fix(ci): publish skin site releases with chunked uploads

Use bounded chunks with retries, processing deadlines and verified activation. Fail publication explicitly on upload errors. Add a manual recovery workflow for existing release packages.

.github/workflows/build-on-tag.yml

@@ -51,6 +51,7 @@ jobs:
           node scripts/axolotl/check-migrations.mjs --release
           node scripts/axolotl/brand-guard.mjs
           node scripts/axolotl/i18n-check.mjs
+          node --test scripts/axolotl/publish-skin-site.test.mjs
           cargo fmt --all --check
 
       - name: Check updater signing configuration
@@ -286,6 +287,9 @@ jobs:
     name: Verify and publish
     needs: build
     runs-on: ubuntu-24.04
+    concurrency:
+      group: skin-site-${{ github.ref_name }}
+      cancel-in-progress: false
     env:
       UPDATE_SERVER_URL: ${{ secrets.UPDATE_SERVER_URL }}
       UPDATE_SERVER_WEBHOOK_SECRET: ${{ secrets.UPDATE_SERVER_WEBHOOK_SECRET }}
@@ -298,6 +302,11 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.ref }}
 
+      - name: Set up Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: .nvmrc
+
       - name: Download updater signatures
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -375,42 +384,14 @@ jobs:
           gh release upload "${GITHUB_REF_NAME}" "release-check/${bundle_name}" --clobber
 
       - name: Publish to skin site
-        continue-on-error: true
         env:
           SKIN_SITE_TOKEN: ${{ secrets.SKIN_SITE_CI_UPLOAD_TOKEN }}
           SKIN_SITE_URL: ${{ vars.SKIN_SITE_URL || 'https://skin.starlight.cool' }}
         run: |
           set -euo pipefail
-          if [ -z "${SKIN_SITE_TOKEN:-}" ]; then
-            echo "::warning::SKIN_SITE_CI_UPLOAD_TOKEN not configured, skipping skin site publish"
-            exit 0
-          fi
-
           version="${GITHUB_REF_NAME#v}"
           bundle="release-check/Starlight_Launcher_${version}_skin-site-update.zip"
-          if [ ! -f "${bundle}" ]; then
-            echo "::warning::Bundle ${bundle} not found, skipping skin site publish"
-            exit 0
-          fi
-
-          upload_response=$(curl -fsS -X POST \
-            -H "Authorization: Bearer ${SKIN_SITE_TOKEN}" \
-            -F "archive=@${bundle};type=application/zip" \
-            "${SKIN_SITE_URL}/starlight/launcher/admin/upload?forceUpdate=false")
-
-          release_id=$(printf '%s' "${upload_response}" | jq -r '.payload.id // empty')
-          if [ -z "${release_id}" ]; then
-            echo "::warning::Skin site upload did not return a release id: ${upload_response}"
-            exit 0
-          fi
-
-          echo "Uploaded release id: ${release_id}"
-
-          curl -fsS -X POST \
-            -H "Authorization: Bearer ${SKIN_SITE_TOKEN}" \
-            "${SKIN_SITE_URL}/starlight/launcher/admin/${release_id}/activate"
-
-          echo "Skin site release ${version} published"
+          node scripts/axolotl/publish-skin-site.mjs "${bundle}" "${GITHUB_REF_NAME}"
 
       - name: Notify Update Server to publish release assets
         if: ${{ env.UPDATE_SERVER_URL != '' && env.UPDATE_SERVER_WEBHOOK_SECRET != '' }}

.github/workflows/publish-skin-site.yml

@@ -0,0 +1,56 @@
+name: Sync release to skin site
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing GitHub release tag to sync (for example v1.0.2-beta10)
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: skin-site-${{ inputs.tag }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Upload and activate existing release
+    runs-on: ubuntu-24.04
+    timeout-minutes: 40
+    steps:
+      - name: Check out publisher
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Download complete update package
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+            echo '::error::Expected a semantic version tag beginning with v'
+            exit 1
+          fi
+          version="${RELEASE_TAG#v}"
+          gh release download "${RELEASE_TAG}" \
+            --pattern "Starlight_Launcher_${version}_skin-site-update.zip" \
+            --dir release-check
+
+      - name: Publish to skin site
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+          SKIN_SITE_TOKEN: ${{ secrets.SKIN_SITE_CI_UPLOAD_TOKEN }}
+          SKIN_SITE_URL: ${{ vars.SKIN_SITE_URL || 'https://skin.starlight.cool' }}
+        run: |
+          set -euo pipefail
+          version="${RELEASE_TAG#v}"
+          node scripts/axolotl/publish-skin-site.mjs \
+            "release-check/Starlight_Launcher_${version}_skin-site-update.zip" "${RELEASE_TAG}"