release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  # The same release, started by hand from the Actions tab, in two flavours.
  #
  # With an empty tag it is the whole release: scripts/next-version.sh reads the
  # version off the conventional commits since the last tag, prepare-release.sh
  # bumps version.go, the Makefile, the Formula and the changelog, and the bump
  # and its tag are pushed only AFTER the gate and the six builds have passed —
  # so a failed release leaves main untouched rather than carrying a version
  # nothing was ever published for.
  #
  # With a tag it releases a version that is already committed: re-running a
  # release whose tag published before the job died, or cutting one from the UI
  # without a local checkout. check-version.sh still fails the run when that tag
  # disagrees with version.go, the Makefile or the Formula.
  #
  # Pushing a tag by hand (RELEASE.md step 2) keeps working and is unchanged.
  workflow_dispatch:
    inputs:
      tag:
        description: >-
          Leave EMPTY for a normal release — the version is read off the
          conventional commits since the last tag and bumped for you. Give a
          tag (v0.25.0) only to release a version that is already committed: an
          existing tag is rebuilt from itself, a new one is created on the
          branch selected above.
        required: false
        default: ""
        type: string
      bump:
        description: >-
          Ignored unless tag is empty. auto reads the commits (feat -> minor,
          breaking -> major, held inside 0.x until someone cuts 1.0.0);
          patch/minor/major force the level.
        required: false
        default: auto
        type: choice
        options: [auto, patch, minor, major]

permissions:
  contents: write

env:
  # Keep in lockstep with .github/workflows/ci.yml. The release gate must be the
  # same gate CI runs, not a weaker one.
  GOLANGCI_LINT_VERSION: v2.13.1

jobs:
  release:
    name: Build & Publish
    runs-on: ubuntu-latest
    # `make check` = tidy-check + lint + coverage + race + web lint/build, and the
    # cross-compile matrix follows it. CI splits that across three jobs with 25+20+15
    # minutes; this job runs all of it plus six builds.
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      # A manual run starts on the BRANCH picked in the Actions tab, not on a
      # tag. When the tag already exists — re-running a release that published
      # its tag and then failed — build from that tag: otherwise this job would
      # publish whatever main happens to be now under a tag pointing at an older
      # commit, and the assets would not be the release they claim to be. When
      # the tag is new, stay on the selected ref; the Create GitHub Release step
      # creates the tag here. fetch-depth: 0 above is what makes the tag local.
      - name: Resolve the release tag (manual runs)
        if: github.event_name == 'workflow_dispatch' && inputs.tag != ''
        env:
          TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          # Validated before it reaches git, and passed by env rather than
          # interpolated into this script.
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
            echo "::error::'${TAG}' is not a vX.Y.Z release tag (expected e.g. v0.25.0)"
            exit 1
          fi
          if git rev-parse -q --verify "refs/tags/${TAG}^{commit}" >/dev/null; then
            echo "tag ${TAG} already exists — building from it, not from ${GITHUB_REF_NAME}"
            git checkout --detach "refs/tags/${TAG}"
          else
            echo "tag ${TAG} is new — it will be created on ${GITHUB_REF_NAME} at this commit"
          fi
          git log -1 --format='building %h %s'

