From 7c1599b73ada99483daa9ef36fdf384435d93b6d Mon Sep 17 00:00:00 2001
From: Palash Debnath <4178343+debpalash@users.noreply.github.com>
Date: Thu, 10 Sep 2026 11:08:10 -0700
Subject: [PATCH] test(release): pin the missing-checksum gate; docs drop the
 manual publish step

The guard now proves the job exits on a missing platform before it
rewrites the notes or publishes, so removing that exit fails CI.
RELEASING.md's end-to-end updater test still said to publish the draft by
hand; the workflow publishes it.
---
 docs/RELEASING.md                    | 2 +-
 tests/test_release_checksum_notes.py | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index 325ddc99..5b10bb59 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -138,7 +138,7 @@ You should see platform-keyed download URLs + minisign signatures. If that JSON
 
 **Option B — full end-to-end:**
 1. Install v0.1.0 on a fresh machine (or clean-installed Applications).
-2. Cut v0.2.0 (bump, tag, push, wait for CI, publish draft).
+2. Cut v0.2.0 (bump, tag, push, wait for CI; the workflow publishes the release).
 3. Launch the installed v0.1.0. Within seconds, the dialog should appear.
 4. Accept → app downloads, verifies, replaces, relaunches as v0.2.0.
 
diff --git a/tests/test_release_checksum_notes.py b/tests/test_release_checksum_notes.py
index 0eb87688..7f8ea681 100644
--- a/tests/test_release_checksum_notes.py
+++ b/tests/test_release_checksum_notes.py
@@ -54,3 +54,12 @@ def test_only_that_job_publishes():
 
 def test_the_contributors_strip_edits_the_notes_after_them():
     assert "needs: [build, release-notes-checksums]" in _job("contributors-strip")
+
+
+def test_a_missing_platform_stops_before_the_notes_or_the_publish():
+    """A release missing one platform's checksums must stay a draft: the job
+    exits before it rewrites the notes or publishes anything."""
+    job = _code(_job("release-notes-checksums"))
+    assert "missing=1" in job
+    gate = job.index('[ "$missing" = 0 ] || exit 1')
+    assert gate < job.index("--notes-file") < job.index("--draft=false")