release 2.5.2

Signed-off-by: Rui Chen <rui@chenrui.dev>

.github/FUNDING.yml

@@ -0,0 +1 @@
+ko_fi: softprops

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,97 @@
+name: Bug report
+description: Report a bug or regression in action-gh-release
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing:
+        - confirm the problem still reproduces on the latest release or `master`
+        - search existing issues for the same behavior
+        - if the original repository is private, include a minimal public repro, a sanitized workflow snippet, or exact redacted steps a maintainer can follow
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-flight checks
+      options:
+        - label: I searched existing issues and did not find a duplicate
+          required: true
+        - label: I reproduced this with the latest released version or current `master`
+          required: true
+        - label: I included a reproducible example or a sanitized/redacted reproduction path if the original repository is private
+          required: true
+  - type: input
+    id: action_version
+    attributes:
+      label: action-gh-release version
+      description: Tag, SHA, or ref used in your workflow
+      placeholder: v2.5.2
+    validations:
+      required: true
+  - type: dropdown
+    id: runner
+    attributes:
+      label: Runner operating system
+      options:
+        - ubuntu-latest
+        - windows-latest
+        - macos-latest
+        - other
+    validations:
+      required: true
+  - type: input
+    id: target_repository
+    attributes:
+      label: Release target repository
+      description: Fill this in if you set the `repository:` input
+      placeholder: owner/repo
+  - type: input
+    id: repro_reference
+    attributes:
+      label: Reproduction repo, gist, or artifact
+      description: Link a minimal repro repository, gist, run URL, or other shareable artifact if you have one
+      placeholder: https://github.com/owner/repro-repo
+  - type: textarea
+    id: workflow
+    attributes:
+      label: Workflow snippet
+      description: Include the relevant `uses:` step and inputs. If the original repo is private, paste a sanitized version here.
+      render: yaml
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Include tags, matrix/concurrency details, and any repo rules involved. If the original repo is private, describe the smallest setup a maintainer can recreate locally or in a throwaway repo.
+      placeholder: |
+        1. Trigger workflow with ...
+        2. Action creates ...
+        3. Action fails with ...
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs
+      description: Paste the relevant error output or run URL
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Any extra environment, token, ruleset, or asset details

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,50 @@
+name: Feature request
+description: Propose an enhancement or new capability for action-gh-release
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this template for new capabilities, behavior changes, or ergonomics improvements.
+        If you are reporting something broken, use the bug report template instead.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-flight checks
+      options:
+        - label: I searched existing issues and did not find a duplicate request
+          required: true
+        - label: This is not a bug report for existing behavior
+          required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem to solve
+      description: What workflow pain point or gap are you trying to address?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe the behavior, input, or output you want
+    validations:
+      required: true
+  - type: textarea
+    id: workflow
+    attributes:
+      label: Example workflow snippet
+      description: Show how you would expect to use this
+      render: yaml
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Workarounds or other approaches you evaluated
+  - type: textarea
+    id: impact
+    attributes:
+      label: Why this belongs in action-gh-release
+      description: Explain the user impact or why this should live in the action rather than in workflow glue

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      npm:
+        patterns:
+          - "*"
+    ignore:
+      - dependency-name: node-fetch
+        versions:
+          - ">=3.0.0"
+      - dependency-name: "@types/node"
+        versions:
+          - ">=22.0.0"
+    commit-message:
+      prefix: "chore(deps)"
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"

.github/release.yml

@@ -0,0 +1,22 @@
+changelog:
+  exclude:
+    labels:
+      - ignore-for-release
+      - github-actions
+    authors:
+      - octocat
+      - renovate[bot]
+  categories:
+    - title: Breaking Changes 🛠
+      labels:
+        - breaking-change
+    - title: Exciting New Features 🎉
+      labels:
+        - enhancement
+        - feature
+    - title: Bug fixes 🐛
+      labels:
+        - bug
+    - title: Other Changes 🔄
+      labels:
+        - "*"

.github/workflows/main.yml

@@ -1,26 +1,32 @@
-name: Main
+name: main
 
-on: [pull_request, push]
+on:
+  push:
+  pull_request:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      # https://github.com/actions/checkout
-      - name: Checkout
-        uses: actions/checkout@master
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
+
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          fetch-depth: 1
+          node-version-file: ".tool-versions"
+          cache: "npm"
+
       - name: Install
         run: npm ci
       - name: Build
         run: npm run build
       - name: Test
         run: npm run test
-      - name: "check for uncommitted changes"
-        # Ensure no changes, but ignore node_modules dir since dev/fresh ci deps installed.
-        run: |
-          git diff --exit-code --stat -- . ':!node_modules' \
-          || (echo "##[error] found changed files after build. please 'npm run build && npm run format'" \
-                  "and check in all changes" \
-              && exit 1)
+      - name: Format
+        run: npm run fmtcheck
+      # - name: "check for uncommitted changes"
+      #   # Ensure no changes, but ignore node_modules dir since dev/fresh ci deps installed.
+      #   run: |
+      #     git diff --exit-code --stat -- . ':!node_modules' \
+      #     || (echo "##[error] found changed files after build. please 'npm run build && npm run fmt'" \
+      #             "and check in all changes" \
+      #         && exit 1)

.gitignore

@@ -2,3 +2,4 @@ __tests__/runner/*
 # actions requires a node_modules dir https://github.com/actions/toolkit/blob/master/docs/javascript-action.md#publish-a-releasesv1-action
 # but its recommended not to check these in https://github.com/actions/toolkit/blob/master/docs/action-versioning.md#recommendations
 node_modules
+coverage

.prettierignore

@@ -0,0 +1,16 @@
+# Build outputs
+dist/
+lib/
+coverage/
+
+# Dependencies
+node_modules/
+
+# Misc
+.github/
+*.log
+.DS_Store
+__tests__/release.txt
+
+# Package files
+package-lock.json

.prettierrc.js

@@ -0,0 +1,11 @@
+/**
+ * @type {import('prettier').Config}
+ */
+module.exports = {
+  trailingComma: 'all',
+  tabWidth: 2,
+  semi: true,
+  singleQuote: true,
+  printWidth: 100,
+  bracketSpacing: true,
+};

.tool-versions

@@ -0,0 +1 @@
+nodejs 24.11.0

CHANGELOG.md

@@ -1,9 +1,351 @@
-## 0.1.0
+## 2.5.2
 
-* Initial release
+`2.5.2` is a patch release focused on the remaining release-creation and prerelease regressions in the `2.5.x` bug-fix cycle.
+It fixes `#705`, fixes `#708`, fixes `#740`, fixes `#741`, and fixes `#722`.
+Regression testing covers the shared-tag race, prerelease event behavior, dotfile asset labels,
+same-filename concurrent uploads, and blocked-tag cleanup behavior.
+
+If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.
+
+## What's Changed
+
+### Bug fixes 🐛
+
+* fix: canonicalize releases after concurrent create by @chenrui333 in https://github.com/softprops/action-gh-release/pull/746
+* fix: preserve prereleased events for prereleases by @chenrui333 in https://github.com/softprops/action-gh-release/pull/748
+* fix: restore dotfile asset labels by @chenrui333 in https://github.com/softprops/action-gh-release/pull/749
+* fix: handle upload already_exists races across workflows by @api2062 in https://github.com/softprops/action-gh-release/pull/745
+* fix: clean up orphan drafts when tag creation is blocked by @chenrui333 in https://github.com/softprops/action-gh-release/pull/750
+
+## 2.5.1
+
+`2.5.1` is a patch release focused on regressions introduced in `2.5.0` and on release lookup reliability.
+It fixes `#713`, addresses `#703`, and fixes `#724`. Regression testing shows that
+current `master` no longer reproduces the finalize-race behavior reported in `#704` and `#709`.
+
+## What's Changed
+
+### Bug fixes 🐛
+
+* fix: fetch correct asset URL after finalization; test; some refactoring by @pzhlkj6612 in https://github.com/softprops/action-gh-release/pull/738
+* fix: release marked as 'latest' despite make_latest: false by @Boshen in https://github.com/softprops/action-gh-release/pull/715
+* fix: use getReleaseByTag API instead of iterating all releases by @kim-em in https://github.com/softprops/action-gh-release/pull/725
+
+### Other Changes 🔄
+
+* dependency updates, including the ESM/runtime compatibility refresh in https://github.com/softprops/action-gh-release/pull/731
+
+## 2.5.0
+
+## What's Changed
+
+### Exciting New Features 🎉
+
+* feat: mark release as draft until all artifacts are uploaded by @dumbmoron in https://github.com/softprops/action-gh-release/pull/692
+
+### Other Changes 🔄
+
+* dependency updates
+
+## 2.4.2
+
+## What's Changed
+
+### Exciting New Features 🎉
+
+* feat: Ensure generated release notes cannot be over 125000 characters by @BeryJu in https://github.com/softprops/action-gh-release/pull/684
+
+### Other Changes 🔄
+
+* dependency updates
+
+## 2.4.1
+
+## What's Changed
+
+### Other Changes 🔄
+
+* fix(util): support brace expansion globs containing commas in parseInputFiles by @Copilot in https://github.com/softprops/action-gh-release/pull/672
+* fix: gracefully fallback to body when body_path cannot be read by @Copilot in https://github.com/softprops/action-gh-release/pull/671
+
+## 2.4.0
+
+## What's Changed
+
+### Exciting New Features 🎉
+
+* feat(action): respect working_directory for files globs by @stephenway in https://github.com/softprops/action-gh-release/pull/667
+
+## 2.3.4
+
+## What's Changed
+
+### Bug fixes 🐛
+
+* fix(action): handle 422 already_exists race condition by @stephenway in https://github.com/softprops/action-gh-release/pull/665
+
+### Other Changes 🔄
+
+- dependency updates
+
+## 2.3.3
+
+## What's Changed
+
+### Exciting New Features 🎉
+
+* feat: add input option `overwrite_files` by @asfernandes in https://github.com/softprops/action-gh-release/pull/343
+
+### Other Changes 🔄
+
+- dependency updates
+
+## 2.3.2
+
+* fix: revert fs `readableWebStream` change
+
+## 2.3.1
+
+### Bug fixes 🐛
+
+* fix: fix file closing issue by @WailGree in https://github.com/softprops/action-gh-release/pull/629
+
+## 2.3.0
+
+* Migrate from jest to vitest
+* Replace `mime` with `mime-types`
+* Bump to use node 24
+* Dependency updates
+
+## 2.2.2
+
+## What's Changed
+
+### Bug fixes 🐛
+
+* fix: updating release draft status from true to false by @galargh in https://github.com/softprops/action-gh-release/pull/316
+
+### Other Changes 🔄
+
+* chore: simplify ref_type test by @steinybot in https://github.com/softprops/action-gh-release/pull/598
+* fix(docs): clarify the default for tag_name by @muzimuzhi in https://github.com/softprops/action-gh-release/pull/599
+* test(release): add unit tests when searching for a release by @rwaskiewicz in https://github.com/softprops/action-gh-release/pull/603
+* dependency updates
+
+## 2.2.1
+
+## What's Changed
+
+### Bug fixes 🐛
+
+* fix: big file uploads by @xen0n in https://github.com/softprops/action-gh-release/pull/562
+
+### Other Changes 🔄
+* chore(deps): bump @types/node from 22.10.1 to 22.10.2 by @dependabot in https://github.com/softprops/action-gh-release/pull/559
+* chore(deps): bump @types/node from 22.10.2 to 22.10.5 by @dependabot in https://github.com/softprops/action-gh-release/pull/569
+* chore: update error and warning messages for not matching files in files field by @ytimocin in https://github.com/softprops/action-gh-release/pull/568
+
+## 2.2.0
+
+## What's Changed
+
+### Exciting New Features 🎉
+
+* feat: read the release assets asynchronously by @xen0n in https://github.com/softprops/action-gh-release/pull/552
+
+### Bug fixes 🐛
+
+* fix(docs): clarify the default for tag_name by @alexeagle in https://github.com/softprops/action-gh-release/pull/544
+
+### Other Changes 🔄
+
+* chore(deps): bump typescript from 5.6.3 to 5.7.2 by @dependabot in https://github.com/softprops/action-gh-release/pull/548
+* chore(deps): bump @types/node from 22.9.0 to 22.9.4 by @dependabot in https://github.com/softprops/action-gh-release/pull/547
+* chore(deps): bump cross-spawn from 7.0.3 to 7.0.6 by @dependabot in https://github.com/softprops/action-gh-release/pull/545
+* chore(deps): bump @vercel/ncc from 0.38.2 to 0.38.3 by @dependabot in https://github.com/softprops/action-gh-release/pull/543
+* chore(deps): bump prettier from 3.3.3 to 3.4.1 by @dependabot in https://github.com/softprops/action-gh-release/pull/550
+* chore(deps): bump @types/node from 22.9.4 to 22.10.1 by @dependabot in https://github.com/softprops/action-gh-release/pull/551
+* chore(deps): bump prettier from 3.4.1 to 3.4.2 by @dependabot in https://github.com/softprops/action-gh-release/pull/554
+
+## 2.1.0
+
+## What's Changed
+
+### Exciting New Features 🎉
+* feat: add support for release assets with multiple spaces within the name by @dukhine in https://github.com/softprops/action-gh-release/pull/518
+* feat: preserve upload order by @richarddd in https://github.com/softprops/action-gh-release/pull/500
+
+### Other Changes 🔄
+* chore(deps): bump @types/node from 22.8.2 to 22.8.7 by @dependabot in https://github.com/softprops/action-gh-release/pull/539
+
+## 2.0.9
+
+- maintenance release with updated dependencies
+
+## 2.0.8
+
+### Other Changes 🔄
+* chore(deps): bump prettier from 2.8.0 to 3.3.3 by @dependabot in https://github.com/softprops/action-gh-release/pull/480
+* chore(deps): bump @types/node from 20.14.9 to 20.14.11 by @dependabot in https://github.com/softprops/action-gh-release/pull/483
+* chore(deps): bump @octokit/plugin-throttling from 9.3.0 to 9.3.1 by @dependabot in https://github.com/softprops/action-gh-release/pull/484
+* chore(deps): bump glob from 10.4.2 to 11.0.0 by @dependabot in https://github.com/softprops/action-gh-release/pull/477
+* refactor: write jest config in ts by @chenrui333 in https://github.com/softprops/action-gh-release/pull/485
+* chore(deps): bump @actions/github from 5.1.1 to 6.0.0 by @dependabot in https://github.com/softprops/action-gh-release/pull/470
+
+## 2.0.7
+
+### Bug fixes 🐛
+
+* Fix missing update release body by @FirelightFlagboy in https://github.com/softprops/action-gh-release/pull/365
+
+### Other Changes 🔄
+
+* Bump @octokit/plugin-retry from 4.0.3 to 7.1.1 by @dependabot in https://github.com/softprops/action-gh-release/pull/443
+* Bump typescript from 4.9.5 to 5.5.2 by @dependabot in https://github.com/softprops/action-gh-release/pull/467
+* Bump @types/node from 20.14.6 to 20.14.8 by @dependabot in https://github.com/softprops/action-gh-release/pull/469
+* Bump @types/node from 20.14.8 to 20.14.9 by @dependabot in https://github.com/softprops/action-gh-release/pull/473
+* Bump typescript from 5.5.2 to 5.5.3 by @dependabot in https://github.com/softprops/action-gh-release/pull/472
+* Bump ts-jest from 29.1.5 to 29.2.2 by @dependabot in https://github.com/softprops/action-gh-release/pull/479
+* docs: document that existing releases are updated by @jvanbruegge in https://github.com/softprops/action-gh-release/pull/474
+
+## 2.0.6
+
+- maintenance release with updated dependencies
+
+## 2.0.5
+
+- Factor in file names with spaces when upserting files [#446](https://github.com/softprops/action-gh-release/pull/446) via [@MystiPanda](https://github.com/MystiPanda)
+- Improvements to error handling [#449](https://github.com/softprops/action-gh-release/pull/449) via [@till](https://github.com/till)
+
+## 2.0.4
+
+- Minor follow up to [#417](https://github.com/softprops/action-gh-release/pull/417). [#425](https://github.com/softprops/action-gh-release/pull/425)
+
+## 2.0.3
+
+- Declare `make_latest` as an input field in `action.yml` [#419](https://github.com/softprops/action-gh-release/pull/419)
+
+## 2.0.2
+
+- Revisit approach to [#384](https://github.com/softprops/action-gh-release/pull/384) making unresolved pattern failures opt-in [#417](https://github.com/softprops/action-gh-release/pull/417)
+
+## 2.0.1
+
+- Add support for make_latest property [#304](https://github.com/softprops/action-gh-release/pull/304) via [@samueljseay](https://github.com/samueljseay)
+- Fail run if files setting contains invalid patterns [#384](https://github.com/softprops/action-gh-release/pull/384) via [@rpdelaney](https://github.com/rpdelaney)
+- Add support for proxy env variables (don't use node-fetch) [#386](https://github.com/softprops/action-gh-release/pull/386/) via [@timor-raiman](https://github.com/timor-raiman)
+- Suppress confusing warning when input_files is empty [#389](https://github.com/softprops/action-gh-release/pull/389) via [@Drowze](https://github.com/Drowze)
+
+## 2.0.0
+
+- `2.0.0`!? this release corrects a disjunction between git tag versions used in the marketplace and the versions listed in this file. Previous versions should have really been 1.\*. Going forward this should be better aligned.
+- Upgrade action.yml declaration to node20 to address deprecations
+
+## 0.1.15
+
+- Upgrade to action.yml declaration to node16 to address deprecations
+- Upgrade dependencies
+- Add `asset` output as a JSON array containing information about the uploaded assets
+
+## 0.1.14
+
+- provides a new workflow input option `generate_release_notes` which when set to true will automatically generate release notes for you based on GitHub activity [#179](https://github.com/softprops/action-gh-release/pull/179). Please see the [GitHub docs for this feature](https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes) for more information
+
+## 0.1.13
+
+- fix issue with multiple runs concatenating release bodies [#145](https://github.com/softprops/action-gh-release/pull/145)
+
+## 0.1.12
+
+- fix bug leading to empty strings substituted for inputs users don't provide breaking api calls [#144](https://github.com/softprops/action-gh-release/pull/144)
+
+## 0.1.11
+
+- better error message on release create failed [#143](https://github.com/softprops/action-gh-release/pull/143)
+
+## 0.1.10
+
+- fixed error message formatting for file uploads
+
+## 0.1.9
+
+- add support for linking release to GitHub discussion [#136](https://github.com/softprops/action-gh-release/pull/136)
+
+## 0.1.8
+
+- address recent warnings in assert upload api as well as introduce asset upload overrides, allowing for multiple runs for the same release with the same named asserts [#134](https://github.com/softprops/action-gh-release/pull/134)
+- fix backwards compatibility with `GITHUB_TOKEN` resolution. `GITHUB_TOKEN` is now resolved first from an env variable and then from an input [#133](https://github.com/softprops/action-gh-release/pull/133)
+- trim white space in provided `tag_name` [#130](https://github.com/softprops/action-gh-release/pull/130)
+
+## 0.1.7
+
+- allow creating draft releases without a tag [#95](https://github.com/softprops/action-gh-release/pull/95)
+- Set default token for simpler setup [#83](https://github.com/softprops/action-gh-release/pull/83)
+- fix regression with action yml [#126](https://github.com/softprops/action-gh-release/pull/126)
+
+## 0.1.6
+
+This is a release catch up have a hiatus. Future releases will happen more frequently
+
+- Add 'fail_on_unmatched_files' input, useful for catching cases where your `files` input does not actually match what you expect [#55](https://github.com/softprops/action-gh-release/pull/55)
+- Add `repository` input, useful for creating a release in an external repository [#61](https://github.com/softprops/action-gh-release/pull/61)
+- Add release `id` to outputs, useful for referring to release in workflow steps following the step that uses this action [#60](https://github.com/softprops/action-gh-release/pull/60)
+- Add `upload_url` as action output, useful for managing uploads separately [#75](https://github.com/softprops/action-gh-release/pull/75)
+- Support custom `target_commitish` value, useful to customize the default [#76](https://github.com/softprops/action-gh-release/pull/76)
+- fix `body_path` input first then fall back on `body` input. This was the originally documented precedence but was implemented in the opposite order! [#85](https://github.com/softprops/action-gh-release/pull/85)
+- Retain original release info if the keys are not set, useful for filling in blanks for a release you've already started separately [#109](https://github.com/softprops/action-gh-release/pull/109)
+- Limit number of times github api request to create a release is retried, useful for avoiding eating up your rate limit and action minutes due to either an invalid token or other circumstance causing the api call to fail [#111](https://github.com/softprops/action-gh-release/pull/111)
+
+## 0.1.5
+
+- Added support for specifying tag name [#39](https://github.com/softprops/action-gh-release/pull/39)
+
+## 0.1.4
+
+- Added support for updating releases body [#36](https://github.com/softprops/action-gh-release/pull/36)
+- Steps can now access the url of releases with the `url` output of this Action [#28](https://github.com/softprops/action-gh-release/pull/28)
+- Added basic GitHub API retry support to manage API turbulence [#26](https://github.com/softprops/action-gh-release/pull/26)
+
+## 0.1.3
+
+- Fixed where `with: body_path` was not being used in generated GitHub releases
+
+## 0.1.2
+
+- Add support for merging draft releases [#16](https://github.com/softprops/action-gh-release/pull/16)
+
+GitHub's api doesn't explicitly have a way of fetching a draft release by tag name which caused draft releases to appear as separate releases when used in a build matrix.
+This is now fixed.
+
+- Add support for newline-delimited asset list [#18](https://github.com/softprops/action-gh-release/pull/18)
+
+GitHub actions inputs don't inherently support lists of things and one might like to append a list of files to include in a release. Previously this was possible using a comma-delimited list of asset path patterns to upload. You can now provide these as a newline delimited list for better readability
+
+```yaml
+- name: Release
+  uses: softprops/action-gh-release@v1
+  if: startsWith(github.ref, 'refs/tags/')
+  with:
+    files: |
+      filea.txt
+      fileb.txt
+      filec.txt
+  env:
+    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+```
+
+- Add support for prerelease annotated GitHub releases with the new input field `with.prerelease: true` [#19](https://github.com/softprops/action-gh-release/pull/19)
+
+---
 
 ## 0.1.1
 
-* Add support for publishing releases on all supported virtual hosts
+- Add support for publishing releases on all supported virtual hosts
 
-You'll need to remove `docker://` prefix and use the `@v1` action tag
+You'll need to remove `docker://` prefix and use the `@v1` action tag
+
+---
+
+## 0.1.0
+
+- Initial release

CONTRIBUTING.md

@@ -0,0 +1,17 @@
+## bootstrapping
+
+This a [JavaScript](https://help.github.com/en/articles/about-actions#types-of-actions) action but uses [TypeScript](https://www.typescriptlang.org/docs/home.html) to generate that JavaScript.
+
+You can bootstrap your environment with a modern version of npm and by running `npm i` at the root of this repo.
+
+## testing
+
+Tests can be found under under `__tests__` directory and are runnable with the `npm t` command.
+
+## source code
+
+Source code can be found under the `src` directory. Running `npm run build` will generate the JavaScript that will run within GitHub workflows.
+
+## formatting
+
+A minimal attempt at keeping a consistent code style is can be applied by running `npm run fmt`.

LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2019 Doug Tangren
+Copyright (c) 2019-current Doug Tangren
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

README.md

@@ -1,11 +1,35 @@
+<div align="center">
+  📦 :octocat:
+</div>
+<h1 align="center">
+  action gh-release
+</h1>
 
-# action gh-release [![](https://github.com/softprops/action-gh-release/workflows/Main/badge.svg)](https://github.com/softprops/action-gh-release/actions)
+<p align="center">
+   A GitHub Action for creating GitHub Releases on Linux, Windows, and macOS virtual environments
+</p>
 
-> A GitHub Action for creating GitHub Releases
+<div align="center">
+  <img src="demo.png"/>
+</div>
 
-> **⚠️ Note:** To use this action, you must have access to the [GitHub Actions](https://github.com/features/actions) feature. GitHub Actions are currently only available in public beta. You can [apply for the GitHub Actions beta here](https://github.com/features/actions/signup/).
+<div align="center">
+  <a href="https://github.com/softprops/action-gh-release/actions">
+		<img src="https://github.com/softprops/action-gh-release/workflows/Main/badge.svg"/>
+	</a>
+</div>
 
-> **⚠️ Note:** This action was previously implemented as a docker container, limiting its use to GitHub Actions Linux virtual environments only. With recent releases, we now support cross platform usage. You'll need to remove the `docker://` prefix in these versions
+<br />
+
+- [🤸 Usage](#-usage)
+  - [🚥 Limit releases to pushes to tags](#-limit-releases-to-pushes-to-tags)
+  - [⬆️ Uploading release assets](#️-uploading-release-assets)
+  - [📝 External release notes](#-external-release-notes)
+  - [💅 Customizing](#-customizing)
+    - [inputs](#inputs)
+    - [outputs](#outputs)
+    - [environment variables](#environment-variables)
+  - [Permissions](#permissions)
 
 ## 🤸 Usage
 
@@ -13,7 +37,7 @@
 
 Typically usage of this action involves adding a step to a build that
 is gated pushes to git tags. You may find `step.if` field helpful in accomplishing this
-as it maximizes the resuse value of your workflow for non-tag pushes.
+as it maximizes the reuse value of your workflow for non-tag pushes.
 
 Below is a simple example of `step.if` tag gating
 
@@ -27,12 +51,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@master
+        uses: actions/checkout@v6
       - name: Release
-        uses: softprops/action-gh-release@v1
-        if: startsWith(github.ref, 'refs/tags/')
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: softprops/action-gh-release@v2
+        if: github.ref_type == 'tag'
 ```
 
 You can also use push config tag filter
@@ -43,29 +65,27 @@ name: Main
 on:
   push:
     tags:
-      - 'v*.*.*'
+      - "v*.*.*"
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@master
+        uses: actions/checkout@v6
       - name: Release
-        uses: softprops/action-gh-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: softprops/action-gh-release@v2
 ```
 
-
 ### ⬆️ Uploading release assets
 
-You can can configure a number of options for your
+You can configure a number of options for your
 GitHub release and all are optional.
 
 A common case for GitHub releases is to upload your binary after its been validated and packaged.
-Use the `with.files` input to declare a comma-separated list of glob expressions matching the files
+Use the `with.files` input to declare a newline-delimited list of glob expressions matching the files
 you wish to upload to GitHub releases. If you'd like you can just list the files by name directly.
+If a tag already has a GitHub release, the existing release will be updated with the release assets.
 
 Below is an example of uploading a single asset named `Release.txt`
 
@@ -79,20 +99,48 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@master
+        uses: actions/checkout@v6
       - name: Build
         run: echo ${{ github.sha }} > Release.txt
       - name: Test
         run: cat Release.txt
       - name: Release
-        uses: softprops/action-gh-release@v1
-        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v2
+        if: github.ref_type == 'tag'
         with:
           files: Release.txt
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 ```
 
+Below is an example of uploading more than one asset with a GitHub release
+
+```yaml
+name: Main
+
+on: push
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Build
+        run: echo ${{ github.sha }} > Release.txt
+      - name: Test
+        run: cat Release.txt
+      - name: Release
+        uses: softprops/action-gh-release@v2
+        if: github.ref_type == 'tag'
+        with:
+          files: |
+            Release.txt
+            LICENSE
+```
+
+> **⚠️ Note:** Notice the `|` in the yaml syntax above ☝️. That lets you effectively declare a multi-line yaml string. You can learn more about multi-line yaml syntax [here](https://yaml-multiline.info)
+
+> **⚠️ Note for Windows:** Paths must use `/` as a separator, not `\`, as `\` is used to escape characters with special meaning in the pattern; for example, instead of specifying `D:\Foo.txt`, you must specify `D:/Foo.txt`. If you're using PowerShell, you can do this with `$Path = $Path -replace '\\','/'`
+
 ### 📝 External release notes
 
 Many systems exist that can help generate release notes for you. This action supports
@@ -109,16 +157,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@master
+        uses: actions/checkout@v6
       - name: Generate Changelog
-        run: echo "# Good things have arrived" > ${{ github.workflow }}-CHANGELOG.txt
+        run: echo "# Good things have arrived" > ${{ github.workspace }}-CHANGELOG.txt
       - name: Release
-        uses: softprops/action-gh-release@v1
-        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v2
+        if: github.ref_type == 'tag'
         with:
-          body_path: ${{ github.workflow }}-CHANGELOG.txt
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          body_path: ${{ github.workspace }}-CHANGELOG.txt
+          repository: my_gh_org/my_gh_repo
+          # note you'll typically need to create a personal access token
+          # with permissions to create releases in the other repo
+          token: ${{ secrets.CUSTOM_GITHUB_TOKEN }}
 ```
 
 ### 💅 Customizing
@@ -127,22 +177,77 @@ jobs:
 
 The following are optional as `step.with` keys
 
-| Name        | Type    | Description                                                     |
-|-------------|---------|-----------------------------------------------------------------|
-| `body`      | String  | Text communicating notable changes in this release              |
-| `body_path` | String  | Path to load text communicating notable changes in this release |
-| `draft`     | Boolean | Indicator of whether or not this release is a draft             |
-| `files`     | String  | Comma-delimited globs of paths to assets to upload for release  |
-| `name`      | String  | Name of the release. defaults to tag name                       |
+| Name                       | Type    | Description                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| -------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `body`                     | String  | Text communicating notable changes in this release                                                                                                                                                                                                                                                                                                                                                                                              |
+| `body_path`                | String  | Path to load text communicating notable changes in this release                                                                                                                                                                                                                                                                                                                                                                                 |
+| `draft`                    | Boolean | Indicator of whether or not this release is a draft                                                                                                                                                                                                                                                                                                                                                                                             |
+| `prerelease`               | Boolean | Indicator of whether or not is a prerelease                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `preserve_order`           | Boolean | Indicator of whether order of files should be preserved when uploading assets                                                                                                                                                                                                                                                                                                                                                                   |
+| `files`                    | String  | Newline-delimited globs of paths to assets to upload for release                                                                                                                                                                                                                                                                                                                                                                                |
+| `overwrite_files`          | Boolean | Indicator of whether files should be overwritten when they already exist. Defaults to true                                                                                                                                                                                                                                                                                                                                                      |
+| `name`                     | String  | Name of the release. defaults to tag name                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `tag_name`                 | String  | Name of a tag. defaults to `github.ref_name`                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `fail_on_unmatched_files`  | Boolean | Indicator of whether to fail if any of the `files` globs match nothing                                                                                                                                                                                                                                                                                                                                                                          |
+| `repository`               | String  | Name of a target repository in `<owner>/<repo>` format. Defaults to GITHUB_REPOSITORY env variable                                                                                                                                                                                                                                                                                                                                              |
+| `target_commitish`         | String  | Commitish value that determines where the Git tag is created from. Can be any branch or commit SHA. Defaults to repository default branch.                                                                                                                                                                                                                                                                                                      |
+| `token`                    | String  | Secret GitHub Personal Access Token. Defaults to `${{ github.token }}`                                                                                                                                                                                                                                                                                                                                                                          |
+| `discussion_category_name` | String  | If specified, a discussion of the specified category is created and linked to the release. The value must be a category that already exists in the repository. For more information, see ["Managing categories for discussions in your repository."](https://docs.github.com/en/discussions/managing-discussions-for-your-community/managing-categories-for-discussions-in-your-repository)                                                     |
+| `generate_release_notes`   | Boolean | Whether to automatically generate the name and body for this release. If name is specified, the specified name will be used; otherwise, a name will be automatically generated. If body is specified, the body will be pre-pended to the automatically generated notes. See the [GitHub docs for this feature](https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes) for more information |
+| `append_body`              | Boolean | Append to existing body instead of overwriting it                                                                                                                                                                                                                                                                                                                                                                                               |
+| `make_latest`              | String  | Specifies whether this release should be set as the latest release for the repository. Drafts and prereleases cannot be set as latest. Can be `true`, `false`, or `legacy`. Uses GitHub api defaults if not provided                                                                                                                                                                                                                            |
 
-💡When providing a `body` and `body_path` at the same time, `body_path` will be attempted first, then falling back on `body` if the path can not be read from.
+💡 When providing a `body` and `body_path` at the same time, `body_path` will be
+attempted first, then falling back on `body` if the path can not be read from.
+
+💡 When the release info keys (such as `name`, `body`, `draft`, `prerelease`, etc.)
+are not explicitly set and there is already an existing release for the tag, the
+release will retain its original info.
+
+#### outputs
+
+The following outputs can be accessed via `${{ steps.<step-id>.outputs }}` from this action
+
+| Name         | Type   | Description                                                                                                                                                                               |
+| ------------ | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `url`        | String | Github.com URL for the release                                                                                                                                                            |
+| `id`         | String | Release ID                                                                                                                                                                                |
+| `upload_url` | String | URL for uploading assets to the release                                                                                                                                                   |
+| `assets`     | String | JSON array containing information about each updated (newly uploaded or overwritten) asset, in the format given [here](https://docs.github.com/en/rest/releases/assets#get-a-release-asset) (minus the `uploader` field) |
+
+As an example, you can use `${{ fromJSON(steps.<step-id>.outputs.assets)[0].browser_download_url }}` to get the download URL of the first asset.
 
 #### environment variables
 
-The following are *required* as `step.env` keys
+The following `step.env` keys are allowed as a fallback but deprecated in favor of using inputs.
 
-| Name           | Description                          |
-|----------------|--------------------------------------|
-| `GITHUB_TOKEN` | GITHUB_TOKEN as provided by `secrets`|
+| Name                | Description                                                                                |
+| ------------------- | ------------------------------------------------------------------------------------------ |
+| `GITHUB_TOKEN`      | GITHUB_TOKEN as provided by `secrets`                                                      |
+| `GITHUB_REPOSITORY` | Name of a target repository in `<owner>/<repo>` format. defaults to the current repository |
+
+> **⚠️ Note:** This action was previously implemented as a Docker container, limiting its use to GitHub Actions Linux virtual environments only. With recent releases, we now support cross platform usage. You'll need to remove the `docker://` prefix in these versions
+
+### Permissions
+
+This Action requires the following permissions on the GitHub integration token:
+
+```yaml
+permissions:
+  contents: write
+```
+
+When used with `discussion_category_name`, additional permission is needed:
+
+```yaml
+permissions:
+  contents: write
+  discussions: write
+```
+
+[GitHub token permissions](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) can be set for an individual job, workflow, or for Actions as a whole.
+
+Note that if you intend to run workflows on the release event (`on: { release: { types: [published] } }`), you need to use
+a personal access token for this action, as the [default `secrets.GITHUB_TOKEN` does not trigger another workflow](https://github.com/actions/create-release/issues/71).
 
 Doug Tangren (softprops) 2019

__tests__/github.test.ts

@@ -1,25 +1,732 @@
-//import * as assert from "assert";
-//const assert = require('assert');
-import * as assert from "assert";
-import { mimeOrDefault, asset } from "../src/github";
+import {
+  asset,
+  findTagFromReleases,
+  finalizeRelease,
+  mimeOrDefault,
+  release,
+  Release,
+  Releaser,
+  upload,
+} from '../src/github';
 
-describe("github", () => {
-  describe("mimeOrDefault", () => {
-    it("returns a specific mime for common path", async () => {
-      assert.equal(mimeOrDefault("foo.tar.gz"), "application/gzip");
+import { mkdtempSync, rmSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { assert, describe, expect, it, vi } from 'vitest';
+
+describe('github', () => {
+  const config = {
+    github_token: 'test-token',
+    github_ref: 'refs/tags/v1.0.0',
+    github_repository: 'owner/repo',
+    input_tag_name: undefined,
+    input_name: undefined,
+    input_body: undefined,
+    input_body_path: undefined,
+    input_files: [],
+    input_draft: undefined,
+    input_prerelease: undefined,
+    input_preserve_order: undefined,
+    input_overwrite_files: undefined,
+    input_fail_on_unmatched_files: false,
+    input_target_commitish: undefined,
+    input_discussion_category_name: undefined,
+    input_generate_release_notes: false,
+    input_append_body: false,
+    input_make_latest: undefined,
+  };
+
+  describe('mimeOrDefault', () => {
+    it('returns a specific mime for common path', async () => {
+      assert.equal(mimeOrDefault('foo.tar.gz'), 'application/gzip');
     });
-    it("returns default mime for uncommon path", async () => {
-      assert.equal(mimeOrDefault("foo.uncommon"), "application/octet-stream");
+    it('returns default mime for uncommon path', async () => {
+      assert.equal(mimeOrDefault('foo.uncommon'), 'application/octet-stream');
     });
   });
 
-  describe("asset", () => {
-    it("derives asset info from a path", async () => {
-      const { name, mime, size, file } = asset("tests/data/foo/bar.txt");
-      assert.equal(name, "bar.txt");
-      assert.equal(mime, "text/plain");
+  describe('asset', () => {
+    it('derives asset info from a path', async () => {
+      const { name, mime, size } = asset('tests/data/foo/bar.txt');
+      assert.equal(name, 'bar.txt');
+      assert.equal(mime, 'text/plain');
       assert.equal(size, 10);
-      assert.equal(file.toString(), "release me");
+    });
+  });
+
+  describe('findTagFromReleases', () => {
+    const owner = 'owner';
+    const repo = 'repo';
+
+    const mockRelease: Release = {
+      id: 1,
+      upload_url: `https://api.github.com/repos/${owner}/${repo}/releases/1/assets`,
+      html_url: `https://github.com/${owner}/${repo}/releases/tag/v1.0.0`,
+      tag_name: 'v1.0.0',
+      name: 'Test Release',
+      body: 'Test body',
+      target_commitish: 'main',
+      draft: false,
+      prerelease: false,
+      assets: [],
+    } as const;
+
+    const mockReleaser: Releaser = {
+      getReleaseByTag: () => Promise.reject({ status: 404 }),
+      createRelease: () => Promise.reject('Not implemented'),
+      updateRelease: () => Promise.reject('Not implemented'),
+      finalizeRelease: () => Promise.reject('Not implemented'),
+      allReleases: async function* () {
+        yield { data: [mockRelease] };
+      },
+      listReleaseAssets: () => Promise.reject('Not implemented'),
+      deleteReleaseAsset: () => Promise.reject('Not implemented'),
+      deleteRelease: () => Promise.reject('Not implemented'),
+      updateReleaseAsset: () => Promise.reject('Not implemented'),
+      uploadReleaseAsset: () => Promise.reject('Not implemented'),
+    } as const;
+
+    it('finds a release by tag using direct API lookup', async () => {
+      const targetTag = 'v1.0.0';
+      const targetRelease = {
+        ...mockRelease,
+        tag_name: targetTag,
+      };
+
+      const releaser = {
+        ...mockReleaser,
+        getReleaseByTag: () => Promise.resolve({ data: targetRelease }),
+      };
+
+      const result = await findTagFromReleases(releaser, owner, repo, targetTag);
+
+      assert.deepStrictEqual(result, targetRelease);
+    });
+
+    it('returns undefined when release is not found (404)', async () => {
+      const releaser = {
+        ...mockReleaser,
+        getReleaseByTag: () => Promise.reject({ status: 404 }),
+      };
+
+      const result = await findTagFromReleases(releaser, owner, repo, 'nonexistent');
+
+      assert.strictEqual(result, undefined);
+    });
+
+    it('re-throws non-404 errors', async () => {
+      const releaser = {
+        ...mockReleaser,
+        getReleaseByTag: () => Promise.reject({ status: 500, message: 'Server error' }),
+      };
+
+      try {
+        await findTagFromReleases(releaser, owner, repo, 'v1.0.0');
+        assert.fail('Expected an error to be thrown');
+      } catch (error) {
+        assert.strictEqual(error.status, 500);
+      }
+    });
+
+    it('finds a release with empty tag name', async () => {
+      const emptyTag = '';
+      const targetRelease = {
+        ...mockRelease,
+        tag_name: emptyTag,
+      };
+
+      const releaser = {
+        ...mockReleaser,
+        getReleaseByTag: () => Promise.resolve({ data: targetRelease }),
+      };
+
+      const result = await findTagFromReleases(releaser, owner, repo, emptyTag);
+
+      assert.deepStrictEqual(result, targetRelease);
+    });
+  });
+
+  describe('finalizeRelease input_draft behavior', () => {
+    const draftRelease: Release = {
+      id: 1,
+      upload_url: 'test',
+      html_url: 'test',
+      tag_name: 'v1.0.0',
+      name: 'test',
+      body: 'test',
+      target_commitish: 'main',
+      draft: true,
+      prerelease: false,
+      assets: [],
+    };
+
+    const finalizedRelease: Release = {
+      ...draftRelease,
+      draft: false,
+    };
+    const publishedPrerelease: Release = {
+      ...draftRelease,
+      draft: false,
+      prerelease: true,
+    };
+
+    it.each([
+      {
+        name: 'returns early when input_draft is true',
+        input_draft: true,
+        release: draftRelease,
+        expectedCalls: 0,
+        expectedResult: draftRelease,
+      },
+      {
+        name: 'finalizes release when input_draft is false',
+        input_draft: false,
+        release: draftRelease,
+        expectedCalls: 1,
+        expectedResult: finalizedRelease,
+      },
+      {
+        name: 'returns early when release is already published',
+        input_draft: false,
+        release: publishedPrerelease,
+        expectedCalls: 0,
+        expectedResult: publishedPrerelease,
+      },
+    ])('$name', async ({ input_draft, release, expectedCalls, expectedResult }) => {
+      const finalizeReleaseSpy = vi.fn(async () => ({ data: finalizedRelease }));
+
+      const releaser: Releaser = {
+        getReleaseByTag: () => Promise.reject('Not implemented'),
+        createRelease: () => Promise.reject('Not implemented'),
+        updateRelease: () => Promise.reject('Not implemented'),
+        finalizeRelease: finalizeReleaseSpy,
+        allReleases: async function* () {
+          throw new Error('Not implemented');
+        },
+        listReleaseAssets: () => Promise.reject('Not implemented'),
+        deleteReleaseAsset: () => Promise.reject('Not implemented'),
+        deleteRelease: () => Promise.reject('Not implemented'),
+        updateReleaseAsset: () => Promise.reject('Not implemented'),
+        uploadReleaseAsset: () => Promise.reject('Not implemented'),
+      };
+
+      const result = await finalizeRelease(
+        {
+          ...config,
+          input_draft,
+        },
+        releaser,
+        release,
+      );
+
+      expect(finalizeReleaseSpy).toHaveBeenCalledTimes(expectedCalls);
+      assert.strictEqual(result, expectedResult);
+
+      if (expectedCalls === 1) {
+        expect(finalizeReleaseSpy).toHaveBeenCalledWith({
+          owner: 'owner',
+          repo: 'repo',
+          release_id: release.id,
+        });
+      }
+    });
+
+    it('deletes a newly created draft when tag creation is blocked by repository rules', async () => {
+      const finalizeReleaseSpy = vi.fn(async () => {
+        throw {
+          status: 422,
+          response: {
+            data: {
+              errors: [
+                {
+                  field: 'pre_receive',
+                  message:
+                    'pre_receive Repository rule violations found\n\nCannot create ref due to creations being restricted.\n\n',
+                },
+              ],
+            },
+          },
+        };
+      });
+      const deleteReleaseSpy = vi.fn(async () => undefined);
+
+      const releaser: Releaser = {
+        getReleaseByTag: () => Promise.reject('Not implemented'),
+        createRelease: () => Promise.reject('Not implemented'),
+        updateRelease: () => Promise.reject('Not implemented'),
+        finalizeRelease: finalizeReleaseSpy,
+        allReleases: async function* () {
+          throw new Error('Not implemented');
+        },
+        listReleaseAssets: () => Promise.reject('Not implemented'),
+        deleteReleaseAsset: () => Promise.reject('Not implemented'),
+        deleteRelease: deleteReleaseSpy,
+        updateReleaseAsset: () => Promise.reject('Not implemented'),
+        uploadReleaseAsset: () => Promise.reject('Not implemented'),
+      };
+
+      await expect(
+        finalizeRelease(
+          {
+            ...config,
+            input_draft: false,
+          },
+          releaser,
+          draftRelease,
+          true,
+        ),
+      ).rejects.toThrow(
+        'Tag creation for v1.0.0 is blocked by repository rules. Deleted draft release 1 to avoid leaving an orphaned draft release.',
+      );
+
+      expect(finalizeReleaseSpy).toHaveBeenCalledTimes(1);
+      expect(deleteReleaseSpy).toHaveBeenCalledWith({
+        owner: 'owner',
+        repo: 'repo',
+        release_id: draftRelease.id,
+      });
+    });
+
+    it('does not delete an existing draft release when tag creation is blocked by repository rules', async () => {
+      const finalizeReleaseSpy = vi.fn(async () => {
+        throw {
+          status: 422,
+          response: {
+            data: {
+              errors: [
+                {
+                  field: 'pre_receive',
+                  message:
+                    'pre_receive Repository rule violations found\n\nCannot create ref due to creations being restricted.\n\n',
+                },
+              ],
+            },
+          },
+        };
+      });
+      const deleteReleaseSpy = vi.fn(async () => undefined);
+
+      const releaser: Releaser = {
+        getReleaseByTag: () => Promise.reject('Not implemented'),
+        createRelease: () => Promise.reject('Not implemented'),
+        updateRelease: () => Promise.reject('Not implemented'),
+        finalizeRelease: finalizeReleaseSpy,
+        allReleases: async function* () {
+          throw new Error('Not implemented');
+        },
+        listReleaseAssets: () => Promise.reject('Not implemented'),
+        deleteReleaseAsset: () => Promise.reject('Not implemented'),
+        deleteRelease: deleteReleaseSpy,
+        updateReleaseAsset: () => Promise.reject('Not implemented'),
+        uploadReleaseAsset: () => Promise.reject('Not implemented'),
+      };
+
+      await expect(
+        finalizeRelease(
+          {
+            ...config,
+            input_draft: false,
+          },
+          releaser,
+          draftRelease,
+          false,
+          1,
+        ),
+      ).rejects.toThrow('Too many retries.');
+
+      expect(finalizeReleaseSpy).toHaveBeenCalledTimes(1);
+      expect(deleteReleaseSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('error handling', () => {
+    it('creates published prereleases without the forced draft-first path', async () => {
+      const prereleaseConfig = {
+        ...config,
+        input_prerelease: true,
+        input_draft: false,
+      };
+      const createdRelease: Release = {
+        id: 1,
+        upload_url: 'test',
+        html_url: 'test',
+        tag_name: 'v1.0.0',
+        name: 'test',
+        body: 'test',
+        target_commitish: 'main',
+        draft: false,
+        prerelease: true,
+        assets: [],
+      };
+
+      const createReleaseSpy = vi.fn(async () => ({ data: createdRelease }));
+      const mockReleaser: Releaser = {
+        getReleaseByTag: () => Promise.reject({ status: 404 }),
+        createRelease: createReleaseSpy,
+        updateRelease: () => Promise.reject('Not implemented'),
+        finalizeRelease: () => Promise.reject('Not implemented'),
+        allReleases: async function* () {
+          yield { data: [createdRelease] };
+        },
+        listReleaseAssets: () => Promise.reject('Not implemented'),
+        deleteReleaseAsset: () => Promise.reject('Not implemented'),
+        deleteRelease: () => Promise.reject('Not implemented'),
+        updateReleaseAsset: () => Promise.reject('Not implemented'),
+        uploadReleaseAsset: () => Promise.reject('Not implemented'),
+      } as const;
+
+      const result = await release(prereleaseConfig, mockReleaser, 1);
+
+      assert.equal(result.release.id, createdRelease.id);
+      assert.equal(result.created, true);
+      expect(createReleaseSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          draft: false,
+          prerelease: true,
+        }),
+      );
+    });
+
+    it('retries upload after deleting conflicting asset on 422 already_exists race', async () => {
+      const uploadReleaseAsset = vi
+        .fn()
+        .mockRejectedValueOnce({
+          status: 422,
+          response: { data: { errors: [{ code: 'already_exists' }] } },
+        })
+        .mockResolvedValueOnce({
+          status: 201,
+          data: { id: 123, name: 'release.txt' },
+        });
+
+      const listReleaseAssets = vi.fn().mockResolvedValue([{ id: 99, name: 'release.txt' }]);
+      const deleteReleaseAsset = vi.fn().mockResolvedValue(undefined);
+
+      const mockReleaser: Releaser = {
+        getReleaseByTag: () => Promise.reject('Not implemented'),
+        createRelease: () => Promise.reject('Not implemented'),
+        updateRelease: () => Promise.reject('Not implemented'),
+        finalizeRelease: () => Promise.reject('Not implemented'),
+        allReleases: async function* () {
+          throw new Error('Not implemented');
+        },
+        listReleaseAssets,
+        deleteReleaseAsset,
+        uploadReleaseAsset,
+      };
+
+      const result = await upload(
+        config,
+        mockReleaser,
+        'https://uploads.github.com/repos/owner/repo/releases/1/assets',
+        '__tests__/release.txt',
+        [],
+      );
+
+      expect(result).toStrictEqual({ id: 123, name: 'release.txt' });
+      expect(listReleaseAssets).toHaveBeenCalledWith({
+        owner: 'owner',
+        repo: 'repo',
+        release_id: 1,
+      });
+      expect(deleteReleaseAsset).toHaveBeenCalledWith({
+        owner: 'owner',
+        repo: 'repo',
+        asset_id: 99,
+      });
+      expect(uploadReleaseAsset).toHaveBeenCalledTimes(2);
+    });
+
+    it('handles 422 already_exists error gracefully', async () => {
+      const existingRelease = {
+        id: 1,
+        upload_url: 'test',
+        html_url: 'test',
+        tag_name: 'v1.0.0',
+        name: 'test',
+        body: 'test',
+        target_commitish: 'main',
+        draft: false,
+        prerelease: false,
+        assets: [],
+      };
+
+      let createAttempts = 0;
+      const mockReleaser: Releaser = {
+        getReleaseByTag: ({ tag }) => {
+          // First call returns 404 (release doesn't exist yet), subsequent calls find it
+          if (createAttempts === 0) {
+            return Promise.reject({ status: 404 });
+          }
+          return Promise.resolve({ data: existingRelease });
+        },
+        createRelease: () => {
+          createAttempts++;
+          return Promise.reject({
+            status: 422,
+            response: { data: { errors: [{ code: 'already_exists' }] } },
+          });
+        },
+        updateRelease: () =>
+          Promise.resolve({
+            data: {
+              id: 1,
+              upload_url: 'test',
+              html_url: 'test',
+              tag_name: 'v1.0.0',
+              name: 'test',
+              body: 'test',
+              target_commitish: 'main',
+              draft: true,
+              prerelease: false,
+              assets: [],
+            },
+          }),
+        finalizeRelease: () => Promise.reject('Not implemented'),
+        allReleases: async function* () {
+          yield { data: [existingRelease] };
+        },
+        listReleaseAssets: () => Promise.reject('Not implemented'),
+        deleteReleaseAsset: () => Promise.reject('Not implemented'),
+        deleteRelease: () => Promise.reject('Not implemented'),
+        uploadReleaseAsset: () => Promise.reject('Not implemented'),
+      } as const;
+
+      const result = await release(config, mockReleaser, 2);
+      assert.ok(result);
+      assert.equal(result.release.id, 1);
+      assert.equal(result.created, false);
+    });
+
+    it('reuses a canonical release after concurrent create success and removes empty duplicates', async () => {
+      const canonicalRelease: Release = {
+        id: 1,
+        upload_url: 'canonical-upload',
+        html_url: 'canonical-html',
+        tag_name: 'v1.0.0',
+        name: 'canonical',
+        body: 'test',
+        target_commitish: 'main',
+        draft: true,
+        prerelease: false,
+        assets: [],
+      };
+      const duplicateRelease: Release = {
+        id: 2,
+        upload_url: 'duplicate-upload',
+        html_url: 'duplicate-html',
+        tag_name: 'v1.0.0',
+        name: 'duplicate',
+        body: 'test',
+        target_commitish: 'main',
+        draft: true,
+        prerelease: false,
+        assets: [],
+      };
+
+      let lookupCount = 0;
+      const deleteReleaseSpy = vi.fn(async () => undefined);
+      const mockReleaser: Releaser = {
+        getReleaseByTag: () => {
+          lookupCount += 1;
+          if (lookupCount === 1) {
+            return Promise.reject({ status: 404 });
+          }
+          return Promise.resolve({ data: canonicalRelease });
+        },
+        createRelease: () => Promise.resolve({ data: duplicateRelease }),
+        updateRelease: () => Promise.reject('Not implemented'),
+        finalizeRelease: () => Promise.reject('Not implemented'),
+        allReleases: async function* () {
+          yield { data: [duplicateRelease, canonicalRelease] };
+        },
+        listReleaseAssets: () => Promise.reject('Not implemented'),
+        deleteReleaseAsset: () => Promise.reject('Not implemented'),
+        deleteRelease: deleteReleaseSpy,
+        updateReleaseAsset: () => Promise.reject('Not implemented'),
+        uploadReleaseAsset: () => Promise.reject('Not implemented'),
+      };
+
+      const result = await release(config, mockReleaser, 2);
+
+      assert.equal(result.release.id, canonicalRelease.id);
+      assert.equal(result.created, false);
+      expect(deleteReleaseSpy).toHaveBeenCalledWith({
+        owner: 'owner',
+        repo: 'repo',
+        release_id: duplicateRelease.id,
+      });
+    });
+
+    it('falls back to recent releases when tag lookup still lags after create', async () => {
+      const canonicalRelease: Release = {
+        id: 1,
+        upload_url: 'canonical-upload',
+        html_url: 'canonical-html',
+        tag_name: 'v1.0.0',
+        name: 'canonical',
+        body: 'test',
+        target_commitish: 'main',
+        draft: true,
+        prerelease: false,
+        assets: [],
+      };
+      const duplicateRelease: Release = {
+        id: 2,
+        upload_url: 'duplicate-upload',
+        html_url: 'duplicate-html',
+        tag_name: 'v1.0.0',
+        name: 'duplicate',
+        body: 'test',
+        target_commitish: 'main',
+        draft: true,
+        prerelease: false,
+        assets: [],
+      };
+
+      const deleteReleaseSpy = vi.fn(async () => undefined);
+      const mockReleaser: Releaser = {
+        getReleaseByTag: () => Promise.reject({ status: 404 }),
+        createRelease: () => Promise.resolve({ data: duplicateRelease }),
+        updateRelease: () => Promise.reject('Not implemented'),
+        finalizeRelease: () => Promise.reject('Not implemented'),
+        allReleases: async function* () {
+          yield { data: [duplicateRelease, canonicalRelease] };
+        },
+        listReleaseAssets: () => Promise.reject('Not implemented'),
+        deleteReleaseAsset: () => Promise.reject('Not implemented'),
+        deleteRelease: deleteReleaseSpy,
+        updateReleaseAsset: () => Promise.reject('Not implemented'),
+        uploadReleaseAsset: () => Promise.reject('Not implemented'),
+      };
+
+      const result = await release(config, mockReleaser, 1);
+
+      assert.equal(result.release.id, canonicalRelease.id);
+      assert.equal(result.created, false);
+      expect(deleteReleaseSpy).toHaveBeenCalledWith({
+        owner: 'owner',
+        repo: 'repo',
+        release_id: duplicateRelease.id,
+      });
+    });
+  });
+
+  describe('upload', () => {
+    it('restores a dotfile label when GitHub normalizes the uploaded asset name', async () => {
+      const tempDir = mkdtempSync(join(tmpdir(), 'gh-release-dotfile-'));
+      const dotfilePath = join(tempDir, '.config');
+      writeFileSync(dotfilePath, 'config');
+
+      const updateReleaseAssetSpy = vi.fn(async () => ({
+        data: {
+          id: 1,
+          name: 'default.config',
+          label: '.config',
+        },
+      }));
+      const releaser: Releaser = {
+        getReleaseByTag: () => Promise.reject('Not implemented'),
+        createRelease: () => Promise.reject('Not implemented'),
+        updateRelease: () => Promise.reject('Not implemented'),
+        finalizeRelease: () => Promise.reject('Not implemented'),
+        allReleases: async function* () {
+          throw new Error('Not implemented');
+        },
+        listReleaseAssets: () => Promise.reject('Not implemented'),
+        deleteReleaseAsset: () => Promise.reject('Not implemented'),
+        deleteRelease: () => Promise.reject('Not implemented'),
+        updateReleaseAsset: updateReleaseAssetSpy,
+        uploadReleaseAsset: () =>
+          Promise.resolve({
+            status: 201,
+            data: {
+              id: 1,
+              name: 'default.config',
+              label: '',
+            },
+          }),
+      };
+
+      try {
+        const result = await upload(
+          config,
+          releaser,
+          'https://uploads.example.test/assets',
+          dotfilePath,
+          [],
+        );
+
+        expect(updateReleaseAssetSpy).toHaveBeenCalledWith({
+          owner: 'owner',
+          repo: 'repo',
+          asset_id: 1,
+          name: 'default.config',
+          label: '.config',
+        });
+        expect(result).toEqual({
+          id: 1,
+          name: 'default.config',
+          label: '.config',
+        });
+      } finally {
+        rmSync(tempDir, { recursive: true, force: true });
+      }
+    });
+
+    it('matches an existing asset by label when overwriting a dotfile', async () => {
+      const tempDir = mkdtempSync(join(tmpdir(), 'gh-release-dotfile-'));
+      const dotfilePath = join(tempDir, '.config');
+      writeFileSync(dotfilePath, 'config');
+
+      const deleteReleaseAssetSpy = vi.fn(async () => undefined);
+      const releaser: Releaser = {
+        getReleaseByTag: () => Promise.reject('Not implemented'),
+        createRelease: () => Promise.reject('Not implemented'),
+        updateRelease: () => Promise.reject('Not implemented'),
+        finalizeRelease: () => Promise.reject('Not implemented'),
+        allReleases: async function* () {
+          throw new Error('Not implemented');
+        },
+        listReleaseAssets: () => Promise.reject('Not implemented'),
+        deleteReleaseAsset: deleteReleaseAssetSpy,
+        deleteRelease: () => Promise.reject('Not implemented'),
+        updateReleaseAsset: () =>
+          Promise.resolve({
+            data: {
+              id: 2,
+              name: 'default.config',
+              label: '.config',
+            },
+          }),
+        uploadReleaseAsset: () =>
+          Promise.resolve({
+            status: 201,
+            data: {
+              id: 2,
+              name: 'default.config',
+              label: '',
+            },
+          }),
+      };
+
+      try {
+        await upload(config, releaser, 'https://uploads.example.test/assets', dotfilePath, [
+          {
+            id: 1,
+            name: 'default.config',
+            label: '.config',
+          },
+        ]);
+
+        expect(deleteReleaseAssetSpy).toHaveBeenCalledWith({
+          asset_id: 1,
+          owner: 'owner',
+          repo: 'repo',
+        });
+      } finally {
+        rmSync(tempDir, { recursive: true, force: true });
+      }
     });
   });
 });

__tests__/release.txt

@@ -0,0 +1 @@
+bar

__tests__/util.test.ts

@@ -1,21 +1,525 @@
-import { isTag, paths } from "../src/util";
-import * as assert from "assert";
+import {
+  alignAssetName,
+  isTag,
+  parseConfig,
+  parseInputFiles,
+  paths,
+  releaseBody,
+  unmatchedPatterns,
+  uploadUrl,
+} from '../src/util';
 
-describe("util", () => {
-  describe("isTag", () => {
-    it("returns true for tags", async () => {
-      assert.equal(isTag("refs/tags/foo"), true);
-    });
-    it("returns false for other kinds of refs", async () => {
-      assert.equal(isTag("refs/heads/master"), false);
+import { assert, describe, expect, it } from 'vitest';
+
+describe('util', () => {
+  describe('uploadUrl', () => {
+    it('strips template', () => {
+      assert.equal(
+        uploadUrl(
+          'https://uploads.github.com/repos/octocat/Hello-World/releases/1/assets{?name,label}',
+        ),
+        'https://uploads.github.com/repos/octocat/Hello-World/releases/1/assets',
+      );
     });
   });
-
-  describe("paths", () => {
-    it("resolves files given a set of paths", async () => {
-      assert.deepStrictEqual(paths(["tests/data/**/*"]), [
-        "tests/data/foo/bar.txt"
+  describe('parseInputFiles', () => {
+    it('parses empty strings', () => {
+      assert.deepStrictEqual(parseInputFiles(''), []);
+    });
+    it('parses comma-delimited strings', () => {
+      assert.deepStrictEqual(parseInputFiles('foo,bar'), ['foo', 'bar']);
+    });
+    it('parses newline and comma-delimited (and then some)', () => {
+      assert.deepStrictEqual(parseInputFiles('foo,bar\nbaz,boom,\n\ndoom,loom '), [
+        'foo',
+        'bar',
+        'baz',
+        'boom',
+        'doom',
+        'loom',
+      ]);
+    });
+    it('handles globs with brace groups containing commas', () => {
+      assert.deepStrictEqual(parseInputFiles('./**/*.{exe,deb,tar.gz}\nfoo,bar'), [
+        './**/*.{exe,deb,tar.gz}',
+        'foo',
+        'bar',
+      ]);
+    });
+    it('handles single-line brace pattern correctly', () => {
+      assert.deepStrictEqual(parseInputFiles('./**/*.{exe,deb,tar.gz}'), [
+        './**/*.{exe,deb,tar.gz}',
       ]);
     });
   });
+  describe('releaseBody', () => {
+    it('uses input body', () => {
+      assert.equal(
+        'foo',
+        releaseBody({
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_body: 'foo',
+          input_body_path: undefined,
+          input_draft: false,
+          input_prerelease: false,
+          input_preserve_order: undefined,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        }),
+      );
+    });
+    it('uses input body path', () => {
+      assert.equal(
+        'bar',
+        releaseBody({
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_body: undefined,
+          input_body_path: '__tests__/release.txt',
+          input_draft: false,
+          input_prerelease: false,
+          input_preserve_order: undefined,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        }),
+      );
+    });
+    it('defaults to body path when both body and body path are provided', () => {
+      assert.equal(
+        'bar',
+        releaseBody({
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_body: 'foo',
+          input_body_path: '__tests__/release.txt',
+          input_draft: false,
+          input_prerelease: false,
+          input_preserve_order: undefined,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        }),
+      );
+    });
+    it('falls back to body when body_path is missing', () => {
+      assert.equal(
+        releaseBody({
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_body: 'fallback-body',
+          input_body_path: '__tests__/does-not-exist.txt',
+          input_draft: false,
+          input_prerelease: false,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_preserve_order: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        }),
+        'fallback-body',
+      );
+    });
+    it('returns undefined when body_path is missing and body is not provided', () => {
+      assert.equal(
+        releaseBody({
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_body: undefined,
+          input_body_path: '__tests__/does-not-exist.txt',
+          input_draft: false,
+          input_prerelease: false,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_preserve_order: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        }),
+        undefined,
+      );
+    });
+  });
+  describe('parseConfig', () => {
+    it('parses basic config', () => {
+      assert.deepStrictEqual(
+        parseConfig({
+          // note: inputs declared in actions.yml, even when declared not required,
+          // are still provided by the actions runtime env as empty strings instead of
+          // the normal absent env value one would expect. this breaks things
+          // as an empty string !== undefined in terms of what we pass to the api
+          // so we cover that in a test case here to ensure undefined values are actually
+          // resolved as undefined and not empty strings
+          INPUT_TARGET_COMMITISH: '',
+          INPUT_DISCUSSION_CATEGORY_NAME: '',
+        }),
+        {
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_working_directory: undefined,
+          input_append_body: false,
+          input_body: undefined,
+          input_body_path: undefined,
+          input_draft: undefined,
+          input_prerelease: undefined,
+          input_preserve_order: undefined,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_fail_on_unmatched_files: false,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        },
+      );
+    });
+
+    it('parses basic config with commitish', () => {
+      assert.deepStrictEqual(
+        parseConfig({
+          INPUT_TARGET_COMMITISH: 'affa18ef97bc9db20076945705aba8c516139abd',
+        }),
+        {
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_working_directory: undefined,
+          input_append_body: false,
+          input_body: undefined,
+          input_body_path: undefined,
+          input_draft: undefined,
+          input_prerelease: undefined,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_preserve_order: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_fail_on_unmatched_files: false,
+          input_target_commitish: 'affa18ef97bc9db20076945705aba8c516139abd',
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        },
+      );
+    });
+    it('supports discussion category names', () => {
+      assert.deepStrictEqual(
+        parseConfig({
+          INPUT_DISCUSSION_CATEGORY_NAME: 'releases',
+        }),
+        {
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_working_directory: undefined,
+          input_append_body: false,
+          input_body: undefined,
+          input_body_path: undefined,
+          input_draft: undefined,
+          input_prerelease: undefined,
+          input_files: [],
+          input_preserve_order: undefined,
+          input_name: undefined,
+          input_overwrite_files: undefined,
+          input_tag_name: undefined,
+          input_fail_on_unmatched_files: false,
+          input_target_commitish: undefined,
+          input_discussion_category_name: 'releases',
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        },
+      );
+    });
+
+    it('supports generating release notes', () => {
+      assert.deepStrictEqual(
+        parseConfig({
+          INPUT_GENERATE_RELEASE_NOTES: 'true',
+        }),
+        {
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_working_directory: undefined,
+          input_append_body: false,
+          input_body: undefined,
+          input_body_path: undefined,
+          input_draft: undefined,
+          input_prerelease: undefined,
+          input_preserve_order: undefined,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_fail_on_unmatched_files: false,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: true,
+          input_make_latest: undefined,
+        },
+      );
+    });
+
+    it('prefers GITHUB_TOKEN over token input for backwards compatibility', () => {
+      assert.deepStrictEqual(
+        parseConfig({
+          INPUT_DRAFT: 'false',
+          INPUT_PRERELEASE: 'true',
+          INPUT_PRESERVE_ORDER: 'true',
+          GITHUB_TOKEN: 'env-token',
+          INPUT_TOKEN: 'input-token',
+        }),
+        {
+          github_ref: '',
+          github_repository: '',
+          github_token: 'env-token',
+          input_working_directory: undefined,
+          input_append_body: false,
+          input_body: undefined,
+          input_body_path: undefined,
+          input_draft: false,
+          input_prerelease: true,
+          input_preserve_order: true,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_fail_on_unmatched_files: false,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        },
+      );
+    });
+    it('uses input token as the source of GITHUB_TOKEN by default', () => {
+      assert.deepStrictEqual(
+        parseConfig({
+          INPUT_DRAFT: 'false',
+          INPUT_PRERELEASE: 'true',
+          INPUT_TOKEN: 'input-token',
+        }),
+        {
+          github_ref: '',
+          github_repository: '',
+          github_token: 'input-token',
+          input_working_directory: undefined,
+          input_append_body: false,
+          input_body: undefined,
+          input_body_path: undefined,
+          input_draft: false,
+          input_prerelease: true,
+          input_preserve_order: undefined,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_fail_on_unmatched_files: false,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        },
+      );
+    });
+    it('parses basic config with draft and prerelease', () => {
+      assert.deepStrictEqual(
+        parseConfig({
+          INPUT_DRAFT: 'false',
+          INPUT_PRERELEASE: 'true',
+        }),
+        {
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_working_directory: undefined,
+          input_append_body: false,
+          input_body: undefined,
+          input_body_path: undefined,
+          input_draft: false,
+          input_prerelease: true,
+          input_preserve_order: undefined,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_fail_on_unmatched_files: false,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        },
+      );
+    });
+    it('parses basic config where make_latest is passed', () => {
+      assert.deepStrictEqual(
+        parseConfig({
+          INPUT_MAKE_LATEST: 'false',
+        }),
+        {
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_working_directory: undefined,
+          input_append_body: false,
+          input_body: undefined,
+          input_body_path: undefined,
+          input_draft: undefined,
+          input_prerelease: undefined,
+          input_preserve_order: undefined,
+          input_files: [],
+          input_name: undefined,
+          input_overwrite_files: undefined,
+          input_tag_name: undefined,
+          input_fail_on_unmatched_files: false,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: 'false',
+        },
+      );
+    });
+    it('parses basic config with append_body', () => {
+      assert.deepStrictEqual(
+        parseConfig({
+          INPUT_APPEND_BODY: 'true',
+        }),
+        {
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_working_directory: undefined,
+          input_append_body: true,
+          input_body: undefined,
+          input_body_path: undefined,
+          input_draft: undefined,
+          input_prerelease: undefined,
+          input_preserve_order: undefined,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_fail_on_unmatched_files: false,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        },
+      );
+    });
+  });
+  describe('isTag', () => {
+    it('returns true for tags', async () => {
+      assert.equal(isTag('refs/tags/foo'), true);
+    });
+    it('returns false for other kinds of refs', async () => {
+      assert.equal(isTag('refs/heads/master'), false);
+    });
+  });
+
+  describe('paths', () => {
+    it('resolves files given a set of paths', async () => {
+      assert.deepStrictEqual(paths(['tests/data/**/*', 'tests/data/does/not/exist/*']), [
+        'tests/data/foo/bar.txt',
+      ]);
+    });
+
+    it('resolves files relative to working_directory', async () => {
+      assert.deepStrictEqual(paths(['data/**/*'], 'tests'), ['tests/data/foo/bar.txt']);
+    });
+  });
+
+  describe('unmatchedPatterns', () => {
+    it("returns the patterns that don't match any files", async () => {
+      assert.deepStrictEqual(
+        unmatchedPatterns(['tests/data/**/*', 'tests/data/does/not/exist/*']),
+        ['tests/data/does/not/exist/*'],
+      );
+    });
+
+    it('resolves unmatched relative to working_directory', async () => {
+      assert.deepStrictEqual(unmatchedPatterns(['data/does/not/exist/*'], 'tests'), [
+        'data/does/not/exist/*',
+      ]);
+    });
+  });
+
+  describe('replaceSpacesWithDots', () => {
+    it('replaces all spaces with dots', () => {
+      expect(alignAssetName('John Doe.bla')).toBe('John.Doe.bla');
+    });
+
+    it('handles names with multiple spaces', () => {
+      expect(alignAssetName('John William Doe.bla')).toBe('John.William.Doe.bla');
+    });
+
+    it('returns the same string if there are no spaces', () => {
+      expect(alignAssetName('JohnDoe')).toBe('JohnDoe');
+    });
+  });
+});
+
+describe('parseInputFiles edge cases', () => {
+  it('handles multiple brace groups on same line', () => {
+    assert.deepStrictEqual(parseInputFiles('./**/*.{exe,deb},./dist/**/*.{zip,tar.gz}'), [
+      './**/*.{exe,deb}',
+      './dist/**/*.{zip,tar.gz}',
+    ]);
+  });
+
+  it('handles nested braces', () => {
+    assert.deepStrictEqual(parseInputFiles('path/{a,{b,c}}/file.txt'), ['path/{a,{b,c}}/file.txt']);
+  });
+
+  it('handles empty comma-separated values', () => {
+    assert.deepStrictEqual(parseInputFiles('foo,,bar'), ['foo', 'bar']);
+  });
+
+  it('handles commas with spaces around braces', () => {
+    assert.deepStrictEqual(parseInputFiles(' ./**/*.{exe,deb} , file.txt '), [
+      './**/*.{exe,deb}',
+      'file.txt',
+    ]);
+  });
+
+  it('handles mixed newlines and commas with braces', () => {
+    assert.deepStrictEqual(parseInputFiles('file1.txt\n./**/*.{exe,deb},file2.txt\nfile3.txt'), [
+      'file1.txt',
+      './**/*.{exe,deb}',
+      'file2.txt',
+      'file3.txt',
+    ]);
+  });
 });

action.yml

@@ -1,28 +1,78 @@
 # https://help.github.com/en/articles/metadata-syntax-for-github-actions
-name: 'GH Release'
-description: 'Github Action for creating Github Releases'
-author: 'softprops'
+name: "GH Release"
+description: "Github Action for creating Github Releases"
+author: "softprops"
 inputs:
   body:
-    description: 'Note-worthy description of changes in release'
+    description: "Note-worthy description of changes in release"
     required: false
-  body-path:
-    description: 'Path to load note-worthy description of changes in release from'
+  body_path:
+    description: "Path to load note-worthy description of changes in release from"
     required: false
   name:
-    description: 'Gives the release a custom name. Defaults to tag name'
+    description: "Gives the release a custom name. Defaults to tag name"
+    required: false
+  tag_name:
+    description: "Gives a tag name. Defaults to github.ref_name"
     required: false
   draft:
-    description: 'Creates a draft release'
+    description: "Creates a draft release. Defaults to false"
+    required: false
+  prerelease:
+    description: "Identify the release as a prerelease. Defaults to false"
+    required: false
+  preserve_order:
+    description: "Preserver the order of the artifacts when uploading"
     required: false
   files:
-    description: 'Comma-delimited list of path globs for asset files to upload'
+    description: "Newline-delimited list of path globs for asset files to upload"
+    required: false
+  working_directory:
+    description: "Base directory to resolve 'files' globs against (defaults to job working-directory)"
+    required: false
+  overwrite_files:
+    description: "Overwrite existing files with the same name. Defaults to true"
+    required: false
+    default: 'true'
+  fail_on_unmatched_files:
+    description: "Fails if any of the `files` globs match nothing. Defaults to false"
+    required: false
+  repository:
+    description: "Repository to make releases against, in <owner>/<repo> format"
+    required: false
+  token:
+    description: "Authorized secret GitHub Personal Access Token. Defaults to github.token"
+    required: false
+    default: ${{ github.token }}
+  target_commitish:
+    description: "Commitish value that determines where the Git tag is created from. Can be any branch or commit SHA."
+    required: false
+  discussion_category_name:
+    description: "If specified, a discussion of the specified category is created and linked to the release. The value must be a category that already exists in the repository. If there is already a discussion linked to the release, this parameter is ignored."
+    required: false
+  generate_release_notes:
+    description: "Whether to automatically generate the name and body for this release. If name is specified, the specified name will be used; otherwise, a name will be automatically generated. If body is specified, the body will be pre-pended to the automatically generated notes."
+    required: false
+  append_body:
+    description: "Append to existing body instead of overwriting it. Default is false."
+    required: false
+  make_latest:
+    description: "Specifies whether this release should be set as the latest release for the repository. Drafts and prereleases cannot be set as latest. Can be `true`, `false`, or `legacy`. Uses GitHub api default if not provided"
     required: false
 env:
-  'GITHUB_TOKEN': 'As provided by Github Actions'
+  GITHUB_TOKEN: "As provided by Github Actions"
+outputs:
+  url:
+    description: "URL to the Release HTML Page"
+  id:
+    description: "Release ID"
+  upload_url:
+    description: "URL for uploading assets to the release"
+  assets:
+    description: "JSON array containing information about each uploaded asset, in the format given [here](https://docs.github.com/en/rest/reference/repos#upload-a-release-asset--code-samples) (minus the `uploader` field)"
 runs:
-  using: 'node12'
-  main: 'lib/main.js'
+  using: "node20"
+  main: "dist/index.js"
 branding:
-  color: 'green'
-  icon: 'package'
+  color: "green"
+  icon: "package"

jest.config.js

@@ -1,11 +0,0 @@
-module.exports = {
-  clearMocks: true,
-  moduleFileExtensions: ['js', 'ts'],
-  testEnvironment: 'node',
-  testMatch: ['**/*.test.ts'],
-  testRunner: 'jest-circus/runner',
-  transform: {
-    '^.+\\.ts$': 'ts-jest'
-  },
-  verbose: true
-}

lib/github.js

@@ -1,79 +0,0 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const fs_1 = require("fs");
-const mime_1 = require("mime");
-const path_1 = require("path");
-exports.asset = (path) => {
-    return {
-        name: path_1.basename(path),
-        mime: exports.mimeOrDefault(path),
-        size: fs_1.lstatSync(path).size,
-        file: fs_1.readFileSync(path)
-    };
-};
-exports.mimeOrDefault = (path) => {
-    return mime_1.getType(path) || "application/octet-stream";
-};
-exports.upload = (gh, url, path) => __awaiter(void 0, void 0, void 0, function* () {
-    let { name, size, mime, file } = exports.asset(path);
-    console.log(`⬆️ Uploading ${name}...`);
-    return yield gh.repos.uploadReleaseAsset({
-        url,
-        headers: {
-            "content-length": size,
-            "content-type": mime
-        },
-        name,
-        file
-    });
-});
-exports.release = (config, gh) => __awaiter(void 0, void 0, void 0, function* () {
-    const [owner, repo] = config.github_repository.split("/");
-    const tag = config.github_ref.replace("refs/tags/", "");
-    try {
-        let release = yield gh.repos.getReleaseByTag({
-            owner,
-            repo,
-            tag
-        });
-        return release.data;
-    }
-    catch (error) {
-        if (error.status === 404) {
-            try {
-                const tag_name = tag;
-                const name = config.input_name || tag;
-                const body = config.input_body;
-                const draft = config.input_draft;
-                console.log(`👩‍🏭 Creating new GitHub release for tag ${tag_name}...`);
-                let release = yield gh.repos.createRelease({
-                    owner,
-                    repo,
-                    tag_name,
-                    name,
-                    body,
-                    draft
-                });
-                return release.data;
-            }
-            catch (error) {
-                // presume a race with competing metrix runs
-                console.log(`⚠️ GitHub release failed with status: ${error.status}, retrying...`);
-                return exports.release(config, gh);
-            }
-        }
-        else {
-            console.log(`⚠️ Unexpected error fetching GitHub release for tag ${config.github_ref}: ${error}`);
-            throw error;
-        }
-    }
-});

lib/main.js

@@ -1,38 +0,0 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const util_1 = require("./util");
-const github_1 = require("./github");
-const core_1 = require("@actions/core");
-const github_2 = require("@actions/github");
-const process_1 = require("process");
-function run() {
-    return __awaiter(this, void 0, void 0, function* () {
-        try {
-            const config = util_1.parseConfig(process_1.env);
-            if (!util_1.isTag(config.github_ref)) {
-                throw new Error(`⚠️ GitHub Releases requires a tag`);
-            }
-            const gh = new github_2.GitHub(config.github_token);
-            let rel = yield github_1.release(config, gh);
-            if (config.input_files) {
-                util_1.paths(config.input_files).forEach((path) => __awaiter(this, void 0, void 0, function* () {
-                    yield github_1.upload(gh, rel.upload_url, path);
-                }));
-            }
-            console.log(`🎉 Release ready at ${rel.html_url}`);
-        }
-        catch (error) {
-            core_1.setFailed(error.message);
-        }
-    });
-}
-run();

lib/util.js

@@ -1,31 +0,0 @@
-"use strict";
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
-    result["default"] = mod;
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const glob = __importStar(require("glob"));
-const fs_1 = require("fs");
-exports.parseConfig = (env) => {
-    return {
-        github_token: env.GITHUB_TOKEN || "",
-        github_ref: env.GITHUB_REF || "",
-        github_repository: env.GITHUB_REPOSITORY || "",
-        input_name: env.INPUT_NAME,
-        input_body: env.INPUT_BODY,
-        input_body_path: env.INPUT_BODY_PATH,
-        input_files: (env.INPUT_FILES || "").split(","),
-        input_draft: env.INPUT_DRAFT === "true"
-    };
-};
-exports.paths = (patterns) => {
-    return patterns.reduce((acc, pattern) => {
-        return acc.concat(glob.sync(pattern).filter(path => fs_1.lstatSync(path).isFile()));
-    }, []);
-};
-exports.isTag = (ref) => {
-    return ref.startsWith("refs/tags/");
-};

package.json

@@ -1,39 +1,44 @@
 {
   "name": "action-gh-release",
-  "version": "0.1.1",
+  "version": "2.5.2",
   "private": true,
   "description": "GitHub Action for creating GitHub Releases",
   "main": "lib/main.js",
   "scripts": {
-    "build": "tsc",
-    "test": "jest",
-    "fmt": "prettier --write 'src/**/*.ts' '__tests__/**/*.ts'"
+    "build": "esbuild src/main.ts --bundle --platform=node --format=cjs --target=node20 --outfile=dist/index.js --minify",
+    "build-debug": "esbuild src/main.ts --bundle --platform=node --format=cjs --target=node20 --outfile=dist/index.js --sourcemap --keep-names",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest --coverage",
+    "fmt": "prettier --write \"src/**/*.ts\" \"__tests__/**/*.ts\"",
+    "fmtcheck": "prettier --check \"src/**/*.ts\" \"__tests__/**/*.ts\"",
+    "updatetag": "git tag -d v2 && git push origin :v2 && git tag -a v2 -m '' && git push origin v2"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/softprops/action-gh-template.git"
+    "url": "git+https://github.com/softprops/action-gh-release.git"
   },
   "keywords": [
     "actions"
   ],
   "author": "softprops",
-  "license": "MIT",
   "dependencies": {
-    "@actions/core": "^1.1.0",
-    "@actions/github": "^1.1.0",
-    "glob": "^7.1.4",
-    "mime": "^2.4.4"
+    "@actions/core": "^3.0.0",
+    "@actions/github": "^9.0.0",
+    "@octokit/plugin-retry": "^8.1.0",
+    "@octokit/plugin-throttling": "^11.0.3",
+    "glob": "^13.0.6",
+    "mime-types": "^3.0.2"
   },
   "devDependencies": {
-    "@types/glob": "^7.1.1",
-    "@types/jest": "^24.0.13",
-    "@types/mime": "^2.0.1",
-    "@types/node": "^12.7.4",
-    "jest": "^24.8.0",
-    "jest-circus": "^24.7.1",
-    "prettier": "1.18.2",
-    "ts-jest": "^24.0.2",
-    "typescript": "^3.5.1",
-    "typescript-formatter": "^7.2.2"
+    "@types/glob": "^9.0.0",
+    "@types/mime-types": "^3.0.1",
+    "@types/node": "^20.19.37",
+    "@vitest/coverage-v8": "^4.1.0",
+    "esbuild": "^0.27.3",
+    "prettier": "3.8.1",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.9.3",
+    "typescript-formatter": "^7.2.2",
+    "vitest": "^4.0.4"
   }
 }

release.sh

@@ -1,17 +0,0 @@
-#!/bin/bash
-# actions requires a node_modules dir https://github.com/actions/toolkit/blob/master/docs/javascript-action.md#publish-a-releasesv1-action
-# but its recommended not to check these in https://github.com/actions/toolkit/blob/master/docs/action-versioning.md#recommendations
-# as such the following hack is how we dill with it
-
-if [[ $# -ne 1 ]]; then
-	echo "please pass a release version. i.e. $0 v1"
-	exit 1
-fi
-
-git checkout -b releases/$1 # If this branch already exists, omit the -b flag
-rm -rf node_modules
-sed -i '/node_modules/d' .gitignore # Bash command that removes node_modules from .gitignore
-npm install --production
-git add node_modules .gitignore
-git commit -m node_modules
-git push origin releases/$1

src/github.ts

@@ -1,91 +1,886 @@
-import { GitHub } from "@actions/github";
-import { Config } from "./util";
-import { lstatSync, readFileSync } from "fs";
-import { getType } from "mime";
-import { basename } from "path";
+import { GitHub } from '@actions/github/lib/utils';
+import { statSync } from 'fs';
+import { open } from 'fs/promises';
+import { lookup } from 'mime-types';
+import { basename } from 'path';
+import { alignAssetName, Config, isTag, releaseBody } from './util';
+
+type GitHub = InstanceType<typeof GitHub>;
 
 export interface ReleaseAsset {
   name: string;
   mime: string;
   size: number;
-  file: Buffer;
 }
 
 export interface Release {
+  id: number;
   upload_url: string;
   html_url: string;
+  tag_name: string;
+  name: string | null;
+  body?: string | null | undefined;
+  target_commitish: string;
+  draft: boolean;
+  prerelease: boolean;
+  assets: Array<{ id: number; name: string; label?: string | null }>;
+}
+
+export interface ReleaseResult {
+  release: Release;
+  created: boolean;
+}
+
+export interface Releaser {
+  getReleaseByTag(params: { owner: string; repo: string; tag: string }): Promise<{ data: Release }>;
+
+  createRelease(params: {
+    owner: string;
+    repo: string;
+    tag_name: string;
+    name: string;
+    body: string | undefined;
+    draft: boolean | undefined;
+    prerelease: boolean | undefined;
+    target_commitish: string | undefined;
+    discussion_category_name: string | undefined;
+    generate_release_notes: boolean | undefined;
+    make_latest: 'true' | 'false' | 'legacy' | undefined;
+  }): Promise<{ data: Release }>;
+
+  updateRelease(params: {
+    owner: string;
+    repo: string;
+    release_id: number;
+    tag_name: string;
+    target_commitish: string;
+    name: string;
+    body: string | undefined;
+    draft: boolean | undefined;
+    prerelease: boolean | undefined;
+    discussion_category_name: string | undefined;
+    generate_release_notes: boolean | undefined;
+    make_latest: 'true' | 'false' | 'legacy' | undefined;
+  }): Promise<{ data: Release }>;
+
+  finalizeRelease(params: {
+    owner: string;
+    repo: string;
+    release_id: number;
+    make_latest: 'true' | 'false' | 'legacy' | undefined;
+  }): Promise<{ data: Release }>;
+
+  allReleases(params: { owner: string; repo: string }): AsyncIterable<{ data: Release[] }>;
+
+  listReleaseAssets(params: {
+    owner: string;
+    repo: string;
+    release_id: number;
+  }): Promise<Array<{ id: number; name: string; label?: string | null; [key: string]: any }>>;
+
+  deleteReleaseAsset(params: { owner: string; repo: string; asset_id: number }): Promise<void>;
+
+  deleteRelease(params: { owner: string; repo: string; release_id: number }): Promise<void>;
+
+  updateReleaseAsset(params: {
+    owner: string;
+    repo: string;
+    asset_id: number;
+    name: string;
+    label: string;
+  }): Promise<{ data: any }>;
+
+  uploadReleaseAsset(params: {
+    url: string;
+    size: number;
+    mime: string;
+    token: string;
+    data: any;
+  }): Promise<{ status: number; data: any }>;
+}
+
+export class GitHubReleaser implements Releaser {
+  github: GitHub;
+  constructor(github: GitHub) {
+    this.github = github;
+  }
+
+  getReleaseByTag(params: {
+    owner: string;
+    repo: string;
+    tag: string;
+  }): Promise<{ data: Release }> {
+    return this.github.rest.repos.getReleaseByTag(params);
+  }
+
+  async getReleaseNotes(params: {
+    owner: string;
+    repo: string;
+    tag_name: string;
+    target_commitish: string | undefined;
+  }): Promise<{
+    data: {
+      name: string;
+      body: string;
+    };
+  }> {
+    return await this.github.rest.repos.generateReleaseNotes(params);
+  }
+
+  truncateReleaseNotes(input: string): string {
+    // release notes can be a maximum of 125000 characters
+    const githubNotesMaxCharLength = 125000;
+    return input.substring(0, githubNotesMaxCharLength - 1);
+  }
+
+  async createRelease(params: {
+    owner: string;
+    repo: string;
+    tag_name: string;
+    name: string;
+    body: string | undefined;
+    draft: boolean | undefined;
+    prerelease: boolean | undefined;
+    target_commitish: string | undefined;
+    discussion_category_name: string | undefined;
+    generate_release_notes: boolean | undefined;
+    make_latest: 'true' | 'false' | 'legacy' | undefined;
+  }): Promise<{ data: Release }> {
+    if (
+      typeof params.make_latest === 'string' &&
+      !['true', 'false', 'legacy'].includes(params.make_latest)
+    ) {
+      params.make_latest = undefined;
+    }
+    if (params.generate_release_notes) {
+      const releaseNotes = await this.getReleaseNotes(params);
+      params.generate_release_notes = false;
+      if (params.body) {
+        params.body = `${params.body}\n\n${releaseNotes.data.body}`;
+      } else {
+        params.body = releaseNotes.data.body;
+      }
+    }
+    params.body = params.body ? this.truncateReleaseNotes(params.body) : undefined;
+    return this.github.rest.repos.createRelease(params);
+  }
+
+  async updateRelease(params: {
+    owner: string;
+    repo: string;
+    release_id: number;
+    tag_name: string;
+    target_commitish: string;
+    name: string;
+    body: string | undefined;
+    draft: boolean | undefined;
+    prerelease: boolean | undefined;
+    discussion_category_name: string | undefined;
+    generate_release_notes: boolean | undefined;
+    make_latest: 'true' | 'false' | 'legacy' | undefined;
+  }): Promise<{ data: Release }> {
+    if (
+      typeof params.make_latest === 'string' &&
+      !['true', 'false', 'legacy'].includes(params.make_latest)
+    ) {
+      params.make_latest = undefined;
+    }
+    if (params.generate_release_notes) {
+      const releaseNotes = await this.getReleaseNotes(params);
+      params.generate_release_notes = false;
+      if (params.body) {
+        params.body = `${params.body}\n\n${releaseNotes.data.body}`;
+      } else {
+        params.body = releaseNotes.data.body;
+      }
+    }
+    params.body = params.body ? this.truncateReleaseNotes(params.body) : undefined;
+    return this.github.rest.repos.updateRelease(params);
+  }
+
+  async finalizeRelease(params: {
+    owner: string;
+    repo: string;
+    release_id: number;
+    make_latest: 'true' | 'false' | 'legacy' | undefined;
+  }) {
+    return await this.github.rest.repos.updateRelease({
+      owner: params.owner,
+      repo: params.repo,
+      release_id: params.release_id,
+      draft: false,
+      make_latest: params.make_latest,
+    });
+  }
+
+  allReleases(params: { owner: string; repo: string }): AsyncIterable<{ data: Release[] }> {
+    const updatedParams = { per_page: 100, ...params };
+    return this.github.paginate.iterator(
+      this.github.rest.repos.listReleases.endpoint.merge(updatedParams),
+    );
+  }
+
+  async listReleaseAssets(params: {
+    owner: string;
+    repo: string;
+    release_id: number;
+  }): Promise<Array<{ id: number; name: string; label?: string | null; [key: string]: any }>> {
+    return this.github.paginate(this.github.rest.repos.listReleaseAssets, {
+      ...params,
+      per_page: 100,
+    });
+  }
+
+  async deleteReleaseAsset(params: {
+    owner: string;
+    repo: string;
+    asset_id: number;
+  }): Promise<void> {
+    await this.github.rest.repos.deleteReleaseAsset(params);
+  }
+
+  async deleteRelease(params: { owner: string; repo: string; release_id: number }): Promise<void> {
+    await this.github.rest.repos.deleteRelease(params);
+  }
+
+  async updateReleaseAsset(params: {
+    owner: string;
+    repo: string;
+    asset_id: number;
+    name: string;
+    label: string;
+  }): Promise<{ data: any }> {
+    return await this.github.rest.repos.updateReleaseAsset(params);
+  }
+
+  async uploadReleaseAsset(params: {
+    url: string;
+    size: number;
+    mime: string;
+    token: string;
+    data: any;
+  }): Promise<{ status: number; data: any }> {
+    return this.github.request({
+      method: 'POST',
+      url: params.url,
+      headers: {
+        'content-length': `${params.size}`,
+        'content-type': params.mime,
+        authorization: `token ${params.token}`,
+      },
+      data: params.data,
+    });
+  }
 }
 
 export const asset = (path: string): ReleaseAsset => {
   return {
     name: basename(path),
     mime: mimeOrDefault(path),
-    size: lstatSync(path).size,
-    file: readFileSync(path)
+    size: statSync(path).size,
   };
 };
 
 export const mimeOrDefault = (path: string): string => {
-  return getType(path) || "application/octet-stream";
+  return lookup(path) || 'application/octet-stream';
 };
 
 export const upload = async (
-  gh: GitHub,
+  config: Config,
+  releaser: Releaser,
   url: string,
-  path: string
+  path: string,
+  currentAssets: Array<{ id: number; name: string; label?: string | null }>,
 ): Promise<any> => {
-  let { name, size, mime, file } = asset(path);
+  const [owner, repo] = config.github_repository.split('/');
+  const { name, mime, size } = asset(path);
+  const releaseIdMatch = url.match(/\/releases\/(\d+)\/assets/);
+  const releaseId = releaseIdMatch ? Number(releaseIdMatch[1]) : undefined;
+  const currentAsset = currentAssets.find(
+    // note: GitHub renames asset filenames that have special characters, non-alphanumeric characters, and leading or trailing periods. The "List release assets" endpoint lists the renamed filenames.
+    // due to this renaming we need to be mindful when we compare the file name we're uploading with a name github may already have rewritten for logical comparison
+    // see https://docs.github.com/en/rest/releases/assets?apiVersion=2022-11-28#upload-a-release-asset
+    ({ name: currentName, label: currentLabel }) =>
+      currentName === name || currentName === alignAssetName(name) || currentLabel === name,
+  );
+  if (currentAsset) {
+    if (config.input_overwrite_files === false) {
+      console.log(`Asset ${name} already exists and overwrite_files is false...`);
+      return null;
+    } else {
+      console.log(`♻️ Deleting previously uploaded asset ${name}...`);
+      await releaser.deleteReleaseAsset({
+        asset_id: currentAsset.id || 1,
+        owner,
+        repo,
+      });
+    }
+  }
   console.log(`⬆️ Uploading ${name}...`);
-  return await gh.repos.uploadReleaseAsset({
-    url,
-    headers: {
-      "content-length": size,
-      "content-type": mime
-    },
-    name,
-    file
-  });
-};
+  const endpoint = new URL(url);
+  endpoint.searchParams.append('name', name);
+  const uploadAsset = async () => {
+    const fh = await open(path);
+    try {
+      return await releaser.uploadReleaseAsset({
+        url: endpoint.toString(),
+        size,
+        mime,
+        token: config.github_token,
+        data: fh.readableWebStream({ type: 'bytes' }),
+      });
+    } finally {
+      await fh.close();
+    }
+  };
 
-export const release = async (config: Config, gh: GitHub): Promise<Release> => {
-  const [owner, repo] = config.github_repository.split("/");
-  const tag = config.github_ref.replace("refs/tags/", "");
   try {
-    let release = await gh.repos.getReleaseByTag({
-      owner,
-      repo,
-      tag
-    });
-    return release.data;
-  } catch (error) {
-    if (error.status === 404) {
+    const resp = await uploadAsset();
+    const json = resp.data;
+    if (resp.status !== 201) {
+      throw new Error(
+        `Failed to upload release asset ${name}. received status code ${
+          resp.status
+        }\n${json.message}\n${JSON.stringify(json.errors)}`,
+      );
+    }
+    if (json.name && json.name !== name && json.id) {
+      console.log(`✏️ Restoring asset label to ${name}...`);
       try {
-        const tag_name = tag;
-        const name = config.input_name || tag;
-        const body = config.input_body;
-        const draft = config.input_draft;
-        console.log(`👩‍🏭 Creating new GitHub release for tag ${tag_name}...`);
-        let release = await gh.repos.createRelease({
+        const { data } = await releaser.updateReleaseAsset({
           owner,
           repo,
-          tag_name,
-          name,
-          body,
-          draft
+          asset_id: json.id,
+          name: json.name,
+          label: name,
         });
-        return release.data;
+        console.log(`✅ Uploaded ${name}`);
+        return data;
       } catch (error) {
-        // presume a race with competing metrix runs
-        console.log(
-          `⚠️ GitHub release failed with status: ${error.status}, retrying...`
-        );
-        return release(config, gh);
+        console.warn(`error updating release asset label for ${name}: ${error}`);
       }
-    } else {
+    }
+    console.log(`✅ Uploaded ${name}`);
+    return json;
+  } catch (error: any) {
+    const errorStatus = error?.status ?? error?.response?.status;
+    const errorData = error?.response?.data;
+
+    // Handle race conditions across concurrent workflows uploading the same asset.
+    if (
+      config.input_overwrite_files !== false &&
+      errorStatus === 422 &&
+      errorData?.errors?.[0]?.code === 'already_exists' &&
+      releaseId !== undefined
+    ) {
       console.log(
-        `⚠️ Unexpected error fetching GitHub release for tag ${config.github_ref}: ${error}`
+        `⚠️ Asset ${name} already exists (race condition), refreshing assets and retrying once...`,
+      );
+      const latestAssets = await releaser.listReleaseAssets({
+        owner,
+        repo,
+        release_id: releaseId,
+      });
+      const latestAsset = latestAssets.find(
+        ({ name: currentName }) => currentName == alignAssetName(name),
+      );
+      if (latestAsset) {
+        await releaser.deleteReleaseAsset({
+          owner,
+          repo,
+          asset_id: latestAsset.id,
+        });
+        const retryResp = await uploadAsset();
+        const retryJson = retryResp.data;
+        if (retryResp.status !== 201) {
+          throw new Error(
+            `Failed to upload release asset ${name}. received status code ${
+              retryResp.status
+            }\n${retryJson.message}\n${JSON.stringify(retryJson.errors)}`,
+          );
+        }
+        console.log(`✅ Uploaded ${name}`);
+        return retryJson;
+      }
+    }
+
+    throw error;
+  }
+};
+
+export const release = async (
+  config: Config,
+  releaser: Releaser,
+  maxRetries: number = 3,
+): Promise<ReleaseResult> => {
+  if (maxRetries <= 0) {
+    console.log(`❌ Too many retries. Aborting...`);
+    throw new Error('Too many retries.');
+  }
+
+  const [owner, repo] = config.github_repository.split('/');
+  const tag =
+    config.input_tag_name ||
+    (isTag(config.github_ref) ? config.github_ref.replace('refs/tags/', '') : '');
+
+  const discussion_category_name = config.input_discussion_category_name;
+  const generate_release_notes = config.input_generate_release_notes;
+  try {
+    const _release: Release | undefined = await findTagFromReleases(releaser, owner, repo, tag);
+
+    if (_release === undefined) {
+      return await createRelease(
+        tag,
+        config,
+        releaser,
+        owner,
+        repo,
+        discussion_category_name,
+        generate_release_notes,
+        maxRetries,
+      );
+    }
+
+    let existingRelease: Release = _release!;
+    console.log(`Found release ${existingRelease.name} (with id=${existingRelease.id})`);
+
+    const release_id = existingRelease.id;
+    let target_commitish: string;
+    if (
+      config.input_target_commitish &&
+      config.input_target_commitish !== existingRelease.target_commitish
+    ) {
+      console.log(
+        `Updating commit from "${existingRelease.target_commitish}" to "${config.input_target_commitish}"`,
+      );
+      target_commitish = config.input_target_commitish;
+    } else {
+      target_commitish = existingRelease.target_commitish;
+    }
+
+    const tag_name = tag;
+    const name = config.input_name || existingRelease.name || tag;
+    // revisit: support a new body-concat-strategy input for accumulating
+    // body parts as a release gets updated. some users will likely want this while
+    // others won't previously this was duplicating content for most which
+    // no one wants
+    const workflowBody = releaseBody(config) || '';
+    const existingReleaseBody = existingRelease.body || '';
+    let body: string;
+    if (config.input_append_body && workflowBody && existingReleaseBody) {
+      body = existingReleaseBody + '\n' + workflowBody;
+    } else {
+      body = workflowBody || existingReleaseBody;
+    }
+
+    const prerelease =
+      config.input_prerelease !== undefined ? config.input_prerelease : existingRelease.prerelease;
+
+    const make_latest = config.input_make_latest;
+
+    const release = await releaser.updateRelease({
+      owner,
+      repo,
+      release_id,
+      tag_name,
+      target_commitish,
+      name,
+      body,
+      draft: existingRelease.draft,
+      prerelease,
+      discussion_category_name,
+      generate_release_notes,
+      make_latest,
+    });
+    return {
+      release: release.data,
+      created: false,
+    };
+  } catch (error) {
+    if (error.status !== 404) {
+      console.log(
+        `⚠️ Unexpected error fetching GitHub release for tag ${config.github_ref}: ${error}`,
       );
       throw error;
     }
+
+    return await createRelease(
+      tag,
+      config,
+      releaser,
+      owner,
+      repo,
+      discussion_category_name,
+      generate_release_notes,
+      maxRetries,
+    );
   }
 };
+
+/**
+ * Finalizes a release by unmarking it as "draft" (if relevant)
+ * after all artifacts have been uploaded.
+ *
+ * @param config - Release configuration as specified by user
+ * @param releaser - The GitHub API wrapper for release operations
+ * @param release - The existing release to be finalized
+ * @param maxRetries - The maximum number of attempts to finalize the release
+ */
+export const finalizeRelease = async (
+  config: Config,
+  releaser: Releaser,
+  release: Release,
+  releaseWasCreated: boolean = false,
+  maxRetries: number = 3,
+): Promise<Release> => {
+  if (config.input_draft === true || release.draft === false) {
+    return release;
+  }
+
+  if (maxRetries <= 0) {
+    console.log(`❌ Too many retries. Aborting...`);
+    throw new Error('Too many retries.');
+  }
+
+  const [owner, repo] = config.github_repository.split('/');
+  try {
+    const { data } = await releaser.finalizeRelease({
+      owner,
+      repo,
+      release_id: release.id,
+      make_latest: config.input_make_latest,
+    });
+
+    return data;
+  } catch (error) {
+    console.warn(`error finalizing release: ${error}`);
+
+    if (releaseWasCreated && release.draft && isTagCreationBlockedError(error)) {
+      let deleted = false;
+
+      try {
+        console.log(
+          `🧹 Deleting draft release ${release.id} for tag ${release.tag_name} because tag creation is blocked by repository rules...`,
+        );
+        await releaser.deleteRelease({
+          owner,
+          repo,
+          release_id: release.id,
+        });
+        deleted = true;
+      } catch (cleanupError) {
+        console.warn(`error deleting orphan draft release ${release.id}: ${cleanupError}`);
+      }
+
+      const cleanupResult = deleted
+        ? `Deleted draft release ${release.id} to avoid leaving an orphaned draft release.`
+        : `Failed to delete draft release ${release.id}; manual cleanup may still be required.`;
+      throw new Error(
+        `Tag creation for ${release.tag_name} is blocked by repository rules. ${cleanupResult}`,
+      );
+    }
+
+    console.log(`retrying... (${maxRetries - 1} retries remaining)`);
+    return finalizeRelease(config, releaser, release, releaseWasCreated, maxRetries - 1);
+  }
+};
+
+/**
+ * Lists assets belonging to a release.
+ *
+ * @param config - Release configuration as specified by user
+ * @param releaser - The GitHub API wrapper for release operations
+ * @param release - The existing release to be checked
+ * @param maxRetries - The maximum number of attempts
+ */
+export const listReleaseAssets = async (
+  config: Config,
+  releaser: Releaser,
+  release: Release,
+  maxRetries: number = 3,
+): Promise<Array<{ id: number; name: string; [key: string]: any }>> => {
+  if (maxRetries <= 0) {
+    console.log(`❌ Too many retries. Aborting...`);
+    throw new Error('Too many retries.');
+  }
+
+  const [owner, repo] = config.github_repository.split('/');
+  try {
+    const assets = await releaser.listReleaseAssets({
+      owner,
+      repo,
+      release_id: release.id,
+    });
+
+    return assets;
+  } catch (error) {
+    console.warn(`error listing assets of release: ${error}`);
+    console.log(`retrying... (${maxRetries - 1} retries remaining)`);
+    return listReleaseAssets(config, releaser, release, maxRetries - 1);
+  }
+};
+
+/**
+ * Finds a release by tag name.
+ *
+ * Uses the direct getReleaseByTag API for O(1) lookup instead of iterating
+ * through all releases. This also avoids GitHub's API pagination limit of
+ * 10000 results which would cause failures for repositories with many releases.
+ *
+ * @param releaser - The GitHub API wrapper for release operations
+ * @param owner - The owner of the repository
+ * @param repo - The name of the repository
+ * @param tag - The tag name to search for
+ * @returns The release with the given tag name, or undefined if no release with that tag name is found
+ */
+export async function findTagFromReleases(
+  releaser: Releaser,
+  owner: string,
+  repo: string,
+  tag: string,
+): Promise<Release | undefined> {
+  try {
+    const { data: release } = await releaser.getReleaseByTag({ owner, repo, tag });
+    return release;
+  } catch (error) {
+    // Release not found (404) or other error - return undefined to allow creation
+    if (error.status === 404) {
+      return undefined;
+    }
+    // Re-throw unexpected errors
+    throw error;
+  }
+}
+
+const CREATED_RELEASE_DISCOVERY_RETRY_DELAY_MS = 1000;
+const RECENT_RELEASE_SCAN_PAGES = 2;
+
+async function sleep(ms: number): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function recentReleasesByTag(
+  releaser: Releaser,
+  owner: string,
+  repo: string,
+  tag: string,
+): Promise<Release[]> {
+  const matches: Release[] = [];
+  let pages = 0;
+
+  for await (const page of releaser.allReleases({ owner, repo })) {
+    matches.push(...page.data.filter((release) => release.tag_name === tag));
+    pages += 1;
+
+    if (pages >= RECENT_RELEASE_SCAN_PAGES) {
+      break;
+    }
+  }
+
+  return matches;
+}
+
+function pickCanonicalRelease(
+  releases: Release[],
+  releaseByTag: Release | undefined,
+): Release | undefined {
+  if (releaseByTag && releases.some((release) => release.id === releaseByTag.id)) {
+    return releaseByTag;
+  }
+
+  if (releases.length === 0) {
+    return releaseByTag;
+  }
+
+  return [...releases].sort((left, right) => {
+    if (left.draft !== right.draft) {
+      return Number(left.draft) - Number(right.draft);
+    }
+
+    return left.id - right.id;
+  })[0];
+}
+
+async function cleanupDuplicateDraftReleases(
+  releaser: Releaser,
+  owner: string,
+  repo: string,
+  tag: string,
+  canonicalReleaseId: number,
+  recentReleases: Release[],
+): Promise<void> {
+  for (const duplicate of recentReleases) {
+    if (duplicate.id === canonicalReleaseId || !duplicate.draft || duplicate.assets.length > 0) {
+      continue;
+    }
+
+    try {
+      console.log(`🧹 Removing duplicate draft release ${duplicate.id} for tag ${tag}...`);
+      await releaser.deleteRelease({
+        owner,
+        repo,
+        release_id: duplicate.id,
+      });
+    } catch (error) {
+      console.warn(`error deleting duplicate release ${duplicate.id}: ${error}`);
+    }
+  }
+}
+
+async function canonicalizeCreatedRelease(
+  releaser: Releaser,
+  owner: string,
+  repo: string,
+  tag: string,
+  createdRelease: Release,
+  maxRetries: number,
+): Promise<Release> {
+  const attempts = Math.max(maxRetries, 1);
+
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    let releaseByTag: Release | undefined;
+    try {
+      releaseByTag = await findTagFromReleases(releaser, owner, repo, tag);
+    } catch (error) {
+      console.warn(`error reloading release for tag ${tag}: ${error}`);
+    }
+
+    let recentReleases: Release[] = [];
+    try {
+      recentReleases = await recentReleasesByTag(releaser, owner, repo, tag);
+    } catch (error) {
+      console.warn(`error listing recent releases for tag ${tag}: ${error}`);
+    }
+
+    const canonicalRelease = pickCanonicalRelease(recentReleases, releaseByTag);
+    if (canonicalRelease) {
+      if (canonicalRelease.id !== createdRelease.id) {
+        console.log(
+          `↪️ Using release ${canonicalRelease.id} for tag ${tag} instead of duplicate draft ${createdRelease.id}`,
+        );
+      }
+
+      await cleanupDuplicateDraftReleases(
+        releaser,
+        owner,
+        repo,
+        tag,
+        canonicalRelease.id,
+        recentReleases,
+      );
+      return canonicalRelease;
+    }
+
+    if (attempt < attempts) {
+      console.log(
+        `Release ${createdRelease.id} is not yet discoverable by tag ${tag}, retrying... (${
+          attempts - attempt
+        } retries remaining)`,
+      );
+      await sleep(CREATED_RELEASE_DISCOVERY_RETRY_DELAY_MS);
+    }
+  }
+
+  console.log(
+    `⚠️ Continuing with newly created release ${createdRelease.id} because tag ${tag} is still not discoverable`,
+  );
+  return createdRelease;
+}
+
+async function createRelease(
+  tag: string,
+  config: Config,
+  releaser: Releaser,
+  owner: string,
+  repo: string,
+  discussion_category_name: string | undefined,
+  generate_release_notes: boolean | undefined,
+  maxRetries: number,
+): Promise<ReleaseResult> {
+  const tag_name = tag;
+  const name = config.input_name || tag;
+  const body = releaseBody(config);
+  const prerelease = config.input_prerelease;
+  const draft = prerelease === true ? config.input_draft === true : true;
+  const target_commitish = config.input_target_commitish;
+  const make_latest = config.input_make_latest;
+  let commitMessage: string = '';
+  if (target_commitish) {
+    commitMessage = ` using commit "${target_commitish}"`;
+  }
+  console.log(`👩‍🏭 Creating new GitHub release for tag ${tag_name}${commitMessage}...`);
+  try {
+    const createdRelease = await releaser.createRelease({
+      owner,
+      repo,
+      tag_name,
+      name,
+      body,
+      draft,
+      prerelease,
+      target_commitish,
+      discussion_category_name,
+      generate_release_notes,
+      make_latest,
+    });
+    const canonicalRelease = await canonicalizeCreatedRelease(
+      releaser,
+      owner,
+      repo,
+      tag_name,
+      createdRelease.data,
+      maxRetries,
+    );
+    return {
+      release: canonicalRelease,
+      created: canonicalRelease.id === createdRelease.data.id,
+    };
+  } catch (error) {
+    // presume a race with competing matrix runs
+    console.log(`⚠️ GitHub release failed with status: ${error.status}`);
+    console.log(`${JSON.stringify(error.response.data)}`);
+
+    switch (error.status) {
+      case 403:
+        console.log(
+          'Skip retry — your GitHub token/PAT does not have the required permission to create a release',
+        );
+        throw error;
+
+      case 404:
+        console.log('Skip retry - discussion category mismatch');
+        throw error;
+
+      case 422:
+        // Check if this is a race condition with "already_exists" error
+        const errorData = error.response?.data;
+        if (errorData?.errors?.[0]?.code === 'already_exists') {
+          console.log(
+            '⚠️ Release already exists (race condition detected), retrying to find and update existing release...',
+          );
+          // Don't throw - allow retry to find existing release
+        } else {
+          console.log('Skip retry - validation failed');
+          throw error;
+        }
+        break;
+    }
+
+    console.log(`retrying... (${maxRetries - 1} retries remaining)`);
+    return release(config, releaser, maxRetries - 1);
+  }
+}
+
+function isTagCreationBlockedError(error: any): boolean {
+  const errors = error?.response?.data?.errors;
+  if (!Array.isArray(errors) || error?.status !== 422) {
+    return false;
+  }
+
+  return errors.some(
+    ({ field, message }: { field?: string; message?: string }) =>
+      field === 'pre_receive' &&
+      typeof message === 'string' &&
+      message.includes('creations being restricted'),
+  );
+}

src/main.ts

@@ -1,23 +1,111 @@
-import { paths, parseConfig, isTag } from "./util";
-import { release, upload } from "./github";
-import { setFailed } from "@actions/core";
-import { GitHub } from "@actions/github";
-import { env } from "process";
+import { setFailed, setOutput } from '@actions/core';
+import { getOctokit } from '@actions/github';
+import { GitHubReleaser, release, finalizeRelease, upload, listReleaseAssets } from './github';
+import { isTag, parseConfig, paths, unmatchedPatterns, uploadUrl } from './util';
+
+import { env } from 'process';
 
 async function run() {
   try {
     const config = parseConfig(env);
-    if (!isTag(config.github_ref)) {
+    if (!config.input_tag_name && !isTag(config.github_ref) && !config.input_draft) {
       throw new Error(`⚠️ GitHub Releases requires a tag`);
     }
-    const gh = new GitHub(config.github_token);
-    let rel = await release(config, gh);
     if (config.input_files) {
-      paths(config.input_files).forEach(async path => {
-        await upload(gh, rel.upload_url, path);
+      const patterns = unmatchedPatterns(config.input_files, config.input_working_directory);
+      patterns.forEach((pattern) => {
+        if (config.input_fail_on_unmatched_files) {
+          throw new Error(`⚠️  Pattern '${pattern}' does not match any files.`);
+        } else {
+          console.warn(`🤔 Pattern '${pattern}' does not match any files.`);
+        }
       });
+      if (patterns.length > 0 && config.input_fail_on_unmatched_files) {
+        throw new Error(`⚠️ There were unmatched files`);
+      }
     }
+
+    // const oktokit = GitHub.plugin(
+    //   require("@octokit/plugin-throttling"),
+    //   require("@octokit/plugin-retry")
+    // );
+
+    const gh = getOctokit(config.github_token, {
+      //new oktokit(
+      throttle: {
+        onRateLimit: (retryAfter, options) => {
+          console.warn(`Request quota exhausted for request ${options.method} ${options.url}`);
+          if (options.request.retryCount === 0) {
+            // only retries once
+            console.log(`Retrying after ${retryAfter} seconds!`);
+            return true;
+          }
+        },
+        onAbuseLimit: (retryAfter, options) => {
+          // does not retry, only logs a warning
+          console.warn(`Abuse detected for request ${options.method} ${options.url}`);
+        },
+      },
+    });
+    //);
+    const releaser = new GitHubReleaser(gh);
+    const releaseResult = await release(config, releaser);
+    let rel = releaseResult.release;
+    const releaseWasCreated = releaseResult.created;
+    let uploadedAssetIds: Set<number> = new Set();
+    if (config.input_files && config.input_files.length > 0) {
+      const files = paths(config.input_files, config.input_working_directory);
+      if (files.length == 0) {
+        if (config.input_fail_on_unmatched_files) {
+          throw new Error(`⚠️ ${config.input_files} does not include a valid file.`);
+        } else {
+          console.warn(`🤔 ${config.input_files} does not include a valid file.`);
+        }
+      }
+      const currentAssets = rel.assets;
+
+      const uploadFile = async (path: string) => {
+        const json = await upload(config, releaser, uploadUrl(rel.upload_url), path, currentAssets);
+        return json ? (json.id as number) : undefined;
+      };
+
+      let results: (number | undefined)[];
+      if (!config.input_preserve_order) {
+        results = await Promise.all(files.map(uploadFile));
+      } else {
+        results = [];
+        for (const path of files) {
+          results.push(await uploadFile(path));
+        }
+      }
+
+      uploadedAssetIds = new Set(results.filter((id): id is number => id !== undefined));
+    }
+
+    console.log('Finalizing release...');
+    rel = await finalizeRelease(config, releaser, rel, releaseWasCreated);
+
+    // Draft releases use temporary "untagged-..." URLs for assets.
+    // URLs will be changed to correct ones once the release is published.
+    console.log('Getting assets list...');
+    {
+      let assets: any[] = [];
+      if (uploadedAssetIds.size > 0) {
+        const updatedAssets = await listReleaseAssets(config, releaser, rel);
+        assets = updatedAssets
+          .filter((a) => uploadedAssetIds.has(a.id))
+          .map((a) => {
+            const { uploader, ...rest } = a;
+            return rest;
+          });
+      }
+      setOutput('assets', assets);
+    }
+
     console.log(`🎉 Release ready at ${rel.html_url}`);
+    setOutput('url', rel.html_url);
+    setOutput('id', rel.id.toString());
+    setOutput('upload_url', rel.upload_url);
   } catch (error) {
     setFailed(error.message);
   }

src/util.ts

@@ -1,5 +1,6 @@
-import * as glob from "glob";
-import { lstatSync } from "fs";
+import * as glob from 'glob';
+import { statSync, readFileSync } from 'fs';
+import * as pathLib from 'path';
 
 export interface Config {
   github_token: string;
@@ -7,35 +8,150 @@ export interface Config {
   github_repository: string;
   // user provided
   input_name?: string;
+  input_tag_name?: string;
+  input_repository?: string;
   input_body?: string;
   input_body_path?: string;
   input_files?: string[];
+  input_working_directory?: string;
+  input_overwrite_files?: boolean;
   input_draft?: boolean;
+  input_preserve_order?: boolean;
+  input_prerelease?: boolean;
+  input_fail_on_unmatched_files?: boolean;
+  input_target_commitish?: string;
+  input_discussion_category_name?: string;
+  input_generate_release_notes?: boolean;
+  input_append_body?: boolean;
+  input_make_latest: 'true' | 'false' | 'legacy' | undefined;
 }
 
+export const uploadUrl = (url: string): string => {
+  const templateMarkerPos = url.indexOf('{');
+  if (templateMarkerPos > -1) {
+    return url.substring(0, templateMarkerPos);
+  }
+  return url;
+};
+
+export const releaseBody = (config: Config): string | undefined => {
+  if (config.input_body_path) {
+    try {
+      const contents = readFileSync(config.input_body_path, 'utf8');
+      return contents;
+    } catch (err: any) {
+      console.warn(
+        `⚠️ Failed to read body_path "${config.input_body_path}" (${err?.code ?? 'ERR'}). Falling back to 'body' input.`,
+      );
+    }
+  }
+  return config.input_body;
+};
+
 type Env = { [key: string]: string | undefined };
 
+const smartSplit = (input: string): string[] => {
+  const result: string[] = [];
+  let current = '';
+  let braceDepth = 0;
+
+  for (const ch of input) {
+    if (ch === '{') {
+      braceDepth++;
+    }
+    if (ch === '}') {
+      braceDepth--;
+    }
+    if (ch === ',' && braceDepth === 0) {
+      if (current.trim()) {
+        result.push(current.trim());
+      }
+      current = '';
+    } else {
+      current += ch;
+    }
+  }
+  if (current.trim()) {
+    result.push(current.trim());
+  }
+  return result;
+};
+
+export const parseInputFiles = (files: string): string[] => {
+  return files
+    .split(/\r?\n/)
+    .flatMap((line) => smartSplit(line))
+    .filter((pat) => pat.trim() !== '');
+};
+
 export const parseConfig = (env: Env): Config => {
   return {
-    github_token: env.GITHUB_TOKEN || "",
-    github_ref: env.GITHUB_REF || "",
-    github_repository: env.GITHUB_REPOSITORY || "",
+    github_token: env.GITHUB_TOKEN || env.INPUT_TOKEN || '',
+    github_ref: env.GITHUB_REF || '',
+    github_repository: env.INPUT_REPOSITORY || env.GITHUB_REPOSITORY || '',
     input_name: env.INPUT_NAME,
+    input_tag_name: env.INPUT_TAG_NAME?.trim(),
     input_body: env.INPUT_BODY,
     input_body_path: env.INPUT_BODY_PATH,
-    input_files: (env.INPUT_FILES || "").split(","),
-    input_draft: env.INPUT_DRAFT === "true"
+    input_files: parseInputFiles(env.INPUT_FILES || ''),
+    input_working_directory: env.INPUT_WORKING_DIRECTORY || undefined,
+    input_overwrite_files: env.INPUT_OVERWRITE_FILES
+      ? env.INPUT_OVERWRITE_FILES == 'true'
+      : undefined,
+    input_draft: env.INPUT_DRAFT ? env.INPUT_DRAFT === 'true' : undefined,
+    input_preserve_order: env.INPUT_PRESERVE_ORDER ? env.INPUT_PRESERVE_ORDER == 'true' : undefined,
+    input_prerelease: env.INPUT_PRERELEASE ? env.INPUT_PRERELEASE == 'true' : undefined,
+    input_fail_on_unmatched_files: env.INPUT_FAIL_ON_UNMATCHED_FILES == 'true',
+    input_target_commitish: env.INPUT_TARGET_COMMITISH || undefined,
+    input_discussion_category_name: env.INPUT_DISCUSSION_CATEGORY_NAME || undefined,
+    input_generate_release_notes: env.INPUT_GENERATE_RELEASE_NOTES == 'true',
+    input_append_body: env.INPUT_APPEND_BODY == 'true',
+    input_make_latest: parseMakeLatest(env.INPUT_MAKE_LATEST),
   };
 };
 
-export const paths = (patterns: string[]): string[] => {
+const parseMakeLatest = (value: string | undefined): 'true' | 'false' | 'legacy' | undefined => {
+  if (value === 'true' || value === 'false' || value === 'legacy') {
+    return value;
+  }
+  return undefined;
+};
+
+export const paths = (patterns: string[], cwd?: string): string[] => {
   return patterns.reduce((acc: string[], pattern: string): string[] => {
-    return acc.concat(
-      glob.sync(pattern).filter(path => lstatSync(path).isFile())
-    );
+    const matches = glob.sync(pattern, { cwd, dot: true, absolute: false });
+    const resolved = matches
+      .map((p) => (cwd ? pathLib.join(cwd, p) : p))
+      .filter((p) => {
+        try {
+          return statSync(p).isFile();
+        } catch {
+          return false;
+        }
+      });
+    return acc.concat(resolved);
+  }, []);
+};
+
+export const unmatchedPatterns = (patterns: string[], cwd?: string): string[] => {
+  return patterns.reduce((acc: string[], pattern: string): string[] => {
+    const matches = glob.sync(pattern, { cwd, dot: true, absolute: false });
+    const files = matches.filter((p) => {
+      try {
+        const full = cwd ? pathLib.join(cwd, p) : p;
+        return statSync(full).isFile();
+      } catch {
+        return false;
+      }
+    });
+    return acc.concat(files.length == 0 ? [pattern] : []);
   }, []);
 };
 
 export const isTag = (ref: string): boolean => {
-  return ref.startsWith("refs/tags/");
+  return ref.startsWith('refs/tags/');
+};
+
+export const alignAssetName = (assetName: string): string => {
+  return assetName.replace(/ /g, '.');
 };

tsconfig.json

@@ -1,9 +1,10 @@
 {
   "compilerOptions": {
+    "useUnknownInCatchVariables": false,
     /* Basic Options */
     // "incremental": true,                   /* Enable incremental compilation */
-    "target": "es6",                          /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
-    "module": "commonjs",                     /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */
+    "target": "es2022",
+    "module": "NodeNext",
     // "allowJs": true,                       /* Allow javascript files to be compiled. */
     // "checkJs": true,                       /* Report errors in .js files. */
     // "jsx": "preserve",                     /* Specify JSX code generation: 'preserve', 'react-native', or 'react'. */
@@ -24,6 +25,7 @@
     /* Strict Type-Checking Options */
     "strict": true,                           /* Enable all strict type-checking options. */
     "noImplicitAny": false,                 /* Raise error on expressions and declarations with an implied 'any' type. */
+    "skipLibCheck": true,
     // "strictNullChecks": true,              /* Enable strict null checks. */
     // "strictFunctionTypes": true,           /* Enable strict checking of function types. */
     // "strictBindCallApply": true,           /* Enable strict 'bind', 'call', and 'apply' methods on functions. */
@@ -43,7 +45,7 @@
     // "paths": {},                           /* A series of entries which re-map imports to lookup locations relative to the 'baseUrl'. */
     // "rootDirs": [],                        /* List of root folders whose combined content represents the structure of the project at runtime. */
     // "typeRoots": [],                       /* List of folders to include type definitions from. */
-    // "types": [],                           /* Type declaration files to be included in compilation. */
+    "types": ["node", "vitest/globals"],
     // "allowSyntheticDefaultImports": true,  /* Allow default imports from modules with no default export. This does not affect code emit, just typechecking. */
     "esModuleInterop": true                   /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
     // "preserveSymlinks": true,              /* Do not resolve the real path of symlinks. */
@@ -59,5 +61,5 @@
     // "experimentalDecorators": true,        /* Enables experimental support for ES7 decorators. */
     // "emitDecoratorMetadata": true,         /* Enables experimental support for emitting type metadata for decorators. */
   },
-  "exclude": ["node_modules", "**/*.test.ts"]
-}
+  "exclude": ["node_modules", "**/*.test.ts", "vitest.config.ts"]
+}

vitest.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    coverage: {
+      reporter: ['text', 'lcov'],
+    },
+    include: ['__tests__/**/*.ts'],
+  },
+});