fix: verify Windows release artifact namespace

.github/scripts/verify-release-artifacts.sh

@@ -2,39 +2,47 @@
 set -euo pipefail
 
 artifact_root="${1:-release-artifacts}"
-run_attempt="${2:-}"
+run_identity="${2:-}"
 
-if [[ -z "$run_attempt" || ! "$run_attempt" =~ ^[1-9][0-9]*$ ]]; then
-  printf 'run attempt must be a positive integer.\n' >&2
+if [[ -z "$run_identity" || ! "$run_identity" =~ ^[1-9][0-9]*$ ]]; then
+  printf 'run identity must be a positive integer.\n' >&2
   exit 1
 fi
 if [[ ! -d "$artifact_root" ]]; then
   printf 'release artifact root is missing: %s\n' "$artifact_root" >&2
   exit 1
 fi
 
+# Require exactly one regular bundle file directly inside its matrix-defined bundle directory.
 require_exactly_one_path() {
-  local path_pattern="$1" label="$2" count=0 matched_path=""
-  while IFS= read -r -d '' matched_path; do count=$((count + 1)); done < <(find "$artifact_root" -type f -path "$path_pattern" -print0)
+  local directory="$1" file_pattern="$2" label="$3" count=0
+  if [[ -d "$artifact_root/$directory" ]]; then
+    while IFS= read -r -d '' _; do count=$((count + 1)); done < <(
+      find "$artifact_root/$directory" -mindepth 1 -maxdepth 1 -type f -name "$file_pattern" -print0
+    )
+  fi
   if [[ $count -ne 1 ]]; then
     printf 'Expected exactly one %s, found %s.\n' "$label" "$count" >&2
     exit 1
   fi
 }
 
+# Require exactly one named operational artifact directly inside its platform-scoped directory.
 require_exactly_one_file() {
-  local file_name="$1" count=0 matched_path=""
-  while IFS= read -r -d '' matched_path; do count=$((count + 1)); done < <(find "$artifact_root" -type f -name "$file_name" -print0)
+  local directory="$1" file_name="$2" count=0
+  while IFS= read -r -d '' _; do count=$((count + 1)); done < <(
+    find "$artifact_root/$directory" -mindepth 1 -maxdepth 1 -type f -name "$file_name" -print0
+  )
   if [[ $count -ne 1 ]]; then
-    printf 'Expected exactly one release artifact named %s, found %s.\n' "$file_name" "$count" >&2
+    printf 'Expected exactly one release artifact named %s in %s, found %s.\n' "$file_name" "$directory" "$count" >&2
     exit 1
   fi
 }
 
 expected_dirs=(
-  "release-disksage-ubuntu-22.04-${run_attempt}"
-  "release-disksage-windows-latest-${run_attempt}"
-  "release-disksage-macos-latest-${run_attempt}"
+  "release-disksage-ubuntu-22.04-${run_identity}"
+  "release-disksage-windows-2022-${run_identity}"
+  "release-disksage-macos-latest-${run_identity}"
 )
 
 mapfile -d '' top_level_entries < <(find "$artifact_root" -mindepth 1 -maxdepth 1 -print0 | sort -z)
@@ -55,22 +63,24 @@ if [[ -n "$unexpected_entry" ]]; then
   exit 1
 fi
 
-require_exactly_one_path '*/bundle/deb/*.deb' 'Debian bundle'
-require_exactly_one_path '*/bundle/appimage/*.AppImage' 'AppImage bundle'
-require_exactly_one_path '*/bundle/msi/*.msi' 'Windows MSI bundle'
-require_exactly_one_path '*/bundle/nsis/*.exe' 'Windows NSIS bundle'
-require_exactly_one_path '*/bundle/dmg/*.dmg' 'macOS DMG bundle'
+require_exactly_one_path "${expected_dirs[0]}/bundle/deb" '*.deb' 'Debian bundle'
+require_exactly_one_path "${expected_dirs[0]}/bundle/appimage" '*.AppImage' 'AppImage bundle'
+require_exactly_one_path "${expected_dirs[1]}/bundle/msi" '*.msi' 'Windows MSI bundle'
+require_exactly_one_path "${expected_dirs[1]}/bundle/nsis" '*.exe' 'Windows NSIS bundle'
+require_exactly_one_path "${expected_dirs[2]}/bundle/dmg" '*.dmg' 'macOS DMG bundle'
 