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: web/package-lock.json

      # An automatic release chooses its own version and commits the bump HERE,
      # in the working tree only. Nothing reaches the remote until the gate and
      # all six builds have passed — see "Publish the version bump" near the
      # end — so a release that fails partway leaves main exactly as it was,
      # rather than carrying a bump for a version nobody can download.
      #
      # next-version.sh prints only the number on stdout (its reasoning goes to
      # stderr, so it shows up in the log), and that number is then handed to
      # prepare-release.sh explicitly rather than letting it resolve `auto` a
      # second time — two resolutions of the same thing can disagree.
      #
      # --no-gate because "Run the full gate (make check)" below runs it against
      # this very tree; without it the job would run the whole gate twice and
      # never finish inside its timeout.
      - name: Choose the version and bump it (automatic releases)
        id: auto
        if: github.event_name == 'workflow_dispatch' && inputs.tag == ''
        env:
          BUMP: ${{ inputs.bump }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          set -euo pipefail
          # An automatic release pushes its bump to the branch it ran from, but
          # "Sync Homebrew formula + prebuilt binaries" below always targets the
          # default branch. From anywhere else those two land on different
          # branches, and main ends up advertising a version whose bump it never
          # received. Releasing another branch is still possible — with an
          # explicit tag, where the bump is already committed and nothing here
          # has to guess where it belongs.
          if [[ "${GITHUB_REF_NAME}" != "${DEFAULT_BRANCH}" ]]; then
            echo "::error::an automatic release (empty tag) runs from ${DEFAULT_BRANCH} only — this run is on ${GITHUB_REF_NAME}. Give an explicit tag to release another branch."
            exit 1
          fi
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          version="$(./scripts/next-version.sh --bump "$BUMP" --explain)"
          echo "selected ${version} for release"
          ./scripts/prepare-release.sh "$version" --no-gate

          # Push the bump NOW, seconds after checkout, rather than at the end.
          #
          # It used to go out after the builds, so that a failed release left the
          # branch untouched. That made every release lose a race it could not
          # win: the job takes ~40 minutes, and any push in that window — a
          # dependabot merge, an unrelated fix — made the bump un-fast-forwardable
          # and threw the whole build away. It happened on the first real run.
          #
          # Rebasing at the END instead would be worse than losing the race: the
          # binaries are built from this tree, and a rebased tag would name a
          # commit whose tree is not the one that was built. Here, before
          # anything is built, a rebase is free and honest — the gate and the
          # builds then run on exactly what was pushed.
          #
          # What this trades: a release that fails later leaves the bump on the
          # branch with no tag and no release. That state is self-healing, not
          # wreckage — the next run computes the same version, finds the files
          # already at it, and prepare-release.sh takes its tag-only path.
          pushed=0
          for attempt in 1 2 3; do
            if git push origin "HEAD:${GITHUB_REF_NAME}"; then
              pushed=1
              break
            fi
            echo "push rejected — ${GITHUB_REF_NAME} moved (attempt ${attempt}/3); rebasing the bump onto it"
            git fetch origin "${GITHUB_REF_NAME}"
            git rebase "origin/${GITHUB_REF_NAME}"
          done
          if [[ "$pushed" != 1 ]]; then
            echo "::error::could not land the version bump on ${GITHUB_REF_NAME} after 3 attempts — it is being pushed to faster than this job can rebase. Nothing has been published and no tag exists; try again when it is quieter."
            exit 1
          fi

          # A rebase moves the commit, and prepare-release.sh's tag still points
          # at where it used to be. Re-point it at what was actually pushed, so
          # the tag published later names the tree that gets built below.
          git tag -f "v${version}" HEAD
          echo "bump landed on ${GITHUB_REF_NAME} as $(git rev-parse --short HEAD)"

          echo "version=${version}" >> "$GITHUB_OUTPUT"
          echo "tag=v${version}" >> "$GITHUB_OUTPUT"

      - name: Extract version
        id: ver
        env:
          # Empty on a tag push, the dispatch input on a manual run. By env, not
          # interpolated into the script body.
          DISPATCH_TAG: ${{ inputs.tag }}
          # Set only when the step above chose the version; empty otherwise.
          AUTO_TAG: ${{ steps.auto.outputs.tag }}
        run: |
          set -euo pipefail
          # An automatic release already knows its tag. Otherwise: on a manual
          # run GITHUB_REF_NAME is the branch that was selected, so the tag has
          # to come from the input instead.
          if [[ -n "${AUTO_TAG}" ]]; then
            TAG="${AUTO_TAG}"
          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            TAG="${DISPATCH_TAG}"
          else
            TAG="${GITHUB_REF_NAME}"
          fi
          VERSION="${TAG#v}"
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
            echo "::error::tag ${TAG} is not a vX.Y.Z release tag" >&2
            exit 1
          fi
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"

