ci: verify signed packages before protected draft publication

.github/workflows/build.yml

@@ -1,4 +1,4 @@
-name: Cross-platform build
+name: Cross-platform build (disposable signatures)
 
 on:
   workflow_dispatch:
@@ -8,36 +8,50 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: build-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    name: ${{ matrix.name }}
+    name: CI test bundle / ${{ matrix.platform }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - name: Linux x64
+          - platform: linux-x86_64
             os: ubuntu-22.04
-            args: --bundles appimage,deb
-          - name: Windows x64
+            target: x86_64-unknown-linux-gnu
+            bundles: appimage,deb
+          - platform: windows-x86_64
             os: windows-2022
-            args: --bundles nsis,msi
-          - name: macOS Apple Silicon
+            target: x86_64-pc-windows-msvc
+            bundles: nsis,msi
+          - platform: darwin-aarch64
             os: macos-15
-            args: --target aarch64-apple-darwin --bundles dmg
-          - name: macOS Intel
+            target: aarch64-apple-darwin
+            bundles: dmg,app
+          - platform: darwin-x86_64
             os: macos-15-intel
-            args: --target x86_64-apple-darwin --bundles dmg
-
+            target: x86_64-apple-darwin
+            bundles: dmg,app
     runs-on: ${{ matrix.os }}
-
+    defaults:
+      run:
+        shell: bash
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 22
           cache: npm
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
       - uses: dtolnay/rust-toolchain@stable
-      - name: Install Linux system dependencies
+        with:
+          targets: ${{ matrix.target }}
+      - name: Install Linux desktop dependencies
         if: runner.os == 'Linux'
         run: |
           sudo apt-get update
@@ -45,29 +59,19 @@ jobs:
       - run: npm ci
       - run: npm test
       - run: cargo test --locked --manifest-path src-tauri/Cargo.toml
-      - run: npm run tauri:build -- ${{ matrix.args }}
-      - name: Upload Windows installers
-        if: runner.os == 'Windows'
-        uses: actions/upload-artifact@v4
+      - run: cargo build --locked --release --manifest-path scripts/release-verifier/Cargo.toml
+      - run: python -m unittest discover -s scripts -p 'release_test.py' -v
+      - name: Generate disposable CI key (never a production secret)
+        run: |
+          python scripts/release.py ci-key --directory "$RUNNER_TEMP/ci-updater"
+          python -c "import json,os; open(os.environ['GITHUB_ENV'],'a').write('RELEASE_VERSION='+json.load(open('package.json'))['version']+'\n')"
+      - name: Build packages and updater bundles
+        run: npm run tauri:build -- --ci --target '${{ matrix.target }}' --bundles '${{ matrix.bundles }}' --config "$RUNNER_TEMP/ci-updater/updater-build.json"
+      - name: Collect and verify every test bundle
+        run: python scripts/release.py collect --bundle 'src-tauri/target/${{ matrix.target }}/release/bundle' --directory ci-packages --platform '${{ matrix.platform }}' --version "$RELEASE_VERSION"
+      - uses: actions/upload-artifact@v4
         with:
-          name: shacraft-launcher-windows-x64
+          name: CI-NOT-FOR-RELEASE-${{ matrix.platform }}
           if-no-files-found: error
-          path: |
-            src-tauri/target/release/bundle/nsis/*.exe
-            src-tauri/target/release/bundle/msi/*.msi
-      - name: Upload Linux packages
-        if: runner.os == 'Linux'
-        uses: actions/upload-artifact@v4
-        with:
-          name: shacraft-launcher-linux-x64
-          if-no-files-found: error
-          path: |
-            src-tauri/target/release/bundle/appimage/*.AppImage
-            src-tauri/target/release/bundle/deb/*.deb
-      - name: Upload macOS package
-        if: runner.os == 'macOS'
-        uses: actions/upload-artifact@v4
-        with:
-          name: shacraft-launcher-${{ matrix.name == 'macOS Apple Silicon' && 'macos-arm64' || 'macos-x64' }}
-          if-no-files-found: error
-          path: src-tauri/target/*/release/bundle/dmg/*.dmg
+          retention-days: 7
+          path: ci-packages/*