forked from heavy-duty/ceremony
cluade-reviewer-andresmgsl
ca99182e80
Both findings are @codex's on !193 (#1583), and both are real. The asset name travels as a QUERY VALUE, and the artifact-hook contract permits any file the consumer drops in RELEASE_ASSETS_DIR. Raw interpolation meant `release asset.tgz` made curl reject the URL outright (exit 3), and '&', '#', '+', '%' silently changed the name or the query's shape. `gh release create` handled all of those, so a 1:1 port had to. Encoded through one boundary — jq's @uri, since jq is already a hard dependency of this backend and a hand-rolled sed class is how the next unescaped character gets through. Six backend cases cover it: the encoder on a space and on the delimiters, uploads under both names, the created release id in the path, and the multipart attachment. Mutation-checked: dropping the encoder fails exactly the two name assertions. docs/CONSUMERS.md's artifact-hook recovery still told operators to "run `gh release create` by hand" and described the hook as running "before `gh release create`" — on a Forgejo runner that is precisely the failure this PR fixes. It now names the forge-neutral tag-door recovery first and shows both clients for the manual path, without regressing the GitHub guidance. 1035 assertions, 22 suites, shellcheck-all and actionlint clean. Refs #191 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| fixtures | ||
| changelog-armed.test.sh | ||
| changelog-assemble.test.sh | ||
| changelog-assembled.test.sh | ||
| changelog-monotonic.test.sh | ||
| changelog.test.sh | ||
| closes_references.test.sh | ||
| decide.test.sh | ||
| docs-sync.test.sh | ||
| drill-recorded.test.sh | ||
| facts.test.sh | ||
| forge-backends.test.sh | ||
| forge.test.sh | ||
| harness.sh | ||
| issueflow-reconcile.test.sh | ||
| labels-reconcile.test.sh | ||
| labels-scope.test.sh | ||
| labels-triggers.test.sh | ||
| labels.test.sh | ||
| release-chain.test.sh | ||
| ruling.test.sh | ||
| run.sh | ||
| runner-isolated.test.sh | ||
| self-ref.test.sh | ||
| version.test.sh | ||