From 89b9392c2595b0b9f2e07e23c7d45f65a31b25d2 Mon Sep 17 00:00:00 2001
From: "claude@clouddev1" <claude-clouddev1@oliversturm.ch>
Date: Fri, 12 Jun 2026 22:11:24 +0000
Subject: [PATCH] =?UTF-8?q?ci:=20release=20job=20=E2=80=94=20test=20before?=
 =?UTF-8?q?=20publish,=20pin=20bash,=20fix=20diagnostic?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Run cargo test before the build so a tag never publishes untested code.
- Pin shell: bash on the scripted steps; the runner defaults to dash,
  which rejected `set -o pipefail` and failed run 22's package step.
- Swap `file` (absent in the slim image) for `ls -l`.
---
 .gitea/workflows/release.yaml | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
index 4db084d..98f7fe4 100644
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -6,8 +6,8 @@
 # (aarch64, macOS, Windows) and the D3 package-manager manifests layer on later,
 # step by step.
 #
-# Correctness comes from the branch gate (clippy + test) that ran when the
-# tagged commit was pushed; this job builds + publishes, it does not re-test.
+# Tests run here before the build so a tag can never publish untested code,
+# even one pointing at a commit that was never gated on a branch.
 name: release
 on:
   push:
@@ -24,14 +24,20 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: test
+        run: nix develop -c cargo test --no-fail-fast
+
       - name: build static binary
         run: nix develop -c cargo build --release --target "$TARGET"
 
       - name: package artifacts
+        # Pin bash: the runner defaults scripted steps to dash, which rejects
+        # `set -o pipefail`. bash is in the CI image.
+        shell: bash
         run: |
           set -euo pipefail
           BIN="target/$TARGET/release/rdbms-playground"
-          file "$BIN"
+          ls -l "$BIN"
           OUT="rdbms-playground-${{ github.ref_name }}-$TARGET"
           mkdir -p dist
           cp "$BIN" "dist/$OUT"
@@ -39,6 +45,7 @@ jobs:
           ls -l dist
 
       - name: publish gitea release + assets
+        shell: bash
         env:
           # Auto-provided by Gitea Actions; has repo write (release) scope.
           TOKEN: ${{ secrets.GITEA_TOKEN }}