-for required_name in \
-  disksage-cloud-plan-linux-x86_64 \
-  disksage-duplicate-audit-linux-x86_64 \
-  disksage-cloud-plan-windows-x86_64.exe \
-  disksage-duplicate-audit-windows-x86_64.exe \
-  disksage-cloud-plan-macos-arm64 \
-  disksage-duplicate-audit-macos-arm64; do
-  require_exactly_one_file "$required_name"
-  require_exactly_one_file "$required_name.sha256"
-done
+require_exactly_one_file "${expected_dirs[0]}" disksage-cloud-plan-linux-x86_64
+require_exactly_one_file "${expected_dirs[0]}" disksage-cloud-plan-linux-x86_64.sha256
+require_exactly_one_file "${expected_dirs[0]}" disksage-duplicate-audit-linux-x86_64
+require_exactly_one_file "${expected_dirs[0]}" disksage-duplicate-audit-linux-x86_64.sha256
+require_exactly_one_file "${expected_dirs[1]}" disksage-cloud-plan-windows-x86_64.exe
+require_exactly_one_file "${expected_dirs[1]}" disksage-cloud-plan-windows-x86_64.exe.sha256
+require_exactly_one_file "${expected_dirs[1]}" disksage-duplicate-audit-windows-x86_64.exe
+require_exactly_one_file "${expected_dirs[1]}" disksage-duplicate-audit-windows-x86_64.exe.sha256
+require_exactly_one_file "${expected_dirs[2]}" disksage-cloud-plan-macos-arm64
+require_exactly_one_file "${expected_dirs[2]}" disksage-cloud-plan-macos-arm64.sha256
+require_exactly_one_file "${expected_dirs[2]}" disksage-duplicate-audit-macos-arm64
+require_exactly_one_file "${expected_dirs[2]}" disksage-duplicate-audit-macos-arm64.sha256
 
 checksum_files=()
 checksum_file=""
@@ -113,9 +123,15 @@ for checksum_file in "${checksum_files[@]}"; do
 done
 
 regular_file_count=0
-matched_path=""
-while IFS= read -r -d '' matched_path; do regular_file_count=$((regular_file_count + 1)); done < <(find "$artifact_root" -type f -print0)
+while IFS= read -r -d '' _; do regular_file_count=$((regular_file_count + 1)); done < <(find "$artifact_root" -type f -print0)
 if [[ $regular_file_count -ne 17 ]]; then
   printf 'Unexpected release artifact entries: expected exactly 17 regular files, found %s.\n' "$regular_file_count" >&2
   exit 1
 fi
+
+# Nonempty content is necessary for publication, but does not establish binary validity.
+empty_artifact="$(find "$artifact_root" -type f -size 0 -print -quit)"
+if [[ -n "$empty_artifact" ]]; then
+  printf 'Empty release artifact is not publishable: %s\n' "$empty_artifact" >&2
+  exit 1
+fi

.github/workflows/release.yml

@@ -108,7 +108,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: 22.12.0
       - run: npm ci
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
@@ -117,7 +117,7 @@ jobs:
           cache-targets: false
 
       - name: Tauri build (with embedded LLM)
-        run: npm run tauri -- build --features llm-engine
+        run: node node_modules/@tauri-apps/cli/tauri.js build --features llm-engine
 
       - name: Diagnose WiX MSI linker failure
         if: failure() && matrix.os == 'windows-2022'
@@ -211,9 +211,10 @@ jobs:
       - name: Upload release artifact set
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: release-disksage-${{ matrix.os }}-${{ github.run_attempt }}
+          name: release-disksage-${{ matrix.os }}-${{ github.run_id }}
           path: ${{ matrix.bundles }}
           if-no-files-found: error
+          overwrite: true
 
   download-artifact-pr-compat:
     if: github.event_name == 'pull_request'
@@ -229,12 +230,12 @@ jobs:
       - name: Download exact release artifact set with v8
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          pattern: release-disksage-*-${{ github.run_attempt }}
+          pattern: release-disksage-*-${{ github.run_id }}
           path: release-artifacts
           merge-multiple: false
       - name: Verify downloaded release artifact contract
         shell: bash
-        run: bash .github/scripts/verify-release-artifacts.sh release-artifacts "${{ github.run_attempt }}"
+        run: bash .github/scripts/verify-release-artifacts.sh release-artifacts "${{ github.run_id }}"
 
   attest-release:
     if: startsWith(github.ref, 'refs/tags/')
@@ -251,16 +252,20 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: 22.12.0
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
 
