From ebc5dcf65d47c8178fe843e2db8bf49ee74b7905 Mon Sep 17 00:00:00 2001
From: Christian Findlay <16697547+MelbourneDeveloper@users.noreply.github.com>
Date: Tue, 13 Oct 2026 23:32:51 +1100
Subject: [PATCH] Release binary jobs no longer race each other or publish
 stray artifacts

The SBOM step attached its file to the GitHub release whenever the release
already existed. Now that the Native AOT migrate binaries build quickly,
their publish job creates the release first, and the slower read-only
Windows LSP build failed replacing the asset. The publish jobs already
attach every SBOM, so the build step no longer uploads to the release or
as a separate workflow artifact.

Each publish job downloaded every artifact in the release run, putting
Deslop reports and the other binary family into its release assets and
checksums. Downloads are now scoped to the workflow's own binary_name.
---
 .github/workflows/release-binary-multiplatform.yml     | 8 ++++++++
 .github/workflows/release-dotnet-aot-multiplatform.yml | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/.github/workflows/release-binary-multiplatform.yml b/.github/workflows/release-binary-multiplatform.yml
index ba88c50b..14bb466f 100644
--- a/.github/workflows/release-binary-multiplatform.yml
+++ b/.github/workflows/release-binary-multiplatform.yml
@@ -102,6 +102,11 @@ jobs:
           file: ${{ steps.pkg.outputs.archive }}
           format: cyclonedx-json
           output-file: ${{ steps.pkg.outputs.archive }}.cdx.json
+          # The publish job attaches every SBOM in dist/. Attaching here races it: once
+          # the release exists, this read-only job fails trying to replace the asset.
+          upload-release-assets: false
+          # The archive's SBOM ships in this job's own artifact below.
+          upload-artifact: false
       - name: Attest build provenance
         uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
         with:
@@ -127,6 +132,9 @@ jobs:
     steps:
       - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
+          # Only this workflow's binaries: an unfiltered download pulls every artifact in
+          # the calling release run (Deslop reports, the other binary family) into dist/.
+          pattern: ${{ inputs.binary_name }}-*
           path: dist
           merge-multiple: true
       - name: Generate SHA256SUMS
diff --git a/.github/workflows/release-dotnet-aot-multiplatform.yml b/.github/workflows/release-dotnet-aot-multiplatform.yml
index de3b9ec8..03653d3e 100644
--- a/.github/workflows/release-dotnet-aot-multiplatform.yml
+++ b/.github/workflows/release-dotnet-aot-multiplatform.yml
@@ -143,6 +143,11 @@ jobs:
           file: ${{ steps.pkg.outputs.archive }}
           format: cyclonedx-json
           output-file: ${{ steps.pkg.outputs.archive }}.cdx.json
+          # The publish job attaches every SBOM in dist/. Attaching here races it: once
+          # the release exists, this read-only job fails trying to replace the asset.
+          upload-release-assets: false
+          # The archive's SBOM ships in this job's own artifact below.
+          upload-artifact: false
       - name: Attest build provenance
         uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
         with:
@@ -168,6 +173,9 @@ jobs:
     steps:
       - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
+          # Only this workflow's binaries: an unfiltered download pulls every artifact in
+          # the calling release run (Deslop reports, the other binary family) into dist/.
+          pattern: ${{ inputs.binary_name }}-*
           path: dist
           merge-multiple: true
       # Own signed checksum file (separate from the Rust binary's SHA256SUMS) so