From bbf9e67a7d15d68766ac727893de424ce41732ca Mon Sep 17 00:00:00 2001
From: m1ngshum <140998506+m1ngshum@users.noreply.github.com>
Date: Fri, 3 Jul 2026 11:03:39 +0800
Subject: [PATCH] fix(ci): attach SBOM at release-create time
 (immutable-releases 422)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The publish workflow created the GitHub Release, then uploaded the CycloneDX
SBOM as a separate `gh release upload` step. With immutable releases enabled
on the repo, that follow-up upload is rejected (HTTP 422: 'Cannot upload assets
to an immutable release'), failing the workflow after npm publish had already
succeeded — v0.17.0 shipped to npm but its GitHub Release has no SBOM asset.

Pass the SBOM to `gh release create` as a positional asset so it's sealed with
the release atomically. Keep the file-guard (asset-less release if generation
failed) and the idempotent already-exists branch (now honest that an immutable
release can't be amended).
---
 .github/workflows/publish.yml | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e3b9dd0..47eb4de 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -53,17 +53,18 @@ jobs:
       - name: Create GitHub Release + attach SBOM
         env:
           GH_TOKEN: ${{ github.token }}
-        # Idempotent: a release may already exist (e.g. created manually right
-        # after the tag push, or on a workflow re-run). Don't fail the publish.
+        # Attach the SBOM AT CREATION TIME. GitHub immutable releases seal a
+        # release's assets on creation and reject any later `gh release upload`
+        # with HTTP 422, so the SBOM must be passed to `gh release create` as a
+        # positional asset — not uploaded in a follow-up step. Idempotent: a
+        # release may already exist (manual create, or a re-run); we don't fail
+        # the publish, but we also can't amend an immutable one.
         run: |
           if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
-            echo "Release $GITHUB_REF_NAME already exists — skipping creation."
+            echo "Release $GITHUB_REF_NAME already exists — skipping (immutable releases can't be amended)."
+          elif [ -f mcpm.cdx.json ]; then
+            gh release create "$GITHUB_REF_NAME" mcpm.cdx.json --generate-notes --title "$GITHUB_REF_NAME"
           else
+            echo "No SBOM produced — creating release without asset."
             gh release create "$GITHUB_REF_NAME" --generate-notes --title "$GITHUB_REF_NAME"
           fi
-          # Best-effort: only attach the SBOM if generation above succeeded.
-          if [ -f mcpm.cdx.json ]; then
-            gh release upload "$GITHUB_REF_NAME" mcpm.cdx.json --clobber
-          else
-            echo "No SBOM produced — skipping asset upload."
-          fi