From 358deaee5d94dff11b1399bd9287de154ea26084 Mon Sep 17 00:00:00 2001
From: XeniOS <reality@xenios.jp>
Date: Sun, 7 Jun 2026 04:09:45 +0900
Subject: [PATCH] [Release] Harden website publish step [skip ci]

---
 .github/workflows/apple-publish.yml | 43 +++++++++++++++++++++++++----
 1 file changed, 38 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/apple-publish.yml b/.github/workflows/apple-publish.yml
index 3a8b11213..d05f44a24 100644
--- a/.github/workflows/apple-publish.yml
+++ b/.github/workflows/apple-publish.yml
@@ -495,11 +495,44 @@ jobs:
 
           gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}" > release.json
 
-          echo "html_url=$(jq -r '.html_url' release.json)" >> "$GITHUB_OUTPUT"
-          echo "ios_download_url=$(jq -r '.assets[] | select(.name == \"xenios_ios_iphone_ipad.ipa\") | .browser_download_url' release.json)" >> "$GITHUB_OUTPUT"
-          echo "macos_universal_download_url=$(jq -r '.assets[] | select(.name == \"xenios_macos_universal.dmg\") | .browser_download_url' release.json)" >> "$GITHUB_OUTPUT"
-          echo "macos_arm64_download_url=$(jq -r '.assets[] | select(.name == \"xenios_macos_apple_silicon.dmg\") | .browser_download_url' release.json)" >> "$GITHUB_OUTPUT"
-          echo "macos_x86_64_download_url=$(jq -r '.assets[] | select(.name == \"xenios_macos_intel.dmg\") | .browser_download_url' release.json)" >> "$GITHUB_OUTPUT"
+          html_url="$(jq -r '.html_url' release.json)"
+          ios_download_url="$(jq -r '.assets[] | select(.name == "xenios_ios_iphone_ipad.ipa") | .browser_download_url' release.json)"
+          macos_universal_download_url="$(jq -r '.assets[] | select(.name == "xenios_macos_universal.dmg") | .browser_download_url' release.json)"
+          macos_arm64_download_url="$(jq -r '.assets[] | select(.name == "xenios_macos_apple_silicon.dmg") | .browser_download_url' release.json)"
+          macos_x86_64_download_url="$(jq -r '.assets[] | select(.name == "xenios_macos_intel.dmg") | .browser_download_url' release.json)"
+
+          for output_name in \
+            html_url \
+            ios_download_url \
+            macos_universal_download_url \
+            macos_arm64_download_url \
+            macos_x86_64_download_url; do
+            output_value="${!output_name}"
+            if [ -z "${output_value}" ] || [ "${output_value}" = "null" ]; then
+              echo "::error::Missing GitHub release output: ${output_name}"
+              exit 1
+            fi
+          done
+
+          {
+            echo "html_url=${html_url}"
+            echo "ios_download_url=${ios_download_url}"
+            echo "macos_universal_download_url=${macos_universal_download_url}"
+            echo "macos_arm64_download_url=${macos_arm64_download_url}"
+            echo "macos_x86_64_download_url=${macos_x86_64_download_url}"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Validate xenios.jp credentials
+        shell: bash
+        env:
+          GH_TOKEN: "${{ secrets.XENIOS_WEBSITE_PAT }}"
+        run: |
+          set -euo pipefail
+          if [ -z "${GH_TOKEN}" ]; then
+            echo "::error::XENIOS_WEBSITE_PAT is not configured"
+            exit 1
+          fi
+          gh api "repos/xenios-jp/xenios.jp" >/dev/null
 
       - name: Check out xenios.jp
         uses: actions/checkout@v4