.

Release namespace and rerun RCA

The release matrix uses windows-2022; predecessor verifier logic expected windows-latest. #264 aligns the verifier with the matrix, restricts bundle/CLI discovery to each exact platform artifact directory, and runs a real filesystem fixture. Exact cardinality, checksum semantics, non-regular-entry rejection, nonempty payload checks, bundle/CLI requirements, attestation, and publication gates remain intact.

A failed-job rerun exposed a second defect: attempt-2 consumers searched attempt-2 names while already-successful attempt-1 producers retained attempt-1 artifacts. Release artifacts, PR/tag consumers, SBOM, and publication therefore use stable ${{ github.run_id }} identity rather than github.run_attempt. The current SBOM contract test checks the same production namespace.

Test-runtime RCA

A predecessor Test run completed Vitest assertions and then lost worker processes to ERR_WORKER_OUT_OF_MEMORY. The inherited #341 contract bounds CI Vitest workers to two while retaining the complete src/**/*.test.ts scope. Later evidence exposed stale attestation/provenance assertions that still required github.run_attempt; those contracts were changed to the production github.run_id boundary without weakening release gates.

Current exact-head evidence

On exact head fea9144a..., Release 34064276679, Test 34064276663, Security Scan 34064276645, SAST Semgrep 34064276692, and Docs 34064276602 are terminal success. Release job download-artifact-pr-compat 101572552331 proves the corrected Windows artifact-directory contract on this exact head.

CodeQL run 34064276711 attempt 3 is now terminal failure on unchanged fea9144a...: language detection 101669210677 succeeded, while compatibility jobs 101669210751 (javascript-typescript) and 101669210752 (python) failed; downstream analysis/publication/verification did not run. The original dispatch-actor allowlist mismatch is repaired in canonical ContextualWisdomLab/.github#1929, so it is no longer the active cause.

Canonical .github evidence now isolates the remaining owner defect to cross-repository terminal receipt/wake semantics and the two-language legacy compatibility path. The merged .github#2009 accepts legacy scalar required_job_id/required_language payloads, but legacy language dispatches can still share one PR concurrency group with cancel-in-progress: true, allowing a later language dispatch to cancel an earlier one before terminal receipt. .github#1902 remains the open canonical repair path. Until that owner produces unchanged-head terminal scan/SARIF receipts for both required languages, rerunning #264 again would only repeat an unfixed central failure.

A dispatch POST, language-detection success, stale status, predecessor success, or leaf repository source churn cannot satisfy the CodeQL gate.

Inheritance boundary

Release-specific evidence inherited from historical #156 includes Cargo-bin and Tauri-binary-isolation contracts. #156 remains open until its other useful evidence is owner-classified. #187, #205, and #206 inherit this release/Test lineage through ordinary two-parent stack refreshes rather than copying release-owner source.

No self-approval, force-push, destructive rebase, gate weakening, or administrative bypass.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

릴리스 아티팩트 검증이 플랫폼별 예상 디렉터리 내부를 검색하도록 변경되었습니다. Windows 디렉터리 이름이 windows-2022로 갱신되었습니다. 워크플로 검증 단계와 디렉터리 계약 테스트가 추가되었습니다.

Changes

릴리스 아티팩트 검증

Layer / File(s)	Summary
플랫폼별 디렉터리 검증 .github/scripts/verify-release-artifacts.sh	검증 함수가 플랫폼 디렉터리 바로 아래에서 파일을 확인합니다. 번들, 운영 CLI, .sha256 파일을 플랫폼별로 각각 정확히 하나씩 검증합니다. Windows 예상 디렉터리를 windows-2022로 변경했습니다.
디렉터리 계약 테스트 src/lib/releaseArtifactVerifierDirectoryContract.test.ts	정확한 배치의 성공을 확인합니다. Windows 아티팩트의 Linux 디렉터리 이동과 Linux 번들의 중첩 경로 이동을 실패로 확인합니다. 오류 메시지와 워크플로 검증 순서를 확인합니다.
릴리스 워크플로 검증 순서 .github/workflows/release.yml, docs/doctoring/release-artifact-windows-namespace-rca.md	attest-release가 SBOM 생성 및 provenance attestation 전에 다운로드한 아티팩트를 검증합니다. Windows 네임스페이스 불일치의 원인과 재검증 조건을 문서화합니다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 64a30

