fix(ci): attach snap with --repo, keep checksums on attach failure (#899)

* fix(ci): attach snap with --repo, keep checksums on attach failure

The Attach Snap job had no checkout and no --repo flag, so
gh release upload failed with 'not a git repository' on v0.18.0.
Every other release upload passes --repo; do the same here.

Publish Snap to Store matched 'will need manual review', but current
snapcraft prints 'human review required', so the expected
allow-installation review hold reported as a hard failure.

A failed attach-snap also skipped Checksums and Provenance even though
it hashes build artifacts, not release state. Run it unless cancelled
and guard that all expected artifacts exist before manifesting.

* fix(ci): keep literal review phrase in snap publish grep

test_release_attaches_snap_then_tries_the_store asserts the literal
'will need manual review' stays in the publish-snap block. Keep it as
the first alternation so the existing test documents the matcher.

* fix(ci): require both native package sets in checksum guard

Merged main added build-native and build-native-arm64 (.deb/.rpm per
arch) to publish-checksums' needs and the SHA256SUMS glob. The artifact
guard now requires two .deb and two .rpm files so a failed native build
cannot publish an incomplete manifest.

---------

Co-authored-by: Jatin K Malik <jatinkrmalik@gmail.com>

.github/workflows/release.yml

@@ -782,6 +782,11 @@ jobs:
     name: Checksums and Provenance
     needs: [build-and-release, build-appimage-arm64, build-native, build-native-arm64, build-flatpak-amd64, build-flatpak-arm64, attach-flatpak, attach-snap]
     runs-on: ubuntu-latest
+    # An attach-job failure must not skip checksums: this job hashes the build
+    # artifacts, which exist regardless of whether an upload to the release
+    # succeeded. A missing build artifact still fails the job via the guard
+    # below, so a partial manifest can never publish.
+    if: ${{ !cancelled() }}
     permissions:
       contents: write
       id-token: write
@@ -793,6 +798,18 @@ jobs:
           merge-multiple: true
           path: dist
 
+      - name: Require every expected artifact
+        working-directory: dist
+        run: |
+          set -euo pipefail
+          for pat in '*.whl' '*.tar.gz' '*.AppImage' '*.deb' '*.rpm' '*.flatpak' '*.snap'; do
+            compgen -G "$pat" > /dev/null || { echo "missing artifact: $pat"; exit 1; }
+          done
+          test "$(compgen -G '*.AppImage' | wc -l)" -eq 2
+          test "$(compgen -G '*.deb' | wc -l)" -eq 2
+          test "$(compgen -G '*.rpm' | wc -l)" -eq 2
+          test "$(compgen -G '*.flatpak' | wc -l)" -eq 2
+
       - name: Generate SHA256SUMS
         working-directory: dist
         run: |
@@ -1012,7 +1029,9 @@ jobs:
         run: |
           set -euo pipefail
           ls -la dist/*.snap
-          gh release upload "$TAG" dist/*.snap --clobber
+          gh release upload "$TAG" dist/*.snap \
+            --repo ${{ github.repository }} \
+            --clobber
 
   publish-snap:
     name: Publish Snap to Store
@@ -1062,7 +1081,7 @@ jobs:
           if [ "$status" -eq 0 ]; then
             exit 0
           fi
-          if grep -F -q "will need manual review" "$log" \
+          if grep -E -q "will need manual review|human review required" "$log" \
             && grep -F -q "allow-installation" "$log"; then
             echo "::warning::Snap Store queued a human review (allow-installation). The .snap is on the GitHub Release."
             exit 0