From 7fd7401c368d83fea1700ac5597a91f4a538cc78 Mon Sep 17 00:00:00 2001
From: rockbenben <qingwhat@gmail.com>
Date: Tue, 20 Oct 2026 19:16:58 +0800
Subject: [PATCH] chore(ci): confirm the release is the latest one before the
 job ends
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The release is created published, so the pointer normally moves on its own. That
is not guaranteed, though: publishing a draft does not make GitHub recompute
which release is the latest one, and that is exactly what happened on rclone-deck
with v0.1.1 — the release looked published, the pointer still pointed at the
previous version, and the updater endpoint answered 404, so no installed app
was ever offered the new build.

The step every other release path in this account now ends with does three
things: publish the release, mark it as the latest one, and read the API back to
confirm the pointer moved. A mismatch fails the job instead of leaving the
update feed on the old version.
---
 .github/workflows/ci.yml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 850efb3..7acd4ba 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -183,6 +183,39 @@ jobs:
           # while the release page shows each asset's actual size right next to its download button.
           body_path: release-body.md
           generate_release_notes: true
+      # 把 release 发布出去，并显式把 `releases/latest` 指到它，然后自己确认一遍。
+      #
+      # ⚠️ **显式给 make_latest 不是多此一举**：GitHub 在「草稿转成已发布」时**不会**重算
+      # `releases/latest` 指向谁。2026-10-20 在 rclone-deck 上撞到过一次：release 已经是
+      # `draft=false`、`prerelease=false`、`published_at` 也填上了，`releases/latest` 却仍
+      # 返回旧版本，端点 `releases/latest/download/latest.json` 于是 404（旧 release 里没有
+      # 那个文件）——已装的应用从此收不到更新。
+      #
+      # 判据是**看 API 指到谁**，不是看 release 的字段：字段全对而指针没挪，端点照样 404。
+      # CDN 那层重定向会再滞后几分钟，属正常——这里判 API，不判 CDN。
+      - name: 发布这个 release，并把 latest 指到它
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME}"
+          # ⚠️ **不能用 `releases/tags/<tag>` 找这条 release**：那个端点**不返回草稿**。
+          # 草稿只能从 release 列表里捞——列表按创建时间倒序，新建的草稿总在第一页。
+          id="$(gh api "repos/${GITHUB_REPOSITORY}/releases?per_page=100" \
+                 --jq "first(.[] | select(.tag_name == \"${tag}\") | .id)")"
+          if [ -z "$id" ]; then
+            echo "::error::没找到 tag ${tag} 对应的 release"
+            exit 1
+          fi
+          gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${id}" \
+            -F draft=false -f make_latest=true > /dev/null
+          latest="$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq .tag_name)"
+          if [ "$latest" != "$tag" ]; then
+            echo "::error::releases/latest 指着 ${latest}，不是 ${tag}"
+            exit 1
+          fi
+          echo "release ${tag} 已发布，releases/latest 指向它"
 
       # --- winget ------------------------------------------------------------------------------
       # NOT WIRED UP YET, and the order matters: `wingetcreate new` has to download a real asset to