Fix npm release asset selection

Select only newly prefixed publishable npm tarballs, leave legacy launcher archives untouched, and reject old releases without the complete new asset set. Cover mixed and legacy-only release fixtures.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 23fc3b8d-7678-46d3-9fe7-875d8311b526

Author: devm33

README.md

@@ -98,13 +98,17 @@ npm install -g @github/copilot@prerelease
 ### npm release publishing
 
 The [npm release workflow](.github/workflows/publish-npm.yml) runs when a GitHub
-release is **published**. It downloads the nine already-built npm `.tgz` release
-assets and validates their names, SHA-256 digests, package identities, versions,
-platform metadata, and launcher dependencies before publishing anything. It does
-not build from or execute release-tag code. Run the workflow manually on `main`
-with the exact published `release_tag` (for example `v1.0.89`) to recover a
-missed or failed release event. Matching versions are skipped only when their
-npm `dist.integrity` matches the release tarball. Older releases use a
+release is **published**. It downloads only the nine already-built npm assets:
+`npm-github-copilot-${VERSION}.tgz` and
+`npm-github-copilot-${VERSION}-${PLATFORM}.tgz` for each of the eight supported
+platforms. It ignores the older `github-copilot-*.tgz` launcher tarballs and
+validates the nine new assets' names, SHA-256 digests, package identities,
+versions, platform metadata, and launcher dependencies before publishing
+anything. It does not build from or execute release-tag code. Run the workflow
+manually on `main` with the exact published `release_tag` to recover a missed
+or failed release event; releases without all nine new npm assets are rejected
+even on manual recovery. Matching versions are skipped only when their npm
+`dist.integrity` matches the release tarball. Older releases use a
 version-specific `release-<version>` npm tag if `latest` or `prerelease` has
 advanced, so recovery never intentionally downgrades those channels. A version
 already on npm with a missing/stale channel tag fails closed: npm OIDC cannot
@@ -125,11 +129,10 @@ no `NPM_TOKEN` or `NODE_AUTH_TOKEN`. The runtime repository must continue its
 existing publishing until this workflow is merged **and all nine npm trusted
 publishers are configured**; only then should its npm publication be cut over.
 Its internal Azure feed publication and ancillary release tasks remain separate.
-The release assets must actually contain nine publishable packages: as of
-September 29, 2026, the platform-named assets in `v1.0.90-4` still contain
-the `@github/copilot` launcher manifest rather than platform package manifests.
-This workflow will reject those assets; the release artifact producer must
-correct them before the npm cutover.
+The release artifact producer must attach the nine actual npm package tarballs
+under the new `npm-github-copilot-` names before cutover. Older releases such as
+`v1.0.90-4` contain only the legacy launcher-manifest tarballs and cannot be
+recovered through this workflow.
 
 
 ### Launching the CLI

script/publish-npm-release.mjs

@@ -18,6 +18,7 @@ const platforms = [
 ];
 const repository = "github/copilot-cli";
 const packageName = (platform) => `@github/copilot${platform ? `-${platform}` : ""}`;
+const assetName = (version, platform) => `npm-github-copilot-${version}${platform ? `-${platform}` : ""}.tgz`;
 
 export function validateRelease(release, tag, eventId, eventPrerelease) {
   const match = /^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9]|[1-9]\d*))?$/.exec(tag);
@@ -35,10 +36,10 @@ export function validateRelease(release, tag, eventId, eventPrerelease) {
     throw new Error(`Prerelease flag for ${tag} differs from the triggering event`);
   }
   const version = tag.slice(1);
-  const names = platforms.map(([platform]) => `github-copilot-${version}-${platform}.tgz`);
-  names.push(`github-copilot-${version}.tgz`);
+  const names = platforms.map(([platform]) => assetName(version, platform));
+  names.push(assetName(version));
   const expected = new Set(names);
-  const assets = release.assets.filter((asset) => asset.name.endsWith(".tgz"));
+  const assets = release.assets.filter((asset) => asset.name.startsWith("npm-github-copilot-") && asset.name.endsWith(".tgz"));
   if (assets.length !== expected.size || assets.some((asset) => !expected.has(asset.name)) ||
       new Set(assets.map((asset) => asset.name)).size !== expected.size) {
     throw new Error(`Release ${tag} must contain exactly the nine expected npm tarballs`);
@@ -111,7 +112,7 @@ export async function publishRelease(tag, {
   const { version, prerelease, assets } = validateRelease(release, tag, eventId, eventPrerelease);
   const temp = mkdtempSync(join(tmpdir(), "copilot-npm-release-"));
   try {
-    run("gh", ["release", "download", tag, "--repo", repository, "--pattern", "github-copilot-*.tgz", "--dir", temp]);
+    run("gh", ["release", "download", tag, "--repo", repository, "--pattern", "npm-github-copilot-*.tgz", "--dir", temp]);
     const downloaded = readdirSync(temp);
     if (downloaded.length !== assets.length || assets.some((asset) => !downloaded.includes(asset.name))) {
       throw new Error(`Downloaded npm tarballs do not match release ${tag}`);
@@ -120,8 +121,8 @@ export async function publishRelease(tag, {
     for (const platform of [...platforms, null]) {
       const suffix = platform?.[0];
       const name = packageName(suffix);
-      const file = join(temp, `github-copilot-${version}${suffix ? `-${suffix}` : ""}.tgz`);
-      const asset = assets.find((entry) => entry.name === `github-copilot-${version}${suffix ? `-${suffix}` : ""}.tgz`);
+      const file = join(temp, assetName(version, suffix));
+      const asset = assets.find((entry) => entry.name === assetName(version, suffix));
       const bytes = readFileSync(file);
       if (statSync(file).size !== asset.size ||
           `sha256:${createHash("sha256").update(bytes).digest("hex")}` !== asset.digest) {

