From 94b2caccb1b27a5b18fad53d76aa7f78a632de32 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 26 May 2026 13:45:55 +0000
Subject: [PATCH 1/3] Initial plan


From 69fde4479d0dcb08c4fc878765e40340ecdfff1f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 26 May 2026 13:51:21 +0000
Subject: [PATCH 2/3] ci: simplify host release upload to avoid 404 in
 build-images

Agent-Logs-Url: https://github.com/markg-github/sev-certify/sessions/fce0ad79-61ec-4399-966e-294f6e7a453b

Co-authored-by: markg-github <13836240+markg-github@users.noreply.github.com>
---
 .github/workflows/build-and-release.yml | 27 ++-----------------------
 1 file changed, 2 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml
index e0541a77..a2795b3d 100644
--- a/.github/workflows/build-and-release.yml
+++ b/.github/workflows/build-and-release.yml
@@ -138,7 +138,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       
-      - name: Upload host assets (custom Content-Type)
+      - name: Upload host assets
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.replace_release == 'true')
         run: |
           set -euo pipefail
@@ -148,29 +148,6 @@ jobs:
             TAG="${GITHUB_REF#refs/tags/}"
           fi
 
-          # Get the release ID
-          RELEASE_ID=$(gh api repos/$GITHUB_REPOSITORY/releases/tags/"${TAG}" --jq .id)
-          HOST_FILE="/tmp/release-artifacts/host-${{ matrix.distro }}-${{ matrix.release }}.efi"
-          ASSET_NAME=$(basename "$HOST_FILE")
-
-          # Look for an existing asset with the same name
-          ASSET_ID=$(gh api \
-            repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID/assets \
-            --jq ".[] | select(.name==\"$ASSET_NAME\") | .id")
-
-          # If found, delete it
-          if [ -n "$ASSET_ID" ]; then
-            gh api \
-              --method DELETE \
-              -H "Authorization: Bearer $GITHUB_TOKEN" \
-              repos/$GITHUB_REPOSITORY/releases/assets/$ASSET_ID
-            fi
-
-          # Upload the new asset with the correct Content-Type
-          curl --fail -sS -X POST \
-            -H "Authorization: Bearer $GITHUB_TOKEN" \
-            -H "Content-Type: application/vnd.dispatch+efi" \
-            --data-binary @"$HOST_FILE" \
-            "https://uploads.github.com/repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID/assets?name=$ASSET_NAME"
+          gh release upload "${TAG}" /tmp/release-artifacts/host-${{ matrix.distro }}-${{ matrix.release }}.efi --clobber
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 8d770d54a0baf75cda795d68e70bafcc71aa691f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 26 May 2026 13:53:39 +0000
Subject: [PATCH 3/3] ci: make host release ID lookup resilient in build
 workflow

Agent-Logs-Url: https://github.com/markg-github/sev-certify/sessions/fce0ad79-61ec-4399-966e-294f6e7a453b

Co-authored-by: markg-github <13836240+markg-github@users.noreply.github.com>
---
 .github/workflows/build-and-release.yml | 39 +++++++++++++++++++++++--
 1 file changed, 37 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml
index a2795b3d..2baaf5f1 100644
--- a/.github/workflows/build-and-release.yml
+++ b/.github/workflows/build-and-release.yml
@@ -138,7 +138,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       
-      - name: Upload host assets
+      - name: Upload host assets (custom Content-Type)
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.replace_release == 'true')
         run: |
           set -euo pipefail
@@ -148,6 +148,41 @@ jobs:
             TAG="${GITHUB_REF#refs/tags/}"
           fi
 
-          gh release upload "${TAG}" /tmp/release-artifacts/host-${{ matrix.distro }}-${{ matrix.release }}.efi --clobber
+          # Resolve release ID via gh release view and retry briefly for API consistency.
+          for attempt in {1..5}; do
+            RELEASE_ID=$(gh release view "${TAG}" --json databaseId --jq '.databaseId' 2>/dev/null || true)
+            if [[ -n "${RELEASE_ID}" ]]; then
+              break
+            fi
+            sleep 2
+          done
+
+          if [[ -z "${RELEASE_ID}" ]]; then
+            echo "Failed to resolve release ID for tag ${TAG}"
+            exit 1
+          fi
+
+          HOST_FILE="/tmp/release-artifacts/host-${{ matrix.distro }}-${{ matrix.release }}.efi"
+          ASSET_NAME=$(basename "$HOST_FILE")
+
+          # Look for an existing asset with the same name.
+          ASSET_ID=$(gh api \
+            repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID/assets \
+            --jq ".[] | select(.name==\"$ASSET_NAME\") | .id")
+
+          # If found, delete it.
+          if [ -n "$ASSET_ID" ]; then
+            gh api \
+              --method DELETE \
+              -H "Authorization: Bearer $GITHUB_TOKEN" \
+              repos/$GITHUB_REPOSITORY/releases/assets/$ASSET_ID
+          fi
+
+          # Upload the new asset with the correct Content-Type.
+          curl --fail -sS -X POST \
+            -H "Authorization: Bearer $GITHUB_TOKEN" \
+            -H "Content-Type: application/vnd.dispatch+efi" \
+            --data-binary @"$HOST_FILE" \
+            "https://uploads.github.com/repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID/assets?name=$ASSET_NAME"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}