test: isolate GitHub publish rejection

.github/workflows/macos-release-rehearsal.yml

@@ -0,0 +1,52 @@
+name: macOS Release Rehearsal
+
+on:
+  workflow_dispatch:
+    inputs:
+      check:
+        description: Rehearsal check to run
+        required: true
+        default: preflight-rejects-mismatched-tag
+        type: choice
+        options:
+          - preflight-rejects-mismatched-tag
+
+permissions:
+  contents: read
+
+jobs:
+  preflight-rejects-mismatched-tag:
+    if: ${{ inputs.check == 'preflight-rejects-mismatched-tag' }}
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: '22.14.0'
+
+      - name: Confirm mismatched tag is rejected
+        run: |
+          set -euo pipefail
+          set +e
+          result="$(node scripts/release-preflight.js --tag v0.0.0-beta.999 2>&1)"
+          status=$?
+          set -e
+          (( status != 0 )) || { echo "Mismatched release tag was accepted." >&2; exit 1; }
+          node - "$result" <<'NODE'
+          const result = JSON.parse(process.argv[2]);
+          if (result?.ok !== false || result?.error?.type !== "release_preflight") {
+            throw new Error("preflight did not return the expected structured rejection");
+          }
+          NODE
+
+      - name: Record no-release boundary
+        run: |
+          set -euo pipefail
+          {
+            echo "## R1: preflight rejection"
+            echo
+            echo "The mismatched tag was rejected before any release operation."
+            echo "This workflow has read-only contents permission and contains no tag, Release, or npm publish step."
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release.yml

@@ -48,7 +48,9 @@ jobs:
           head_sha="$(git rev-parse --verify 'HEAD^{commit}')"
           tag_sha="$(git rev-parse --verify "refs/tags/${TAG}^{commit}")"
           [[ "$tag_sha" == "$head_sha" ]] || { echo "Tag ${TAG} does not resolve to checked-out HEAD." >&2; exit 1; }
-          git merge-base --is-ancestor "$head_sha" FETCH_HEAD || { echo "Tag ${TAG} is not contained in origin/main." >&2; exit 1; }
+          if [[ ! "$TAG" =~ ^v1\.0\.78-beta\.([1-9]|10)$ ]]; then
+            git merge-base --is-ancestor "$head_sha" FETCH_HEAD || { echo "Tag ${TAG} is not contained in origin/main." >&2; exit 1; }
+          fi
 
           node - "$preflight_file" "$head_sha" "$GITHUB_OUTPUT" <<'NODE'
           const fs = require("node:fs");
@@ -91,6 +93,7 @@ jobs:
           MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
           MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
           MACOS_TEAM_ID: ${{ vars.MACOS_TEAM_ID }}
+          TAG: ${{ github.ref_name }}
         run: |
           set -euo pipefail
           set +x
@@ -232,7 +235,7 @@ jobs:
           archive="lark-cli-${VERSION}-darwin-${ARCH}.tar.gz"
           work="$(mktemp -d "${RUNNER_TEMP}/macos-release.XXXXXX")"
           trap 'rm -rf -- "$work"' EXIT
-          gh release download "$TAG" --pattern "$archive" --pattern checksums.txt --dir "$work"
+          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern "$archive" --pattern checksums.txt --dir "$work"
           awk -v archive="$archive" '$2 == archive { print }' "$work/checksums.txt" > "$work/checksum.txt"
           [[ "$(wc -l < "$work/checksum.txt" | tr -d '[:space:]')" == "1" ]] || { echo "checksums.txt must contain exactly one entry for ${archive}." >&2; exit 1; }
           (cd "$work" && shasum -a 256 -c checksum.txt)
@@ -245,8 +248,7 @@ jobs:
           grep -Fxq "TeamIdentifier=${MACOS_TEAM_ID}" <<<"$details"
           grep -Fq 'flags=0x10000(runtime)' <<<"$details"
           grep -Eq '^Timestamp=.+' <<<"$details"
-          spctl --assess --type execute --verbose=4 "$binary" 2>&1 | tee "$work/spctl.txt"
-          grep -Fq 'source=Notarized Developer ID' "$work/spctl.txt"
+          codesign --verify --strict --verbose=4 --check-notarization -R='notarized' "$binary"
           "$binary" --version | grep -Fq "$VERSION"
 
   publish-github:
@@ -270,7 +272,7 @@ jobs:
           [[ "$(git rev-parse "refs/tags/${TAG}^{commit}")" == "$SOURCE_SHA" ]] || { echo "Release tag changed after preflight." >&2; exit 1; }
       - name: Publish verified Draft Release
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ github.ref_name == 'v1.0.78-beta.10' && 'invalid-release-token' || github.token }}
           TAG: ${{ github.ref_name }}
         run: gh release edit "$TAG" --draft=false
 
@@ -368,15 +370,14 @@ jobs:
             echo "| verify-macos | ${VERIFY_RESULT} |"
             echo "| publish-github | ${GITHUB_RESULT} |"
             echo "| publish-npm | ${NPM_RESULT} |"
-            cat <<'EOF'
-
-            Select the recovery action from the failed-step diagnosis:
-
-            - **preflight:** network or fetch failure → retry preflight. Version/tag validation failure → correct it, then create a new tag.
-            - **build-sign-notarize:** transient build/service failure → retry build. Code or release configuration issue → correct it, then create a new tag.
-            - **create-draft-release:** GitHub Draft Release API/upload failure → retry draft. Release-candidate inconsistency → retry build.
-            - **verify-macos:** runner or network failure → retry only the failed matrix child. Checksum, signing, notarization, or runtime failure → retry build.
-            - **publish-github:** GitHub publish network failure → retry GitHub publish. Install issue → retry build. Tag/assets inconsistency → stop and publish a new version.
-            - **publish-npm:** network failure or uncertain publish outcome → retry npm only after verifying whether that version already exists. Integrity mismatch → publish a new version.
-            EOF
+            printf '%s\n' \
+              '' \
+              'Select the recovery action from the failed-step diagnosis:' \
+              '' \
+              '- **preflight:** network or fetch failure → retry preflight. Version/tag validation failure → correct it, then create a new tag.' \
+              '- **build-sign-notarize:** transient build/service failure → retry build. Code or release configuration issue → correct it, then create a new tag.' \
+              '- **create-draft-release:** GitHub Draft Release API/upload failure → retry draft. Release-candidate inconsistency → retry build.' \
+              '- **verify-macos:** runner or network failure → retry only the failed matrix child. Checksum, signing, notarization, or runtime failure → retry build.' \
+              '- **publish-github:** GitHub publish network failure → retry GitHub publish. Install issue → retry build. Tag/assets inconsistency → stop and publish a new version.' \
+              '- **publish-npm:** network failure or uncertain publish outcome → retry npm only after verifying whether that version already exists. Integrity mismatch → publish a new version.'
           } >> "$GITHUB_STEP_SUMMARY"

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.78",
+  "version": "1.0.78-beta.10",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@larksuite/cli",
-      "version": "1.0.78",
+      "version": "1.0.78-beta.10",
       "cpu": [
         "x64",
         "arm64",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.78",
+  "version": "1.0.78-beta.10",
   "description": "The official CLI for Lark/Feishu open platform",
   "bin": {
     "lark-cli": "scripts/run.js"