Actions pinned to full commits, no token left in the checkout, no binaries
from a fork's pull request among the artifacts, the version passed through the
environment, an audit of the NuGet packages, time limits, one release at a
time with checksums and never over another commit's release, and Dependabot
for the actions and packages.
The stable channel compares versions; the testing channel offers the staging
build of another commit. The channel switch is the starter's only, not the
simulator's.
download-artifact unpacks a zip it detects, so the Windows package arrived in
dist/ as loose files (Starter.exe, the native dlls, startercfg/) and gh tried
to upload the startercfg directory as a release asset. skip-decompress leaves
the artifact as the file it was uploaded as.
The two packages are also named explicitly instead of globbing dist/*, so a
missing one fails the step rather than quietly publishing half a release.
The packages are uploaded with archive: false, and non-zipped artifacts can
only be fetched by v8 of download-artifact - v7 fetched the first one, then
failed the run with "Unable to download and extract artifact".
Workflow artifacts can only be downloaded by signed-in users with access to
the repository, so they are useless for handing a build to anyone else. After
the matrix publishes, a release job recreates a rolling pre-release from the
same packages; its assets are downloadable without an account:
releases/download/latest/<file> from main
releases/download/staging/<file> from staging
Each branch owns its tag, so a staging build never overwrites the main one.
The release is deleted and created again rather than edited, so the tag
follows its branch and assets from an older build do not linger. Write access
is granted to that job only, the workflow default stays read.