The change narrowly aligns Windows artifact verification with the release namespace and adds regression coverage; no actionable merge-blocking risk remains, though the RCA should accurately describe the verifier’s direct-placement checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 3 files. (2 skipped: 2 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 Windows 릴리스 아티팩트 네임스페이스 검증 수정이라는 PR의 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/release-artifact-windows-namespace-v1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T22:31:03.418261Z	5c4eede	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5c4eedeb6a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for fea9144a15234035fbdf37e9fa914e5fd51efdec.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/disksage/actions/runs/34064276711/job/101581526664)
• CodeQL PR/CodeQL compatibility analysis (javascript-typescript): FAILURE (https://github.com/ContextualWisdomLab/disksage/actions/runs/34064276711/job/101581526763)
• CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/disksage/actions/runs/34064276711/job/101581526664)
• CodeQL compatibility analysis (javascript-typescript) check run: failure (https://github.com/ContextualWisdomLab/disksage/actions/runs/34064276711/job/101581526763)
• Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/disksage/actions/runs/34064275537/job/101581586598)
• noema-review check run: failure (https://github.com/ContextualWisdomLab/disksage/actions/runs/34064275537/job/101581586598)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Repository file: verify-release-artifacts.sh"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Repository file: verify-release-artifacts.sh"]
  R1 --> V1["required checks"]
  Evidence --> S2["Workflow: release.yml"]
  S2 --> I2["GitHub Actions review job"]
  I2 --> R2["Review risk: Workflow: release.yml"]
  R2 --> V2["actionlint plus required checks"]
  Evidence --> S3["Workflow: test.yml"]
  S3 --> I3["GitHub Actions review job"]
  I3 --> R3["Review risk: Workflow: test.yml"]
  R3 --> V3["actionlint plus required checks"]
  Evidence --> S4["Docs: release-artifact-provenance.md (2 files)"]
  S4 --> I4["operator or user guidance"]
  I4 --> R4["Review risk: Docs: release-artifact-provenance.md (2 files)"]
  R4 --> V4["docs review"]
  Evidence --> S5["Repository file: package.json"]
  S5 --> I5["repository behavior"]
  I5 --> R5["Review risk: Repository file: package.json"]
  R5 --> V5["required checks"]
  Evidence --> S6["CI script: workflow-concurrency-contract.test.mjs"]
  S6 --> I6["review and security gate shell path"]
  I6 --> R6["Review risk: CI script: workflow-concurrency-contract.test.mjs"]
  R6 --> V6["bash -n plus Strix self-test"]
  Evidence --> S7["TypeScript/JavaScript: releaseArtifactAllowlistContract.test.ts (12 files)"]
  S7 --> I7["TypeScript or JavaScript runtime"]
  I7 --> R7["Review risk: TypeScript/JavaScript: releaseArtifactAllowlistContract.test.ts (12 files)"]
  R7 --> V7["package test plus coverage"]
  Evidence --> S8["TypeScript/JavaScript: vitest.config.ts"]
  S8 --> I8["TypeScript or JavaScript runtime"]
  I8 --> R8["Review risk: TypeScript/JavaScript: vitest.config.ts"]
  R8 --> V8["package test plus coverage"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: fea9144a15234035fbdf37e9fa914e5fd51efdec
• Workflow run: 34072987562
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES
• Coverage gate: success
• Model pool: exhausted
• Verdict: REQUEST_CHANGES
• Formal review: fix: verify Windows release artifact namespace #264 (review)