      # Fail before spending 40 minutes on a build whose binaries would report a
      # version nobody asked for. This catches the classic release mistake: the
      # tag says v0.17.0, cmd/slmcode/version.go still says 0.16.0, and every
      # published artifact carries the tag in its filename and the old version
      # in `slmcode version`.
      - name: Version consistency (tag == version.go == Makefile == Formula)
        run: ./scripts/check-version.sh --tag "${{ steps.ver.outputs.tag }}"

      - name: Repo reference guard
        run: ./scripts/check-repo-refs.sh

      # NOT a bare `cd web && npm ci`. `npm ci` installs strictly from
      # package-lock.json and refuses to run when the lock does not match
      # package.json — which is exactly the state web/ is in until a regenerated
      # lock is committed. A stale lock is a reason to fix the lock, never a
      # reason for a tagged release to abort before it builds anything.
      # `make web-deps` tries `npm ci` first and falls back to `npm install`,
      # printing the fix either way.
      - name: Install web deps
        run: make web-deps

      - name: Install golangci-lint
        # `go install` (not the release install.sh + prebuilt binary) so the
        # linter is always built with the SAME Go toolchain this job just set
        # up — golangci-lint refuses to run when built with an older Go than
        # the module it's targeting, so a prebuilt binary silently breaks
        # every time the pinned toolchain in go.mod moves past it. install.sh
        # also matched the wrong release asset for v2.13.1 (grabbed the
        # .sbom.json instead of the tarball) and failed checksum verification.
        run: |
          set -euo pipefail
          go install "github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${GOLANGCI_LINT_VERSION}"
          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

      # ORDER IS LOAD-BEARING. `make ui-react` builds web/ and syncs web/dist into
      # cmd/slmcode/ui/, which is what `//go:embed all:ui` compiles into every
      # binary. It MUST run before any `go build`, or cmd/slmcode/ui/ holds nothing
      # but .gitkeep, every published binary falls back to the placeholder page
      # compiled into pkg/server, and every user who runs `slmcode studio` gets
      # "Studio not built" — with no way to fix it short of a new release. The
      # step below turns that from a silent downgrade into a failed release.
      - name: Build the Studio UI
        run: make ui-react

      # `sourcemap: 'hidden'` in web/vite.config.ts still WRITES .map files into
      # web/dist; it only suppresses the sourceMappingURL comment. `go:embed all:ui`
      # takes the directory as-is, so every release binary would carry the full TSX
      # source. Drop them after the sync and before the compile.
      - name: Strip sourcemaps from the embedded UI
        run: |
          set -euo pipefail
          find cmd/slmcode/ui -name '*.map' -print -delete

      # The same gate contributors run and the same one CI's lint-test job runs:
      # gofmt, vet, golangci-lint (blocking — golangci-lint is installed above, or
      # scripts/lint.sh silently SKIPS it), the coverage floor, -race, and the web
      # build. A release used to go out on `make lint && make test` alone, which
      # skipped the race detector, the coverage floor and the web lint.
      - name: Run the full gate (make check)
        run: make check

      # The single check that stands between this release and shipping a
      # placeholder Studio to every user. `make check` does NOT enforce it:
      # scripts/ui-check.sh treats "no build output at all" as a valid state, so
      # contributors without Node can still build — the binary then serves the
      # placeholder page compiled into pkg/server. For a RELEASE that state is
      # fatal, so this step asserts the *built* branch specifically.
      - name: Verify the real Studio UI is embedded (fatal)
        run: |
          set -euo pipefail
          ui=cmd/slmcode/ui
          fail() { echo "::error::$*"; exit 1; }

          # Shared contract first (tracked .gitkeep, no half-built tree).
          ./scripts/ui-check.sh

          [[ -f "$ui/index.html" ]] || fail "$ui/index.html is missing — 'make ui-react' did not sync web/dist. Every published binary would serve the pkg/server placeholder page."
          [[ -d "$ui/assets" ]] || fail "$ui/assets is missing — 'make ui-react' did not sync web/dist. Every published binary would serve the pkg/server placeholder page."

