- macOS and Windows jobs fail on refs/heads/release when their signing secrets
are empty, instead of letting the app's packaging warn and ship unsigned.
A caller that doesn't list a secret name gets it empty, even though the value
is in its release environment: craft-launcher 0.3.1 built unsigned Windows
MSIs this way.
- linux-riscv64 calls package.sh --formats "deb rpm tar". Every app's
package.sh splits formats on spaces, so deb,rpm,tar matched nothing and the
job failed with an empty dist/release.
- README caller example lists the secrets instead of secrets: inherit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dtolnay/rust-toolchain derives the toolchain from the ref it is called at
(@stable, @1.90). Pinned to a commit SHA, that ref carries no toolchain, so
the action fails with "'toolchain' is a required input". This broke the
Windows ARM64 workflow on every craft app's main (e.g. storytold/wordcraft
run on 860f4ca) and would break the macOS, Windows, Linux, web and riscv64
release jobs the same way. Pass toolchain: stable at every call site.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Brandon ThomasandClaude Opus 5.5
Dylan M. Taylor