From 3dd2b9b37f01b33b9ff7ed085d199e6b46bfeab8 Mon Sep 17 00:00:00 2001
From: Long Ho <holevietlong@gmail.com>
Date: Sun, 23 Aug 2026 18:05:53 +0700
Subject: [PATCH] fix(bazel): publish stable BCR release archives

---
 .github/workflows/bcr.yml                 |  3 +++
 .github/workflows/cli-release.yml         | 17 +++++++++++++++++
 .github/workflows/publish-bcr.yml         |  5 -----
 bcr/modules/codescythe/0.10.1/source.json |  6 +++---
 4 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/bcr.yml b/.github/workflows/bcr.yml
index a7d1b44..df51f0a 100644
--- a/.github/workflows/bcr.yml
+++ b/.github/workflows/bcr.yml
@@ -58,6 +58,9 @@ jobs:
             const crypto = require("node:crypto");
             const root = process.argv[1];
             const source = JSON.parse(fs.readFileSync(`${root}/source.json`));
+            if (!source.url.includes("/releases/download/")) {
+              throw new Error(`BCR source URL is not a stable release asset: ${source.url}`);
+            }
             for (const [name, expected] of Object.entries(source.overlay)) {
               const content = fs.readFileSync(`${root}/overlay/${name}`);
               const actual = `sha256-${crypto.createHash("sha256").update(content).digest("base64")}`;
diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml
index f9e8436..e12e03a 100644
--- a/.github/workflows/cli-release.yml
+++ b/.github/workflows/cli-release.yml
@@ -157,6 +157,9 @@ jobs:
     if: ${{ (github.event_name == 'release' && startsWith(github.event.release.tag_name, 'codescythe_cli_v')) || (github.event_name == 'workflow_dispatch' && inputs.dry_run == false && startsWith(github.ref_name, 'codescythe_cli_v')) }}
 
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
       - name: Download release artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
@@ -175,6 +178,19 @@ jobs:
           rm -rf release
           mv release-assets release
 
+      - name: Create deterministic source archive
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name || github.ref_name }}
+        run: |
+          set -euo pipefail
+
+          version="${RELEASE_TAG#codescythe_cli_v}"
+          git archive \
+            --format=tar.gz \
+            --prefix="codescythe-$version/" \
+            --output="release/codescythe-$version.tar.gz" \
+            HEAD
+
       - name: Generate checksums
         run: |
           set -euo pipefail
@@ -199,6 +215,7 @@ jobs:
             release/codescythe-darwin-arm64 \
             release/codescythe-linux-amd64 \
             release/codescythe-linux-arm64 \
+            "release/codescythe-${RELEASE_TAG#codescythe_cli_v}.tar.gz" \
             release/checksums.txt \
             --clobber
 
diff --git a/.github/workflows/publish-bcr.yml b/.github/workflows/publish-bcr.yml
index b0ed1e4..4c9d47b 100644
--- a/.github/workflows/publish-bcr.yml
+++ b/.github/workflows/publish-bcr.yml
@@ -103,11 +103,6 @@ jobs:
               -f base=main \
               -f body='Publish the Codescythe binary toolchain overlay.' \
               --jq .html_url)"
-            pr_number="${pr_url##*/}"
-            gh api \
-              --method POST \
-              "repos/bazelbuild/bazel-central-registry/issues/$pr_number/comments" \
-              -f body='@bazel-io skip_check unstable_url'
           fi
 
           echo "$pr_url" >> "$GITHUB_STEP_SUMMARY"
diff --git a/bcr/modules/codescythe/0.10.1/source.json b/bcr/modules/codescythe/0.10.1/source.json
index 17a57f1..d0b7224 100644
--- a/bcr/modules/codescythe/0.10.1/source.json
+++ b/bcr/modules/codescythe/0.10.1/source.json
@@ -1,7 +1,7 @@
 {
-  "url": "https://github.com/perplexityai/codescythe/archive/refs/tags/codescythe_cli_v0.10.1.tar.gz",
-  "integrity": "sha256-LeLiBjtSWW/tQVXOAa6eDQI4MmBolxIYtc0ukRCW5lQ=",
-  "strip_prefix": "codescythe-codescythe_cli_v0.10.1",
+  "url": "https://github.com/perplexityai/codescythe/releases/download/codescythe_cli_v0.10.1/codescythe-0.10.1.tar.gz",
+  "integrity": "sha256-mKQPdgSfVckSHFgTq4dbDkhMi7Mw8CXhuDW65XS5Vdk=",
+  "strip_prefix": "codescythe-0.10.1",
   "overlay": {
     "BUILD.bazel": "sha256-Xvy9R+IqlTF1S7QTvE0DEDgB9LUSrQJiFMVGlo5Ymns=",
     "MODULE.bazel": "sha256-DF6Qg9DJ35CrEQuQU84KFDdiUf7Bb294pRgKENiX0Uk=",