[andersaamodt]

Summary

• gate the release build workflow so it runs after the Test and coverage workflow succeeds and checks out the tested commit before building both artifacts
• pin the standalone Nix derivation to the nixos-23.11 channel tarball and cleanly copy the resulting binary from a dedicated out-link

Testing

• cargo test

---

https://chatgpt.com/codex/tasks/task_e_68dbab15e71c8320a748455d60820d9b

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting

• @codex fix this CI failure
• @codex address that feedback

[chatgpt-codex-connector]

[P1] Build workflow checks out untested SHA

The release workflow is triggered only after the test workflow succeeds, but the checkout step pulls github.event.workflow_run.head_sha, which is the head commit of the PR branch. The tests in Test and coverage run against the merge commit (refs/pull/<n>/merge), not the head SHA, so the binary built here can differ from the code that actually passed tests and might even fail to merge. To build the same code that was verified by CI, the workflow should checkout the merge ref (e.g. refs/pull/${{ github.event.workflow_run.pull_requests[0].number }}/merge) or the exact SHA that the test workflow built.

Useful? React with 👍 / 👎.