ci: validate release packaging without publishing

.github/workflows/release.yml

@@ -4,6 +4,22 @@ on:
   push:
     tags:
       - "v*"
+  pull_request:
+    paths:
+      - ".github/workflows/release.yml"
+      - ".github/scripts/**"
+      - "apps/headless/Dockerfile.linux"
+      - "apps/headless/build.sh"
+      - "apps/headless/build-linux.sh"
+      - "apps/headless/install-linux.sh"
+      - "apps/headless/Package.swift"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Build and verify release packages without publishing
+        required: true
+        default: true
+        type: boolean
 
 permissions:
   contents: read
@@ -13,9 +29,28 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.version }}
+      publish: ${{ steps.version.outputs.publish }}
     steps:
       - id: version
-        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+        env:
+          DRY_RUN: ${{ inputs.dry_run }}
+        run: |
+          set -eu
+          if [ "$GITHUB_EVENT_NAME" = "push" ]; then
+            case "$GITHUB_REF" in
+              refs/tags/v*) ;;
+              *) echo "release publishing requires a v* tag" >&2; exit 64 ;;
+            esac
+            echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+          else
+            if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ] && [ "$DRY_RUN" != "true" ]; then
+              echo "manual release runs must use dry_run=true; publish by pushing a v* tag" >&2
+              exit 64
+            fi
+            echo "version=0.0.${GITHUB_RUN_NUMBER}" >> "$GITHUB_OUTPUT"
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+          fi
 
   macos:
     needs: version
@@ -36,8 +71,14 @@ jobs:
         env:
           VERSION: ${{ needs.version.outputs.version }}
         run: |
+          set -eu
           cd apps/headless
           ditto -c -k --keepParent Headless.app "Headless-${VERSION}-macos.zip"
+          test -s "Headless-${VERSION}-macos.zip"
+          unzip -t "Headless-${VERSION}-macos.zip"
+          unzip -Z1 "Headless-${VERSION}-macos.zip" | grep -qx 'Headless.app/Contents/MacOS/Headless'
+          unzip -Z1 "Headless-${VERSION}-macos.zip" | grep -qx 'Headless.app/Contents/Resources/bin/headless'
+          unzip -Z1 "Headless-${VERSION}-macos.zip" | grep -qx 'Headless.app/Contents/Resources/bin/headless-mcp'
       - uses: actions/upload-artifact@v7
         with:
           name: macos
@@ -56,8 +97,15 @@ jobs:
         env:
           VERSION: ${{ needs.version.outputs.version }}
         run: |
+          set -eu
           cp apps/headless/build/headless-linux-amd64.tar.gz \
             "apps/headless/build/headless-${VERSION}-linux-amd64.tar.gz"
+          archive="apps/headless/build/headless-${VERSION}-linux-amd64.tar.gz"
+          test -s "$archive"
+          tar -tzf "$archive" > archive-contents.txt
+          for expected in headless headless-host headless-mcp install-linux.sh Headless_HeadlessProtocol.resources/AgentRuntime.js; do
+            grep -qx "$expected" archive-contents.txt
+          done
       - uses: actions/upload-artifact@v7
         with:
           name: linux-amd64
@@ -76,15 +124,26 @@ jobs:
         env:
           VERSION: ${{ needs.version.outputs.version }}
         run: |
+          set -eu
           cp apps/headless/build/headless-linux-arm64.tar.gz \
             "apps/headless/build/headless-${VERSION}-linux-arm64.tar.gz"
+          archive="apps/headless/build/headless-${VERSION}-linux-arm64.tar.gz"
+          test -s "$archive"
+          tar -tzf "$archive" > archive-contents.txt
+          for expected in headless headless-host headless-mcp install-linux.sh Headless_HeadlessProtocol.resources/AgentRuntime.js; do
+            grep -qx "$expected" archive-contents.txt
+          done
       - uses: actions/upload-artifact@v7
         with:
           name: linux-arm64
           path: apps/headless/build/headless-${{ needs.version.outputs.version }}-linux-arm64.tar.gz
 
   publish:
     needs: [version, macos, linux-amd64, linux-arm64]
+    if: >-
+      github.event_name == 'push' &&
+      startsWith(github.ref, 'refs/tags/v') &&
+      needs.version.outputs.publish == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: write

CHANGELOG.md

@@ -72,6 +72,8 @@ Cutting that release is tracked in
 
 ### Changed
 
+- The release workflow can now exercise and verify every package without
+  publishing, manually or on pull requests that change packaging inputs.
 - macOS WebKit and Linux Chromium now share one `HostCore` dispatcher and
   lifecycle implementation behind small engine adapters, eliminating the two
   divergent copies of flow, capture, recording, report, trace, and error logic.

README.md

@@ -214,6 +214,11 @@ Assets: macOS `Headless.app` zip, Linux amd64/arm64 tarballs. See the Actions
 `Release` workflow and the release notes on each tag for install caveats
 (Gatekeeper; Linux Chromium/FFmpeg).
 
+The `Release` workflow can also be run manually with `dry_run` enabled. That
+builds, verifies, and uploads all three workflow artifacts without creating a
+GitHub Release. Pull requests that change release packaging run the same dry
+run automatically.
+
 ## Tests
 
 ```sh