          # A real Vite index.html mounts #root and loads a hashed module bundle.
          grep -q 'id="root"' "$ui/index.html" \
            || fail "$ui/index.html has no <div id=\"root\"> — not a Vite build of web/"
          grep -qE '<script[^>]+src="[^"]*assets/[^"]+\.js"' "$ui/index.html" \
            || fail "$ui/index.html does not reference a built assets/*.js bundle — not a Vite build output"

          js_count="$(find "$ui/assets" -name '*.js' | wc -l | tr -d ' ')"
          [[ "$js_count" -ge 1 ]] || fail "$ui/assets contains no JavaScript bundle"
          if find "$ui" -name '*.map' | grep -q .; then
            fail "sourcemaps survived into $ui — they would ship the TSX source inside every binary"
          fi
          echo "Studio UI verified: ${js_count} JS bundle(s) under ${ui}/assets"
          ls -la "$ui" "$ui/assets"

      - name: Build release binaries
        env:
          VERSION: ${{ steps.ver.outputs.version }}
        run: |
          set -euo pipefail
          mkdir -p dist
          commit="$(git rev-parse --short HEAD)"
          built="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          # SourceRoot is stamped EMPTY on purpose. The Makefile stamps $(CURDIR)
          # for local builds so `slmcode update` can find the checkout; a release
          # binary must not carry the runner's throwaway path, or `slmcode update`
          # would try to rebuild from /home/runner/work/... on the user's machine.
          ldflags="-s -w -X main.Version=${VERSION} -X main.SourceRoot= -X main.GitCommit=${commit} -X main.BuildTime=${built}"

          build() {
            local goos="$1" goarch="$2" ext="$3"
            local out="dist/slmcode_${VERSION}_${goos}_${goarch}${ext}"
            echo "Building ${out}"
            GOOS="$goos" GOARCH="$goarch" CGO_ENABLED=0 \
              go build -trimpath -ldflags "$ldflags" -o "$out" ./cmd/slmcode
            chmod +x "$out"
          }

          # Must stay in sync with, in this order:
          #   scripts/install-remote.sh  (linux|darwin × amd64|arm64)
          #   scripts/install.ps1        (windows × amd64|arm64, with .exe)
          #   Formula/slmcode.rb         (macOS arm/intel, Linux arm/intel)
          #   cmd/slmcode/cmd_update_binary.go assetName()
          build darwin amd64 ""
          build darwin arm64 ""
          build linux amd64 ""
          build linux arm64 ""
          build windows amd64 ".exe"
          build windows arm64 ".exe"

          cp scripts/install-remote.sh dist/install.sh
          cp scripts/install.ps1 dist/install.ps1
          cp scripts/install.cmd dist/install.cmd

          (
            cd dist
            # coreutils sha256sum, not perl's shasum: same "<hex>  <name>" output,
            # one less thing that has to be present on the runner image.
            sha256sum slmcode_* install.sh install.ps1 install.cmd > SHA256SUMS
          )
          cat dist/SHA256SUMS
          ls -lah dist

      # Prove the artifact the user will download reports what the tag says, and
      # that the Studio it serves is the real SPA. Runs the native linux/amd64
      # build — the one platform this runner can execute.
      - name: Smoke-test the built binary
        env:
          VERSION: ${{ steps.ver.outputs.version }}
        run: |
          set -euo pipefail
          bin="dist/slmcode_${VERSION}_linux_amd64"
          export SLMCODE_SKIP_UPDATE_CHECK=1
          "$bin" version
          python3 - "$VERSION" <<'PY'
          import json, subprocess, sys
          version = sys.argv[1]
          bin_path = "dist/slmcode_%s_linux_amd64" % version
          info = json.loads(subprocess.check_output([bin_path, "version", "--json"]))
          problems = []
          if info.get("version") != version:
              problems.append("version is %r, expected %r" % (info.get("version"), version))
          if not info.get("commit") or info["commit"] == "unknown":
              problems.append("GitCommit was not stamped (%r)" % info.get("commit"))
          if not info.get("built") or info["built"] == "unknown":
              problems.append("BuildTime was not stamped (%r)" % info.get("built"))
          if info.get("source"):
              problems.append("SourceRoot leaked into the release binary: %r" % info["source"])
          if problems:
              for p in problems:
                  print("::error::%s" % p)
              sys.exit(1)
          print("binary reports version=%s commit=%s built=%s" % (info["version"], info["commit"], info["built"]))
          PY

