Fix Linux artifact acceptance under pipefail

Author: gitcommit90

.github/workflows/release-acceptance.yml

@@ -83,8 +83,8 @@ jobs:
           tar -xOf "dist/accept/1Helm-$version-linux-node.tgz" "$root/resources/source-build.json" > dist/accept/source-build.json
           test "$(jq -r .version dist/accept/source-build.json)" = "$version"
           test "$(jq -r .commit dist/accept/source-build.json)" = "$commit"
-          tar -tzf "dist/accept/1Helm-$version-linux-node.tgz" | grep -qx "$root/src/server/index.ts"
-          tar -tzf "dist/accept/1Helm-$version-linux-node.tgz" | grep -qx "$root/node_modules/node-pty/build/Release/pty.node"
+          grep -Fqx "$root/src/server/index.ts" dist/accept/archive-files.txt
+          grep -Fqx "$root/node_modules/node-pty/build/Release/pty.node" dist/accept/archive-files.txt
           printf 'Accepted exact Linux package for %s %s\n' "$version" "$commit" > dist/accept/linux-acceptance.txt
           node scripts/release-stage-evidence.mjs create linux-acceptance "$version" "$commit" \
             dist/accept/linux-acceptance-evidence.json dist/accept/linux-acceptance.txt "dist/accept/1Helm-$version-linux-node.tgz"

test/release-workflows.mjs

@@ -17,6 +17,7 @@ test("release pipeline has durable retry boundaries instead of one monolithic ru
   assert.match(read("release-mac-build.yml"), /ci_run_id/);
   assert.match(read("release-acceptance.yml"), /run-id:.*build_run_id/);
   assert.doesNotMatch(read("release-acceptance.yml"), /package:dmg:release|package:linux/, "acceptance must not rebuild artifacts");
+  assert.doesNotMatch(read("release-acceptance.yml"), /tar -tzf.*\| grep -q/, "archive checks must not trigger tar SIGPIPE under pipefail");
   assert.doesNotMatch(read("release-publish.yml"), /npm ci|package:|notarytool/, "publication must consume, not rebuild");
   assert.doesNotMatch(read("release-public-verify.yml"), /npm ci|package:|notarytool/, "public verification must consume, not rebuild");
 });