From cb715898cda7465f4bb236282aa5aaba714a5d78 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Sun, 20 Sep 2026 16:01:01 -0700
Subject: [PATCH] fix(release): pass the draft-verify tag on Windows pwsh
 (#21851)

The Windows matrix defaults to pwsh, so assert-github-release-is-draft.mjs
received an empty argv and failed with "tag is required" after the signed
installer was already uploaded. Force bash, interpolate the tag in YAML,
and fall back to env TAG.
---
 .github/workflows/release-cut.yml                      | 5 ++++-
 .github/workflows/release-mac-build.yml                | 3 ++-
 config/scripts/assert-github-release-is-draft.mjs      | 4 +++-
 config/scripts/assert-github-release-is-draft.test.mjs | 4 ++++
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index 966396ac453..f7bdc13caac 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -2223,10 +2223,13 @@ jobs:
         # Why: electron-builder `--publish always` can create a public release
         # as soon as this platform uploads. Re-draft immediately, then fail, so
         # /releases/latest never keeps serving a missing Windows exe.
+        # Why bash: the Windows matrix defaults to pwsh, which does not expand
+        # "$TAG" into argv.
+        shell: bash
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ needs.cut.outputs.tag }}
-        run: node config/scripts/assert-github-release-is-draft.mjs "$TAG"
+        run: node config/scripts/assert-github-release-is-draft.mjs "${{ needs.cut.outputs.tag }}"
 
       # Why post-pack for Linux: electron-builder packs and uploads in one
       # `--publish always` invocation. The previous step re-drafts if that
diff --git a/.github/workflows/release-mac-build.yml b/.github/workflows/release-mac-build.yml
index b8e0079984b..7f0149fc74e 100644
--- a/.github/workflows/release-mac-build.yml
+++ b/.github/workflows/release-mac-build.yml
@@ -184,10 +184,11 @@ jobs:
         # Why: re-draft immediately if electron-builder flipped the GitHub
         # release public, then fail. Checking without restoring leaves
         # /releases/latest serving a missing Windows exe.
+        shell: bash
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ inputs.tag }}
-        run: node config/scripts/assert-github-release-is-draft.mjs "$TAG"
+        run: node config/scripts/assert-github-release-is-draft.mjs "${{ inputs.tag }}"
 
       # Why post-publish for macOS: electron-builder packs and uploads in a
       # single `--publish always` invocation, so there is no cheap insertion
diff --git a/config/scripts/assert-github-release-is-draft.mjs b/config/scripts/assert-github-release-is-draft.mjs
index c60722452bb..cce1d51cee2 100644
--- a/config/scripts/assert-github-release-is-draft.mjs
+++ b/config/scripts/assert-github-release-is-draft.mjs
@@ -91,7 +91,9 @@ export async function restorePublishedDesktopReleasesToDraft({
 }
 
 async function main() {
-  const tag = process.argv[2]
+  // Why env TAG: the Windows release-cut matrix uses pwsh, which does not
+  // expand bash-style "$TAG" in argv. The step still exports TAG.
+  const tag = process.argv[2] || process.env.TAG
   const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN
   const repo = process.env.GITHUB_REPOSITORY || 'stablyai/orca'
   const restored = await restorePublishedDesktopReleasesToDraft({
diff --git a/config/scripts/assert-github-release-is-draft.test.mjs b/config/scripts/assert-github-release-is-draft.test.mjs
index 8b730e9fb37..aed313495de 100644
--- a/config/scripts/assert-github-release-is-draft.test.mjs
+++ b/config/scripts/assert-github-release-is-draft.test.mjs
@@ -128,13 +128,17 @@ describe('release draft workflow contract', () => {
 
     expect(electronBuilderConfig.publish.releaseType).toBe('draft')
     expect(cutCheckout.with['fetch-tags']).toBe(true)
+    expect(linuxDraftStep.shell).toBe('bash')
     expect(linuxDraftStep.run).toContain('assert-github-release-is-draft.mjs')
+    expect(linuxDraftStep.run).toContain('needs.cut.outputs.tag')
     expect(publishRelease.run).toContain('gh release edit')
     expect(publishRelease.run).toContain('--draft=false')
     expect(macSteps.indexOf(abortParentStep)).toBeLessThan(macSteps.indexOf(macPublishStep))
     expect(abortParentStep.env.PARENT_RUN).toBe('${{ inputs.release_run_id }}')
     expect(abortParentStep.run).toContain('refusing to publish mac artifacts')
+    expect(macDraftStep.shell).toBe('bash')
     expect(macDraftStep.run).toContain('assert-github-release-is-draft.mjs')
+    expect(macDraftStep.run).toContain('inputs.tag')
     expect(macPublishStep.with.command).toContain('-c.publish.releaseType=draft')
 
     const linuxCommands = releaseWorkflow.jobs.build.strategy.matrix.include