      # The point of no return, and deliberately the last thing before
      # publishing: the gate has passed, the Studio UI is verified embedded, all
      # six binaries are built and the linux/amd64 one has been run and asked
      # what version it thinks it is. Only now does the tag exist.
      #
      # The bump commit itself went out at the start (see "Choose the version and
      # bump it"), because holding it until here meant losing a 40-minute race
      # with every other push to the branch. The tag is what actually publishes —
      # it is what the GitHub Release is cut from and what users download — so it
      # is the thing worth withholding until everything has proven itself. A bump
      # without a tag is a no-op that the next run absorbs.
      #
      # Unlike the branch, a tag cannot be rejected for moving: nothing else
      # creates it. The only way this fails is if the tag already exists, which
      # prepare-release.sh refuses up front.
      #
      # Pushing it here does not start a second Release run: events raised by
      # GITHUB_TOKEN do not trigger workflows. That restriction is usually a
      # nuisance; here it is what keeps one button from producing two releases.
      - name: Publish the release tag (automatic releases)
        if: steps.auto.outputs.tag != ''
        env:
          TAG: ${{ steps.auto.outputs.tag }}
        run: |
          set -euo pipefail
          git push origin "refs/tags/${TAG}"
          echo "published ${TAG} at $(git rev-parse --short HEAD)"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ steps.ver.outputs.tag }}
          name: SLMCode ${{ steps.ver.outputs.tag }}
          generate_release_notes: true
          body: |
            ## Install

            **macOS / Linux / WSL**
            ```bash
            curl -fsSL https://raw.githubusercontent.com/UnicoLab/smlcode/main/scripts/install-remote.sh | bash
            ```

            **Windows (PowerShell)**
            ```powershell
            irm https://raw.githubusercontent.com/UnicoLab/smlcode/main/scripts/install.ps1 | iex
            ```

            **Homebrew**
            ```bash
            brew install --formula https://raw.githubusercontent.com/UnicoLab/smlcode/main/Formula/slmcode.rb
            ```

            **Locked-down machine** (brew, Go and release downloads all 403)
            ```bash
            git clone --depth 1 https://github.com/UnicoLab/smlcode.git
            cd smlcode && ./scripts/install-offline.sh
            ```
            The macOS binaries ship inside the repository (`prebuilt/`), so the
            clone is the download. No Homebrew, no Go toolchain, no asset fetch.

            **Already installed**
            ```bash
            slmcode update
            ```

            ## ⚠️ Upgrading

            Per-release detail is in the
            [changelog](https://github.com/UnicoLab/smlcode/blob/main/docs/changelog.md);
            behaviour changes and the opt-back-in for each are in the
            [migration notes](https://github.com/UnicoLab/smlcode/blob/main/docs/migration.md).

            **Coming from v0.18.x or earlier?** v0.19.0 changed several defaults —
            repository hooks fail closed, `mcp_servers` is read from the user config
            layer only, the shell allowlist is tiered, `slmcode apply` is interactive,
            HITL gates block when a human is attached, and Studio requires a session
            token. Read the migration notes before upgrading.

