[david-crespo]

I saw actions/runner-images#15228 and went looking for our workflows where it matters. The macOS runner images still trust the compromised eMudhra CAs, so actions/checkout on macOS can be intercepted, and it sends GITHUB_TOKEN. In most of our repos that token is read-only on a public repo, so it's not worth much. This release workflow is the exception: our macos-15 and macos-15-intel jobs run with contents: write.

This PR builds on all four OSes with a read-only token and uploads the binaries as artifacts. A single release job on Ubuntu, which isn't affected, is the only one with write access, and it publishes all four. The other download that could have mattered is the toolchain, but a probe (#603) showed rustup on all four macOS images rejects the chain as revoked.

I haven't run the new workflow yet. It only runs on version tags or when a PR has the release-test label, so adding the label here should produce a draft v0.0.0-pre+<sha> release with all four binaries.

[david-crespo]

@claude review

[claude]

I reviewed this PR and didn't find any bugs. It changes which job in the release pipeline gets contents: write, and the description says the new workflow hasn't run yet, so a human should still look it over and check the first release-test run.

What was reviewed:

• Permissions: the builds now use the workflow-level contents: read token with persist-credentials: false. Only the Ubuntu release job gets write access.
• Artifact handoff: each build uploads its artifact under its own name (matrix.artifact), with if-no-files-found: error. The release job downloads them all with merge-multiple: true, and dist/* picks up all four binaries. The release action talks to the API, so the release job doesn't need a checkout.
• Gating and tags: the release job is skipped whenever the build is skipped, because of needs. The tag step behaves the same after the move. One behavior change: if any build fails, nothing is published, where before the other OSes could still publish their binaries.

Extended reasoning...

Only .github/workflows/release.yml changes. The single release matrix job is split into a read-only build matrix and one Ubuntu job that downloads the artifacts and publishes them with contents: write. The change touches CI token permissions and how release binaries are published, which is security-sensitive. The new actions are pinned by SHA and the logic looks right, but the change is about permissions and the author says the workflow hasn't run yet, so a human look is worthwhile.

[notpeter]

Cool. I added the release-test tag -- which creates an unpublished pre-release GitHub release to exercise the workflow. This appears to have been successful and created binaries as expected.
https://github.com/oxidecomputer/rfd-api/releases/tag/untagged-133b6d43905639d855c7

We can safely delete these release(s) whenever we're done with testing.