Skip to content

Releasing: attach the source tarball as a release asset #411

Description

@Bronek

Bazel Central Registry validation rejects GitHub's autogenerated /archive/refs/tags/ tarballs as unstable source URLs; only /releases/download/ assets are accepted as checksum-stable. For v0.1.0 this was retrofitted after the BCR presubmit failed (bazelbuild/bazel-central-registry#10306): functional-0.1.0.tar.gz, byte-identical to the autogenerated tarball, was uploaded to the existing release.

CONTRIBUTING ## Releasing should make this part of every release, so the BCR submission can point at the asset URL from the start. Simplest form, as a step after publishing the Release: download https://github.com/libfn/functional/archive/refs/tags/v<version>.tar.gz, verify its contents against the tag tree, rename to functional-<version>.tar.gz, and gh release upload v<version> it. Re-uploading the autogenerated bytes keeps the sha256/SHA512 already pinned by other registries valid for the same file.

Alternatively the single-header.yml publish job could attach (and attest) the tarball automatically on release: published, alongside libfn-v<version>.hpp.

Assisted-by: Claude:claude-fable-5

Metadata

Metadata

Assignees

No one assigned

    Labels

    documentationImprovements or additions to documentation

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions