Prefix release binary zips with the release version

[Ibrahimrahhal]

Release assets are now named corgea-<tag>-<target>.zip instead of corgea-<target>.zip, e.g. corgea-v1.16.0-aarch64-apple-darwin.zip.

Changes

• release-binaries.yml: new "Resolve Asset Name" step. Uses the dispatch tag input, else the pushed tag, else (branch builds) v + the Cargo.toml version. Archive, release upload, and artifact upload all use that name.
• scripts/npm/bundle-binaries.js: now takes the release tag (bundle-binaries <assets-dir> <tag>) and looks for the versioned name first. It falls back to the legacy unversioned name so older tags can still be republished via manual dispatch.
• npm-publish.yml: passes the tag to the bundler.
• build_release.sh: local zips use the same naming.
• RELEASING.md: documents the new names (also corrects "6 target zips" to 7).

Testing

• Ran the workflow's resolve step locally for dispatch, tag push, and branch push. Got corgea-v1.16.0-…, corgea-v1.17.0-…, and corgea-v1.16.0-… (from Cargo.toml).
• Downloaded the real v1.16.0 release assets and ran the bundler against them renamed to the new scheme, and against the original legacy names. Both bundled all 5 npm targets, and the bundled musl binary reports corgea 1.16.0. A missing asset or missing tag argument exits 1 with a clear message.
• actionlint passes on both workflows.

Note

Anything outside this repo that downloads corgea-<target>.zip by fixed name (install scripts, docs, releases/latest/download/... links) will need the version in the URL starting with the next release. Existing releases keep their current names.

  

[corgea-security]

Automated review risk: 2/5.

The versioned asset naming is consistently propagated across build, upload, npm bundling, and documentation. No blocking defects are evident from the supplied diff.

No critical or high-priority changes were found.

[corgea-security]

Approved by Dennis: high policy risk and automated risk 2/5.

[cursor]

No merge blocker. The versioned asset name stays aligned across the release upload and the npm bundler, and the legacy name is only a fallback.

Checked against 5d14be5: tag and workflow_dispatch builds take the tag as-is (v1.16.0 → corgea-v1.16.0-<target>.zip); branch builds prefix v onto the single corgea version from cargo metadata (one line, 1.16.0, so the name is not vv… or multiline). npm-publish.yml passes that same tag into bundle-binaries.js, which looks for corgea-<tag>-<triple>.zip before corgea-<triple>.zip. A new release has no legacy zips, so a missing versioned asset still fails the publish. Republishing an older tag still finds the old names.

Run 36688415230 (this branch) archived and uploaded corgea-v1.16.0-<target>.zip on Linux and Windows, including corgea-v1.16.0-x86_64-pc-windows-msvc.zip. No previous review threads.

  

_{Sent by Cursor Automation: pr-flow}