From c99c6a89d6985881bcad92754f429e39718073d7 Mon Sep 17 00:00:00 2001
From: morluto <76467478+morluto@users.noreply.github.com>
Date: Wed, 14 Oct 2026 21:05:20 +0800
Subject: [PATCH] fix(release): restore qualified runtime before the npm canary

The published-package verifier imports contracts from dist in the release checkout. Restore the exact qualification run's runtime artifact before publication so those dependencies are available without rebuilding the package.
---
 .github/workflows/release.yml                     |  6 ++++++
 tests/boundary/filesystem/releaseWorkflow.test.ts | 12 +++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 61e39d029d..66d1221e9e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -337,6 +337,12 @@ jobs:
         id: package
         run: node scripts/ci/verified-package.mjs validate .cache/verified-package
 
+      - name: Restore qualified verifier runtime
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: rea-test-runtime
+          path: .
+
       - name: Publish
         shell: bash
         env:
diff --git a/tests/boundary/filesystem/releaseWorkflow.test.ts b/tests/boundary/filesystem/releaseWorkflow.test.ts
index 4d38594330..3e51acd657 100644
--- a/tests/boundary/filesystem/releaseWorkflow.test.ts
+++ b/tests/boundary/filesystem/releaseWorkflow.test.ts
@@ -664,7 +664,7 @@ it("requires qualified package validation before publishing and retains the regi
     .object({
       jobs: z.object({
         publish: z.object({
-          steps: z.array(z.object({ run: z.string().optional() })),
+          steps: z.array(stepSchema),
         }),
       }),
     })
@@ -685,6 +685,16 @@ it("requires qualified package validation before publishing and retains the regi
   );
   expect(verify).toBeGreaterThanOrEqual(0);
   expect(publish).toBeGreaterThan(verify);
+  const steps = workflow.jobs.publish.steps;
+  const runtime = steps.findIndex(
+    (step) => step.with?.name === "rea-test-runtime",
+  );
+  expect(runtime).toBeGreaterThan(verify);
+  expect(runtime).toBeLessThan(publish);
+  expect(steps[runtime]?.uses).toBe(
+    "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093",
+  );
+  expect(steps[runtime]?.with).toEqual({ name: "rea-test-runtime", path: "." });
   expect(
     commands
       .slice(publish + 1)