From d264f865e8428623c10f6e65654af78ae0145119 Mon Sep 17 00:00:00 2001
From: Rahul Krishna <i.m.ralk@gmail.com>
Date: Wed, 22 Jul 2026 11:48:07 -0400
Subject: [PATCH] fix(ci): make the codeanalyzer-JAR release guard pipe-safe
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The guard piped `tar tzf` (which decompresses the whole ~32MB sdist) straight
into `grep -q`; grep closes the pipe on first match, SIGPIPE-killing tar, and
under `set -o pipefail` that surfaced as a false "missing JAR" — failing the
v1.4.4 release even though the JAR was present in both wheel and sdist. Capture
each listing with command substitution and grep a here-string instead, so no
producer is still writing when grep short-circuits. (#284)
---
 .github/workflows/release.yml | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4259ff7..b8232c4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -69,17 +69,28 @@ jobs:
         # Guard against the hatchling/.gitignore regression (issue #284): a jarless wheel
         # installs fine but fails at runtime with "codeanalyzer jar not found". Fail the
         # release here rather than publish a broken artifact to PyPI.
+        #
+        # The listing is captured before grepping: piping `tar tzf` (which decompresses the
+        # whole 32MB sdist) straight into `grep -q` lets grep close the pipe on first match,
+        # SIGPIPE-killing tar and — under `pipefail` — reporting a false "missing JAR".
         run: |
           set -euo pipefail
           jar_re='codeanalyzer/jar/codeanalyzer-[0-9][^/]*\.jar$'
-          ok=1
-          for f in dist/*.whl; do
-            unzip -l "$f" | grep -qE "$jar_re" || { echo "::error::$f is missing the codeanalyzer JAR"; ok=0; }
+          fail=0
+          for f in dist/*.whl dist/*.tar.gz; do
+            case "$f" in
+              *.whl)    listing=$(unzip -l "$f") ;;
+              *.tar.gz) listing=$(tar tzf "$f") ;;
+            esac
+            if grep -qE "$jar_re" <<<"$listing"; then
+              echo "  ✓ $f"
+            else
+              echo "::error::$f is missing the codeanalyzer JAR"
+              grep -i '\.jar' <<<"$listing" || echo "  (no .jar entries at all)"
+              fail=1
+            fi
           done
-          for f in dist/*.tar.gz; do
-            tar tzf "$f" | grep -qE "$jar_re" || { echo "::error::$f is missing the codeanalyzer JAR"; ok=0; }
-          done
-          if [ "$ok" -ne 1 ]; then
+          if [ "$fail" -ne 0 ]; then
             echo "Refusing to publish a jarless release."; exit 1
           fi
           echo "codeanalyzer JAR present in wheel and sdist ✓"