---
name: risk-release-workflow-untestable-pre-tag
description: .gitea/workflows/release.yml only runs on a v*.*.* tag that also publishes live to the Chrome Web Store — review it by extracting and executing the embedded script locally.
metadata:
  type: project
---

`.gitea/workflows/release.yml` and `.gitea/workflows/deploy-chrome.yml` both trigger only on `push: tags: v*.*.*`, and the deploy workflow publishes live to the Chrome Web Store. A bug in either is first observed during a real release.

**Why:** there is no dry-run path; CI never exercises these files on a normal push.

**How to apply:** when a release workflow embeds a script in a heredoc inside a YAML block scalar, extract it and run it rather than reading it. Working recipe used on 2026-08-12:
`sed -n '<first>,<last>p' .gitea/workflows/release.yml | sed 's/^          //' > <scratchpad>/brp.js` then run it with the relevant env var set, over the real `CHANGELOG.md`, for: the current tag, an older tag, the oldest tag (last-section / no-next-heading case), a tag with no section (fallback), and a prefix-collision tag such as `v1.1.0-beta`. This confirmed indentation stripping, heredoc termination, `VERSION="$VERSION" node ...` env passing, and JSON safety of `→`/em-dash/backticks in one pass.

Also compare any zip/packaging edit against the known-good pattern at `.gitea/workflows/deploy-chrome.yml:47-57` — that pattern was itself a fix (commit `1fedaf4`) for a nested-directory zip that Chrome rejected. Related: [[risk-release-notes-unverified-claims]].