            ## Verify what you downloaded

            ```bash
            curl -fsSLO https://github.com/UnicoLab/smlcode/releases/download/${{ steps.ver.outputs.tag }}/SHA256SUMS
            shasum -a 256 -c SHA256SUMS --ignore-missing
            ```

            [Changelog](https://github.com/UnicoLab/smlcode/blob/main/docs/changelog.md) ·
            [Migration notes](https://github.com/UnicoLab/smlcode/blob/main/docs/migration.md) ·
            [Install guide](https://github.com/UnicoLab/smlcode/blob/main/docs/install.md)

            Made with ♥ by [UnicoLab](https://unicolab.ai)
          files: |
            dist/slmcode_*
            dist/install.sh
            dist/install.ps1
            dist/install.cmd
            dist/SHA256SUMS
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # AFTER the release exists, never before: the formula's url lines point at
      # release assets, so pushing a synced formula while the upload could still
      # fail would leave main advertising a download that 404s.
      #
      # Done in a throwaway clone rather than in this checkout. This tree is a
      # detached HEAD at the tag with a build tree on top of it, so the previous
      # `git checkout -B main origin/main` in-place was one upstream edit away
      # from aborting on "local changes would be overwritten" — after the
      # binaries had already been built and with no way to resume.
      - name: Sync Homebrew formula + prebuilt binaries onto main
        env:
          VERSION: ${{ steps.ver.outputs.version }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          work="$(mktemp -d)"
          git clone --depth 1 --branch main \
            "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "$work"
          cp scripts/update-formula.sh "$work/scripts/update-formula.sh"
          cp scripts/update-prebuilt.sh "$work/scripts/update-prebuilt.sh"
          (
            cd "$work"
            bash scripts/update-formula.sh "$VERSION" "${GITHUB_WORKSPACE}/dist"
            # prebuilt/ is the offline install channel: the macOS binaries live
            # in the repository so a `git clone` delivers them on machines where
            # brew, go.dev and objects.githubusercontent.com are all blocked.
            # Refreshed from the SAME dist/ that was just published, so the
            # committed binaries are the release binaries — not a rebuild.
            bash scripts/update-prebuilt.sh "$VERSION" "${GITHUB_WORKSPACE}/dist"
            if git diff --quiet -- Formula/slmcode.rb prebuilt \
               && [ -z "$(git status --porcelain -- prebuilt)" ]; then
              echo "Formula and prebuilt/ unchanged — nothing to commit"
              exit 0
            fi
            git config user.name "github-actions[bot]"
            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
            git add Formula/slmcode.rb prebuilt
            git commit -m "chore: sync Homebrew formula + prebuilt binaries for v${VERSION} [skip ci]"
            git push origin main
          )
          rm -rf "$work"

      # Close the loop: what GitHub is actually serving must match what we built.
      # Catches a partial upload, a truncated asset, and a formula synced against
      # a dist/ that is not what landed on the release.
      - name: Verify the published assets
        env:
          VERSION: ${{ steps.ver.outputs.version }}
          TAG: ${{ steps.ver.outputs.tag }}
        run: |
          set -euo pipefail
          base="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}"
          verify="$(mktemp -d)"
          curl -fsSL --retry 5 --retry-delay 5 -o "$verify/SHA256SUMS" "$base/SHA256SUMS"
          if ! diff -u dist/SHA256SUMS "$verify/SHA256SUMS"; then
            echo "::error::the published SHA256SUMS differs from the one built here"
            exit 1
          fi
          for asset in \
            "slmcode_${VERSION}_darwin_arm64" \
            "slmcode_${VERSION}_darwin_amd64" \
            "slmcode_${VERSION}_linux_arm64" \
            "slmcode_${VERSION}_linux_amd64" \
            "slmcode_${VERSION}_windows_amd64.exe" \
            "slmcode_${VERSION}_windows_arm64.exe" \
            install.sh install.ps1 install.cmd
          do
            curl -fsSL --retry 5 --retry-delay 5 -o "$verify/$asset" "$base/$asset"
          done
          ( cd "$verify" && sha256sum -c SHA256SUMS )
          echo "All published assets match SHA256SUMS."
          rm -rf "$verify"