From b244748217ccfd005ee9701030612efe0ae8d0a6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20Flor=C3=AAncio?= <carlosmflorencio@gmail.com>
Date: Tue, 24 Feb 2026 11:30:44 +0000
Subject: [PATCH] fix: make github release atomic

---
 .github/workflows/release.yml | 43 ++++++++++++++++++++++++++++++++---
 apps/cli/README_internal.md   |  2 ++
 2 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d6cbb4a6b9..09f074295d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -104,9 +104,46 @@ jobs:
           tar -czf "kandev-${{ matrix.platform }}.tar.gz" kandev
           shasum -a 256 "kandev-${{ matrix.platform }}.tar.gz" > "kandev-${{ matrix.platform }}.tar.gz.sha256"
 
-      - name: Upload release assets
+      - name: Upload bundle artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: bundle-${{ matrix.platform }}
+          path: |
+            dist/kandev-${{ matrix.platform }}.tar.gz
+            dist/kandev-${{ matrix.platform }}.tar.gz.sha256
+
+  publish-release:
+    needs: build-bundles
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download bundle artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: bundle-*
+          path: dist/release-assets
+          merge-multiple: true
+
+      - name: Verify release assets
+        run: |
+          set -euo pipefail
+          required_platforms=(linux-x64 linux-arm64 macos-x64 macos-arm64 windows-x64)
+          for platform in "${required_platforms[@]}"; do
+            archive="dist/release-assets/kandev-${platform}.tar.gz"
+            checksum="${archive}.sha256"
+            if [ ! -f "$archive" ]; then
+              echo "Missing required archive: $archive" >&2
+              exit 1
+            fi
+            if [ ! -f "$checksum" ]; then
+              echo "Missing required checksum: $checksum" >&2
+              exit 1
+            fi
+          done
+          ls -lh dist/release-assets
+
+      - name: Publish release assets
         uses: softprops/action-gh-release@v2
         with:
           files: |
-            dist/kandev-${{ matrix.platform }}.tar.gz
-            dist/kandev-${{ matrix.platform }}.tar.gz.sha256
+            dist/release-assets/kandev-*.tar.gz
+            dist/release-assets/kandev-*.tar.gz.sha256
diff --git a/apps/cli/README_internal.md b/apps/cli/README_internal.md
index 3a01a68418..0010ad4c27 100644
--- a/apps/cli/README_internal.md
+++ b/apps/cli/README_internal.md
@@ -58,6 +58,8 @@ Note: the runtime bundles are pulled from the latest GitHub Release by default,
 - **New runtime release without CLI publish**: users get new runtime automatically, but no update prompt.
 - **New CLI publish**: users get an update prompt and then re-run with the new CLI.
 - On startup, `run` also prints the resolved runtime release tag.
+- Runtime assets are published atomically in CI (single final release upload job), so `/releases/latest`
+  does not surface partially uploaded platform bundles.
 
 You can disable the prompt with: