Issue 1: `unzip -l "$ZIP_PATH" | grep -q ...` combined with set -o
pipefail silently fails when grep -q exits on first match and SIGPIPEs
the upstream unzip (which has not yet finished streaming the long file
list). pipefail sees unzip's non-zero exit and fails the pipeline, so
the guard thinks the file is missing. Fix: capture unzip -l output to
a variable once, then grep the string via herestring. The first two
sanity checks using `unzip -p` (short output, tight race window) were
not affected.
Issue 2: test_wp_plugin_info_json_download_url_contains_expected_asset_name
assumed Gitea asset URLs always contain the asset filename. This is
not true on git.netranking.ru, which returns /attachments/<uuid> — a
UUID-only URL. Relaxed the test to assert the URL is an HTTPS Gitea
URL; freshness of download_url is enforced indirectly via the
version-match test.
Post-mortem: 1.2.0 release was completed via a manual recovery script
after release.sh failed at the zip-sanity step. State on main is
consistent: tag v1.2.0 -> release commit, JSON commit directly on top
of release commit, JSON points to the live Gitea asset.
Critical: macOS BSD sed does not support \s character class.
The two substitutions in the version-bump step silently no-oped, the
grep fail-fast guard caught it (no remote damage), but release.sh
couldn't complete. Using POSIX [[:space:]] works on both BSD and GNU sed.
Also: extend test_git_archive_excludes_dev_files to cover .phpunit.result.cache,
.beads/, .claude/, dist/, .DS_Store — the test now fully enforces .gitattributes
export-ignore invariant.
Vladimir Bryzgalov