test/publish-npm-release.test.mjs

@@ -26,7 +26,7 @@ function fixture(version = "1.2.3-4") {
   for (const platform of [...platforms, null]) {
     const [suffix, os, cpu, libc] = platform ?? [];
     const name = `@github/copilot${suffix ? `-${suffix}` : ""}`;
-    const filename = `github-copilot-${version}${suffix ? `-${suffix}` : ""}.tgz`;
+    const filename = `npm-github-copilot-${version}${suffix ? `-${suffix}` : ""}.tgz`;
     const source = join(root, filename);
     const packageDir = join(root, "work", "package");
     mkdirSync(packageDir, { recursive: true });
@@ -54,6 +54,15 @@ function fixture(version = "1.2.3-4") {
   };
 }
 
+function attachLegacyTarballs(f) {
+  const launcher = f.release.assets.find((asset) => asset.name === `npm-github-copilot-${f.release.tag_name.slice(1)}.tgz`);
+  for (const platform of [...platforms.map(([suffix]) => `-${suffix}`), ""]) {
+    const name = `github-copilot-${f.release.tag_name.slice(1)}${platform}.tgz`;
+    cpSync(join(f.root, launcher.name), join(f.root, name));
+    f.release.assets.push({ ...launcher, name });
+  }
+}
+
 async function exercise(options = {}) {
   const f = fixture(options.version);
   const published = [];
@@ -64,7 +73,8 @@ async function exercise(options = {}) {
     const run = (tool, args) => {
       if (tool === "gh" && args[0] === "api") return JSON.stringify(f.release);
       if (tool === "gh" && args[0] === "release") {
-        for (const asset of f.release.assets) {
+        assert.equal(args[args.indexOf("--pattern") + 1], "npm-github-copilot-*.tgz");
+        for (const asset of f.release.assets.filter((entry) => entry.name.startsWith("npm-github-copilot-") && entry.name.endsWith(".tgz"))) {
           const source = join(f.root, asset.name);
           cpSync(source, join(args.at(-1), asset.name));
         }
@@ -98,7 +108,43 @@ test("publishes all eight platforms before launcher with prerelease tag", async
   const { published } = await exercise({ eventId: "1234", eventPrerelease: "true" });
   assert.equal(published.length, 9);
   assert.ok(published.every((args) => args[args.indexOf("--tag") + 1] === "prerelease"));
-  assert.match(published.at(-1)[1], /github-copilot-1\.2\.3-4\.tgz$/);
+  assert.match(published.at(-1)[1], /npm-github-copilot-1\.2\.3-4\.tgz$/);
+});
+
+test("ignores the nine old launcher-manifest tarballs and publishes only the new npm packages", async () => {
+  const { published } = await exercise({ mutate: attachLegacyTarballs });
+  assert.equal(published.length, 9);
+  assert.ok(published.every((args) => args[1].split("/").at(-1).startsWith("npm-github-copilot-")));
+});
+
+test("rejects an old release with only the nine legacy tarballs, including manual recovery", async () => {
+  await assert.rejects(exercise({
+    mutate: (f) => {
+      attachLegacyTarballs(f);
+      f.release.assets = f.release.assets.filter((asset) => !asset.name.startsWith("npm-github-copilot-"));
+    },
+  }), (error) => {
+    assert.match(error.message, /nine expected npm tarballs/);
+    assert.deepEqual(error.published, []);
+    return true;
+  });
+});
+
+test("rejects a new platform asset whose manifest is actually the old launcher", async () => {
+  await assert.rejects(exercise({
+    mutate: (f) => {
+      attachLegacyTarballs(f);
+      const platformAsset = f.release.assets.find((asset) => asset.name === "npm-github-copilot-1.2.3-4-linux-x64.tgz");
+      const launcher = f.release.assets.find((asset) => asset.name === "npm-github-copilot-1.2.3-4.tgz");
+      cpSync(join(f.root, launcher.name), join(f.root, platformAsset.name));
+      platformAsset.size = launcher.size;
+      platformAsset.digest = launcher.digest;
+    },
+  }), (error) => {
+    assert.match(error.message, /Package identity or repository mismatch for @github\/copilot-linux-x64/);
+    assert.deepEqual(error.published, []);
+    return true;
+  });
 });
 
 test("a matching existing package is skipped on a partial rerun", async () => {
@@ -131,7 +177,7 @@ test("rejects a registry integrity mismatch before any publish", async () => {
 });
 
 test("rejects invalid launcher dependencies and platform metadata before publishing", async () => {
-  for (const filename of ["github-copilot-1.2.3-4.tgz", "github-copilot-1.2.3-4-linuxmusl-x64.tgz"]) {
+  for (const filename of ["npm-github-copilot-1.2.3-4.tgz", "npm-github-copilot-1.2.3-4-linuxmusl-x64.tgz"]) {
     await assert.rejects(exercise({
       mutate: (f) => {
         const work = join(f.root, "work");
@@ -166,6 +212,7 @@ test("rejects incomplete assets and incorrect digests before any publish", async
     (f) => { f.release.assets.pop(); },
     (f) => { f.release.assets[0].digest = `sha256:${"0".repeat(64)}`; },
     (f) => { f.release.assets[0].name = "unexpected.tgz"; },
+    (f) => { f.release.assets.push({ ...f.release.assets[0], name: "npm-github-copilot-1.2.3-4-unknown.tgz" }); },
   ]) {
     await assert.rejects(exercise({ mutate }), (error) => {
       assert.deepEqual(error.published, []);