fix: publish updater URLs from release tags

Author: MarkShawn2020

scripts/generate-updater-manifest.mjs

@@ -72,6 +72,7 @@ export async function buildUpdaterManifest({
   assets,
   readSignature,
   requiredPlatforms = [],
+  downloadBaseUrl,
 }) {
   const assetsByName = new Map(assets.map((asset) => [asset.name, asset]));
   const platforms = {};
@@ -89,7 +90,12 @@ export async function buildUpdaterManifest({
 
     const entry = {
       signature: (await readSignature(signatureAsset)).trim(),
-      url: updaterAsset.browser_download_url,
+      // A draft GitHub Release reports an `untagged-...` download URL. That
+      // URL is invalid after publication, so manifests must be addressed by
+      // the immutable tag rather than copied from the draft asset response.
+      url: downloadBaseUrl
+        ? `${downloadBaseUrl}/${encodeURIComponent(updaterAsset.name)}`
+        : updaterAsset.browser_download_url,
     };
     const baseKey = `${target.os}-${target.arch}`;
     const installerKey = `${baseKey}-${target.installer}`;
@@ -176,6 +182,7 @@ async function generateFromGitHub({ repo, tag, output, requiredPlatforms }) {
     release,
     assets,
     requiredPlatforms,
+    downloadBaseUrl: `https://github.com/${repo}/releases/download/${encodeURIComponent(tag)}`,
     readSignature: async (asset) => {
       const response = await githubRequest(
         `${apiBaseUrl}/repos/${repo}/releases/assets/${asset.id}`,

scripts/generate-updater-manifest.test.mjs

@@ -79,6 +79,26 @@ test("builds one complete manifest after all release assets are available", asyn
   );
 });
 
+test("uses the immutable tag download path instead of a draft asset URL", async () => {
+  const draftAsset = {
+    id: 1,
+    name: "lovcode_aarch64.app.tar.gz",
+    browser_download_url:
+      "https://github.com/example/lovcode/releases/download/untagged-draft/lovcode_aarch64.app.tar.gz",
+  };
+  const manifest = await buildUpdaterManifest({
+    release: { ...release, tag_name: "v1.2.3" },
+    assets: [draftAsset, { ...draftAsset, id: 2, name: `${draftAsset.name}.sig` }],
+    readSignature: async () => "signature",
+    downloadBaseUrl: "https://github.com/example/lovcode/releases/download/v1.2.3",
+  });
+
+  assert.equal(
+    manifest.platforms["darwin-aarch64"].url,
+    "https://github.com/example/lovcode/releases/download/v1.2.3/lovcode_aarch64.app.tar.gz",
+  );
+});
+
 test("fails before upload when a required target is absent", async () => {
   const assets = signedAssetPair(1, "lovcode_aarch64.app.tar.gz");