From e938e53ea6952bbd587e47de1b7c961da31c9eb7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miguel=20=C3=81ngel?= <miguel.sierra@heygen.com>
Date: Sun, 25 Oct 2026 09:50:12 +0000
Subject: [PATCH] ci(release): keep the packed release tarballs as an artifact
 on release pull requests (#6292)

---
 .github/workflows/ci.yml                 | 10 ++++++++++
 scripts/verify-packed-manifests.mjs      | 10 ++++++++++
 scripts/verify-packed-manifests.test.mjs | 16 +++++++++++++++-
 3 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 309968f40f..af2bf411e0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -328,6 +328,16 @@ jobs:
       - run: bash scripts/ci/install-workspace-dependencies.sh
       - run: bun run build
       - run: bun run verify:packed-manifests
+        env:
+          PACK_KEEP_DIR: ${{ startsWith(github.head_ref, 'release/v') && format('{0}/release-tarballs', runner.temp) || '' }}
+      - name: Keep the release tarballs
+        if: startsWith(github.head_ref, 'release/v')
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: release-tarballs
+          path: ${{ runner.temp }}/release-tarballs/*.tgz
+          if-no-files-found: error
+          retention-days: 7
       - run: bun run check:cli-lazy-deps
       - name: Share the built CLI with the edit accuracy shards
         if: needs.changes.outputs.edit_accuracy == 'true'
diff --git a/scripts/verify-packed-manifests.mjs b/scripts/verify-packed-manifests.mjs
index ef4ff74b39..94cd76ba3c 100644
--- a/scripts/verify-packed-manifests.mjs
+++ b/scripts/verify-packed-manifests.mjs
@@ -5,6 +5,7 @@
 
 import { execFileSync } from "node:child_process";
 import {
+  copyFileSync,
   existsSync,
   mkdirSync,
   mkdtempSync,
@@ -659,6 +660,14 @@ function pinStandInLambdaAssets() {
   return restore;
 }
 
+/** Copy the packed tarballs out of the temp pack directory, for a job that uploads them. */
+export function keepPackedTarballs(packDir, keepDir) {
+  mkdirSync(keepDir, { recursive: true });
+  for (const name of readdirSync(packDir).filter((file) => file.endsWith(".tgz"))) {
+    copyFileSync(join(packDir, name), join(keepDir, name));
+  }
+}
+
 function main() {
   const packDir = mkdtempSync(join(tmpdir(), "hyperframes-pack-"));
   const unpinLambda = pinStandInLambdaAssets();
@@ -668,6 +677,7 @@ function main() {
       .filter(Boolean);
     verifyPackedConsumer(packDir, packedWorkspaces);
     verifyPackageSizes(packedWorkspaces);
+    if (process.env.PACK_KEEP_DIR) keepPackedTarballs(packDir, process.env.PACK_KEEP_DIR);
   } finally {
     unpinLambda();
     rmSync(packDir, { force: true, recursive: true });
diff --git a/scripts/verify-packed-manifests.test.mjs b/scripts/verify-packed-manifests.test.mjs
index 36b511f07e..862fcdfa2d 100644
--- a/scripts/verify-packed-manifests.test.mjs
+++ b/scripts/verify-packed-manifests.test.mjs
@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { describe, it } from "node:test";
@@ -11,6 +11,7 @@ import {
   CONSUMER_TSCONFIG,
   countTypeErrorsByPackage,
   installConsumer,
+  keepPackedTarballs,
   listPackedExportContracts,
   listPackageSizeIssues,
   listPackedJavaScriptImportIssues,
@@ -444,3 +445,16 @@ describe("packed consumer install", () => {
     );
   });
 });
+
+describe("keepPackedTarballs", () => {
+  it("copies the tarballs and nothing else", () => {
+    const from = mkdtempSync(join(tmpdir(), "keep-from-"));
+    const to = join(mkdtempSync(join(tmpdir(), "keep-to-")), "out");
+    writeFileSync(join(from, "a-1.0.0.tgz"), "a");
+    writeFileSync(join(from, "notes.txt"), "x");
+    keepPackedTarballs(from, to);
+    assert.deepEqual(readdirSync(to), ["a-1.0.0.tgz"]);
+    assert.equal(readFileSync(join(to, "a-1.0.0.tgz"), "utf8"), "a");
+    rmSync(from, { recursive: true, force: true });
+  });
+});