fix(KAN-65): resume release publication with CI credentials

native/publish-macos.mjs

@@ -435,7 +435,13 @@ if (
                 process.argv[2] === 'resume' ? resumeMacos : publishMacos;
             const url = await publish({
                 directory: process.env.RELEASE_DIRECTORY,
-                metadata: releaseMetadata(),
+                metadata: releaseMetadata(
+                    process.env,
+                    process.argv[2] === 'resume' &&
+                        process.env.RELEASE_METADATA_DIRECTORY
+                        ? resolve(process.env.RELEASE_METADATA_DIRECTORY)
+                        : undefined,
+                ),
             });
             console.log(`Verified public release: ${url}`);
             if (process.env.GITHUB_STEP_SUMMARY) {

native/tests/macos-workflow.test.js

@@ -113,6 +113,38 @@ test('manual release on main accepts an existing tag without moving it', (t) =>
     assert.equal(f.git(f.checkout, 'rev-parse', 'macos-v1.2.3'), f.commit);
 });
 
+test('resume uses current tools, validated tagged metadata and release credentials without rebuilding', (t) => {
+    const f = fixture(t);
+    const result = f.run({
+        GITHUB_EVENT_NAME: 'workflow_dispatch',
+        GITHUB_REF: 'refs/heads/main',
+        REQUESTED_TAG: 'macos-v1.2.3',
+        RELEASE_MODE: 'resume',
+    });
+    assert.equal(result.status, 0, result.stderr);
+    const resume = workflow.split('\n  resume:\n')[1];
+    assert.match(resume, /needs: prepare/);
+    assert.match(
+        resume,
+        /github.event_name == 'workflow_dispatch' && inputs.mode == 'resume'/,
+    );
+    assert.match(resume, /ref: \$\{\{ github.sha \}\}/);
+    assert.match(resume, /ref: \$\{\{ needs.prepare.outputs.commit \}\}/);
+    assert.match(resume, /RELEASE_METADATA_DIRECTORY: release-source\/native/);
+    assert.match(resume, /path: release-source/);
+    assert.match(resume, /secrets.S3_ACCESS_KEY_ID/);
+    assert.match(resume, /secrets.S3_SECRET_ACCESS_KEY/);
+    assert.match(resume, /node native\/publish-macos.mjs resume/);
+    assert.doesNotMatch(
+        resume,
+        /tauri-action|APPLE_PASSWORD|APPLE_CERTIFICATE|TAURI_SIGNING_PRIVATE_KEY/,
+    );
+    assert.match(
+        workflow.split('\n  release:\n')[1],
+        /if: \$\{\{ inputs.mode != 'resume' \}\}/,
+    );
+});
+
 test('release DMG packaging disables Finder automation in the Tauri action environment', () => {
     const build = workflow
         .split('      - name: Build, sign and notarize with Tauri\n')[1]
@@ -127,6 +159,7 @@ test('release DMG packaging disables Finder automation in the Tauri action envir
 });
 
 for (const [name, overrides] of [
+    ['invalid release mode', { RELEASE_MODE: 'overwrite' }],
     ['web release tag', { GITHUB_REF: 'refs/tags/v1.2.3' }],
     ['missing tag', { GITHUB_REF: 'refs/tags/macos-v9.9.9' }],
     [