From b2abcdcc121214660db6f0c9dbec8b262cf75b4f Mon Sep 17 00:00:00 2001
From: Ammar <ammar+ai@ammar.io>
Date: Mon, 17 Nov 2025 12:56:12 -0600
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=A4=96=20fix:=20unblock=20release=20w?=
 =?UTF-8?q?orkflow?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- allow manual dispatch on tag refs
- harden VSCE publish guard

_Generated with _
---
 .github/workflows/release.yml | 36 ++++++++++++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7ae329ba3..09da8b413 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,13 +3,36 @@ name: Release
 on:
   release:
     types: [published]
+  workflow_dispatch:
 
 permissions:
   contents: write # Required for electron-builder to upload release assets
 
+env:
+  RELEASE_TAG: ${{ github.event.release.tag_name || github.ref_name }}
+
 jobs:
+  preflight:
+    name: Validate release target
+    runs-on: ubuntu-latest
+    steps:
+      - name: Ensure release tag context
+        run: |
+          if [ -z "$RELEASE_TAG" ]; then
+            echo "::error::RELEASE_TAG is empty. Ensure this workflow runs on a release event or refs/tags/* ref."
+            exit 1
+          fi
+
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [[ "$GITHUB_REF" != refs/tags/* ]]; then
+            echo "::error::workflow_dispatch runs must target a tag ref. Current ref: $GITHUB_REF"
+            exit 1
+          fi
+
+          echo "Publishing tag $RELEASE_TAG"
+
   build-macos:
     name: Build and Release macOS
+    needs: preflight
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-macos-15' || 'macos-latest' }}
     steps:
       - name: Checkout code
@@ -38,6 +61,7 @@ jobs:
 
   build-linux:
     name: Build and Release Linux
+    needs: preflight
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-16' || 'ubuntu-latest' }}
     steps:
       - name: Checkout code
@@ -57,6 +81,7 @@ jobs:
 
   build-vscode-extension:
     name: Build and Release VS Code Extension
+    needs: preflight
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-16' || 'ubuntu-latest' }}
     steps:
       - name: Checkout code
@@ -72,20 +97,25 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release upload ${{ github.event.release.tag_name }} \
+          gh release upload "$RELEASE_TAG" \
             vscode/mux-*.vsix \
             --clobber
 
       - name: Publish to VS Code Marketplace
-        if: ${{ secrets.VSCE_PAT != '' }}
         working-directory: vscode
         env:
           VSCE_PAT: ${{ secrets.VSCE_PAT }}
         run: |
-          bunx vsce publish -p $VSCE_PAT
+          if [ -z "$VSCE_PAT" ]; then
+            echo "VSCE_PAT secret is not set; skipping VS Code Marketplace publish."
+            exit 0
+          fi
+
+          bunx vsce publish -p "$VSCE_PAT"
 
   build-windows:
     name: Build and Release Windows
+    needs: preflight
     runs-on: windows-latest
     steps:
       - name: Checkout code

From 609ca3c150d25f736aafaac586c83235a25ba8fb Mon Sep 17 00:00:00 2001
From: Ammar <ammar+ai@ammar.io>
Date: Mon, 17 Nov 2025 13:02:06 -0600
Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=A4=96=20fix:=20gate=20VSIX=20upload?=
 =?UTF-8?q?=20on=20release?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- wait for a release object before gh upload
- ensure vscode job runs after mac electron-builder publishes

_Generated with _
---
 .github/workflows/release.yml | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 09da8b413..769cb9cd7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -81,7 +81,9 @@ jobs:
 
   build-vscode-extension:
     name: Build and Release VS Code Extension
-    needs: preflight
+    needs:
+      - preflight
+      - build-macos
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-16' || 'ubuntu-latest' }}
     steps:
       - name: Checkout code
@@ -93,6 +95,23 @@ jobs:
 
       - uses: ./.github/actions/build-vscode-extension
 
+      - name: Wait for GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          for attempt in $(seq 1 30); do
+            if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+              echo "Release $RELEASE_TAG is available"
+              exit 0
+            fi
+
+            echo "Release $RELEASE_TAG not found yet (attempt $attempt/30); waiting 10s..."
+            sleep 10
+          done
+
+          echo "::error::Timed out waiting for release $RELEASE_TAG"
+          exit 1
+
       - name: Upload VS Code extension to release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}