       - name: Download exact release artifact set
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          pattern: release-disksage-*-${{ github.run_attempt }}
+          pattern: release-disksage-*-${{ github.run_id }}
           path: release-artifacts
           merge-multiple: false
 
+      - name: Verify downloaded release artifact contract
+        shell: bash
+        run: bash .github/scripts/verify-release-artifacts.sh release-artifacts "${{ github.run_id }}"
+
       - name: Generate and validate source-bound SBOM
         shell: bash
         run: |
@@ -277,90 +282,6 @@ jobs:
           node scripts/ci/generate-release-sbom.mjs \
             --validate release-artifacts/sbom/disksage.spdx.json
 
-      - name: Verify release artifact checksums
-        shell: bash
-        run: |
-          set -euo pipefail
-          require_exactly_one_path() {
-            local path_pattern="$1" label="$2" count=0
-            while IFS= read -r -d ''; do count=$((count + 1)); done < <(find release-artifacts -type f -path "$path_pattern" -print0)
-            if [[ $count -ne 1 ]]; then
-              printf 'Expected exactly one %s, found %s.\n' "$label" "$count" >&2
-              exit 1
-            fi
-          }
-          require_exactly_one_file() {
-            local file_name="$1" count=0
-            while IFS= read -r -d ''; do count=$((count + 1)); done < <(find release-artifacts -type f -name "$file_name" -print0)
-            if [[ $count -ne 1 ]]; then
-              printf 'Expected exactly one release artifact named %s, found %s.\n' "$file_name" "$count" >&2
-              exit 1
-            fi
-          }
-          require_exactly_one_path '*/bundle/deb/*.deb' 'Debian bundle'
-          require_exactly_one_path '*/bundle/appimage/*.AppImage' 'AppImage bundle'
-          require_exactly_one_path '*/bundle/msi/*.msi' 'Windows MSI bundle'
-          require_exactly_one_path '*/bundle/nsis/*.exe' 'Windows NSIS bundle'
-          require_exactly_one_path '*/bundle/dmg/*.dmg' 'macOS DMG bundle'
-          for required_name in \
-            disksage-cloud-plan-linux-x86_64 \
-            disksage-duplicate-audit-linux-x86_64 \
-            disksage-cloud-plan-windows-x86_64.exe \
-            disksage-duplicate-audit-windows-x86_64.exe \
-            disksage-cloud-plan-macos-arm64 \
-            disksage-duplicate-audit-macos-arm64; do
-            require_exactly_one_file "$required_name"
-            require_exactly_one_file "$required_name.sha256"
-          done
-          checksum_files=()
-          checksum_file=""
-          while IFS= read -r -d '' checksum_file; do checksum_files+=("$checksum_file"); done < <(find release-artifacts -type f -name '*.sha256' -print0)
-          if [[ ${#checksum_files[@]} -ne 6 ]]; then
-            printf 'Expected six operational CLI checksum files, found %s.\n' "${#checksum_files[@]}" >&2
-            exit 1
-          fi
-          for checksum_file in "${checksum_files[@]}"; do
-            checksum_dir="$(dirname "$checksum_file")"
-            checksum_name="$(basename "$checksum_file")"
-            expected_asset_name="${checksum_name%.sha256}"
-            checksum_line="" line="" line_count=0
-            while IFS= read -r line || [[ -n "$line" ]]; do
-              line_count=$((line_count + 1))
-              checksum_line="$line"
-            done <"$checksum_file"
-            if [[ $line_count -ne 1 ]]; then
-              printf 'Checksum file %s must contain exactly one record.\n' "$checksum_name" >&2
-              exit 1
-            fi
-            recorded_digest="" recorded_name="" extra_field=""
-            read -r recorded_digest recorded_name extra_field <<<"$checksum_line"
-            if [[ ! "$recorded_digest" =~ ^[0-9a-fA-F]{64}$ ]] || [[ "$recorded_name" != "$expected_asset_name" ]] || [[ -n "$extra_field" ]]; then
-              printf 'Checksum file %s must reference its adjacent operational CLI %s exactly once.\n' "$checksum_name" "$expected_asset_name" >&2
-              exit 1
-            fi
-            if command -v sha256sum >/dev/null 2>&1; then
-              (cd "$checksum_dir" && sha256sum --check "$checksum_name")
-            elif command -v shasum >/dev/null 2>&1; then
-              (cd "$checksum_dir" && shasum -a 256 --check "$checksum_name")
-            else
-              printf 'No SHA-256 checksum verifier is available.\n' >&2
-              exit 1
-            fi
-          done
-          require_exactly_one_file disksage.spdx.json
-          node "$GITHUB_WORKSPACE/scripts/ci/generate-release-sbom.mjs" --validate "$(find release-artifacts -type f -name 'disksage.spdx.json' -print -quit)"
-          unexpected_entry="$(find release-artifacts -mindepth 1 ! -type d ! -type f -print -quit)"
-          if [[ -n "$unexpected_entry" ]]; then
-            printf 'Unexpected release artifact entries: non-regular path %s is not publishable.\n' "$unexpected_entry" >&2
-            exit 1
-          fi
-          regular_file_count=0
-          while IFS= read -r -d ''; do regular_file_count=$((regular_file_count + 1)); done < <(find release-artifacts -type f -print0)
-          if [[ $regular_file_count -ne 18 ]]; then
-            printf 'Unexpected release artifact entries: expected exactly 18 regular files, found %s.\n' "$regular_file_count" >&2
-            exit 1
-          fi
-
       - name: Generate GitHub build provenance
         uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
@@ -369,10 +290,11 @@ jobs:
       - name: Upload attested release SBOM
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: release-sbom-${{ github.run_attempt }}
+          name: release-sbom-${{ github.run_id }}
           path: release-artifacts/sbom/disksage.spdx.json
           if-no-files-found: error
           retention-days: 7
+          overwrite: true
 
