From 84642c2b87a943e2d09018c940179d69b7c4f088 Mon Sep 17 00:00:00 2001
From: bigboateng <bigboateng2011@gmail.com>
Date: Sun, 26 Jul 2026 18:53:39 +0100
Subject: [PATCH] ci: release workflow fixes (syft, GITHUB_TOKEN, v-strip,
 tagged bindings)

---
 .github/workflows/release.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ed6b385..9dcccce 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,6 +38,10 @@ jobs:
           service_account: ${{ vars.DEPLOYER_SA_EMAIL }}
       - uses: google-github-actions/setup-gcloud@v2
 
+      # goreleaser's `sboms` block shells out to syft; install it so the SBOM step succeeds.
+      - name: install syft (SBOM)
+        uses: anchore/sbom-action/download-syft@v0
+
       # google-github-actions/auth writes gha-creds-*.json into the workspace; exclude it so
       # goreleaser's clean-tree check does not fail with "git is in a dirty state".
       - name: keep the tree clean for goreleaser
@@ -61,7 +65,7 @@ jobs:
       - name: publish binaries -> Artifact Registry (generic)
         run: |
           set -euo pipefail
-          VER="${GITHUB_REF_NAME}"
+          VER="${GITHUB_REF_NAME#v}"   # strip the leading v; goreleaser archives are named without it
           for f in dist/interlock_*.tar.gz dist/interlock_*.zip dist/checksums.txt; do
             [ -e "$f" ] || continue
             gcloud artifacts generic upload \
@@ -73,7 +77,7 @@ jobs:
       - name: update latest channel manifest
         run: |
           set -euo pipefail
-          printf '{"version":"%s"}\n' "${GITHUB_REF_NAME}" > latest.json
+          printf '{"version":"%s"}\n' "${GITHUB_REF_NAME#v}" > latest.json
           gcloud artifacts generic upload \
             --project="${{ vars.AR_PROJECT }}" --location="${{ vars.AR_LOCATION }}" \
             --repository="${{ vars.AR_GENERIC_REPO }}" \
@@ -83,6 +87,7 @@ jobs:
         working-directory: clients/typescript
         run: |
           set -euo pipefail
+          npm version "${GITHUB_REF_NAME#v}" --no-git-tag-version --allow-same-version
           gcloud artifacts print-settings npm \
             --project="${{ vars.AR_PROJECT }}" --location="${{ vars.AR_LOCATION }}" \
             --repository="${{ vars.AR_NPM_REPO }}" --scope=@operatorstack > .npmrc
@@ -93,6 +98,7 @@ jobs:
         working-directory: clients/python
         run: |
           set -euo pipefail
+          sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml
           pip install --quiet build twine keyrings.google-artifactregistry-auth
           python -m build
           twine upload \