From 44717e495690937c8aebe122facdaade6e5b90ae Mon Sep 17 00:00:00 2001
From: DuProcess <273172371+DuProcess@users.noreply.github.com>
Date: Mon, 22 Jun 2026 01:42:17 -0400
Subject: [PATCH] Harden release upload scripts

---
 install.sh                      | 2 +-
 scripts/upload-gitea-release.sh | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/install.sh b/install.sh
index f243665..01a8115 100755
--- a/install.sh
+++ b/install.sh
@@ -43,7 +43,7 @@ Environment alternatives:
   DOSH_BINARY_URL URL
                   Exact release tarball URL to install
   DOSH_BINARY_BASE URL
-                  Release download base; defaults to REPO/releases/latest/download
+                  Release download base; otherwise derived from the latest tag
   DOSH_BINARY_NAME NAME
                   Release tarball name; defaults to dosh-OS-ARCH.tar.gz
   DOSH_BINARY_VERSION TAG
diff --git a/scripts/upload-gitea-release.sh b/scripts/upload-gitea-release.sh
index 2c76c96..8bc9737 100755
--- a/scripts/upload-gitea-release.sh
+++ b/scripts/upload-gitea-release.sh
@@ -102,6 +102,7 @@ delete_existing_asset() {
     done
 }
 
+uploaded=0
 for artifact in "$@"; do
   if [ ! -f "$artifact" ]; then
     continue
@@ -114,4 +115,10 @@ for artifact in "$@"; do
     -X POST \
     -F "attachment=@$artifact" \
     "$api/releases/$release_id/assets?name=$name" >/dev/null
+  uploaded=$((uploaded + 1))
 done
+
+if [ "$uploaded" -eq 0 ]; then
+  echo "no release artifacts uploaded" >&2
+  exit 1
+fi