   publish-release:
     if: startsWith(github.ref, 'refs/tags/')
@@ -384,14 +306,14 @@ jobs:
       - name: Download attested release artifact set
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          pattern: release-disksage-*-${{ github.run_attempt }}
+          pattern: release-disksage-*-${{ github.run_id }}
           path: release-artifacts
           merge-multiple: false
 
       - name: Download attested release SBOM
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: release-sbom-${{ github.run_attempt }}
+          name: release-sbom-${{ github.run_id }}
           path: release-artifacts/sbom
       - name: Publish attested artifacts to GitHub Release
         uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
@@ -440,7 +362,7 @@ jobs:
           cache: true
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: 22.12.0
       - run: npm ci
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
@@ -456,7 +378,7 @@ jobs:
         shell: bash
         run: echo "CMAKE_GENERATOR=Ninja" >> "$GITHUB_ENV"
       - name: "Tauri build (GPU: CUDA [+ Vulkan on Linux] + dynamic backends)"
-        run: npm run tauri -- build --no-bundle --features "${{ matrix.features }}"
+        run: node node_modules/@tauri-apps/cli/tauri.js build --no-bundle --features "${{ matrix.features }}"
       - name: Build engine smoke-test binary
         run: cargo test --manifest-path src-tauri/Cargo.toml --release --no-run --features "${{ matrix.features }}" --lib
       - name: List built shared libs (diagnostic)

.github/workflows/test.yml

@@ -30,23 +30,36 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.run_attempt == 1 }}
+
 jobs:
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    env:
+      CARGO_BUILD_JOBS: 2
+      CARGO_INCREMENTAL: 0
+      CARGO_PROFILE_TEST_DEBUG: 0
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
       - name: Install Tauri system deps
         run: |
           sudo apt-get update
-          sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev lsof
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           workspaces: src-tauri
           cache-targets: false
+      - name: Configure private test temp
+        run: |
+          mkdir -p "$RUNNER_TEMP/disksage"
+          echo "TMPDIR=$RUNNER_TEMP/disksage" >> "$GITHUB_ENV"
       - name: Rust tests (includes unix symlink test)
         run: cargo test --manifest-path src-tauri/Cargo.toml
       - name: Headless cloud planner tests
@@ -62,7 +75,7 @@ jobs:
           cargo test --manifest-path src-tauri/Cargo.toml --features archive-cli --test archive_tree_help_exit
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20.19.0
+          node-version: 22.12.0
       - run: npm ci
       - run: npm test
       - run: npm run build
@@ -73,6 +86,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
       - name: Windows absolute-home regression
@@ -88,6 +102,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
       - name: Install build deps (llama.cpp native + tauri)
         run: |