fix: draft prereleases before uploading assets

Signed-off-by: Rui Chen <rui@chenrui.dev>

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,97 @@
+name: Bug report
+description: Report a bug or regression in action-gh-release
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing:
+        - confirm the problem still reproduces on the latest release or `master`
+        - search existing issues for the same behavior
+        - if the original repository is private, include a minimal public repro, a sanitized workflow snippet, or exact redacted steps a maintainer can follow
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-flight checks
+      options:
+        - label: I searched existing issues and did not find a duplicate
+          required: true
+        - label: I reproduced this with the latest released version or current `master`
+          required: true
+        - label: I included a reproducible example or a sanitized/redacted reproduction path if the original repository is private
+          required: true
+  - type: input
+    id: action_version
+    attributes:
+      label: action-gh-release version
+      description: Tag, SHA, or ref used in your workflow
+      placeholder: v2.5.2
+    validations:
+      required: true
+  - type: dropdown
+    id: runner
+    attributes:
+      label: Runner operating system
+      options:
+        - ubuntu-latest
+        - windows-latest
+        - macos-latest
+        - other
+    validations:
+      required: true
+  - type: input
+    id: target_repository
+    attributes:
+      label: Release target repository
+      description: Fill this in if you set the `repository:` input
+      placeholder: owner/repo
+  - type: input
+    id: repro_reference
+    attributes:
+      label: Reproduction repo, gist, or artifact
+      description: Link a minimal repro repository, gist, run URL, or other shareable artifact if you have one
+      placeholder: https://github.com/owner/repro-repo
+  - type: textarea
+    id: workflow
+    attributes:
+      label: Workflow snippet
+      description: Include the relevant `uses:` step and inputs. If the original repo is private, paste a sanitized version here.
+      render: yaml
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Include tags, matrix/concurrency details, and any repo rules involved. If the original repo is private, describe the smallest setup a maintainer can recreate locally or in a throwaway repo.
+      placeholder: |
+        1. Trigger workflow with ...
+        2. Action creates ...
+        3. Action fails with ...
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs
+      description: Paste the relevant error output or run URL
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Any extra environment, token, ruleset, or asset details

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,50 @@
+name: Feature request
+description: Propose an enhancement or new capability for action-gh-release
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this template for new capabilities, behavior changes, or ergonomics improvements.
+        If you are reporting something broken, use the bug report template instead.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-flight checks
+      options:
+        - label: I searched existing issues and did not find a duplicate request
+          required: true
+        - label: This is not a bug report for existing behavior
+          required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem to solve
+      description: What workflow pain point or gap are you trying to address?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe the behavior, input, or output you want
+    validations:
+      required: true
+  - type: textarea
+    id: workflow
+    attributes:
+      label: Example workflow snippet
+      description: Show how you would expect to use this
+      render: yaml
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Workarounds or other approaches you evaluated
+  - type: textarea
+    id: impact
+    attributes:
+      label: Why this belongs in action-gh-release
+      description: Explain the user impact or why this should live in the action rather than in workflow glue

.github/dependabot.yml

@@ -1,14 +1,29 @@
 version: 2
 updates:
-- package-ecosystem: npm
-  directory: "/"
-  schedule:
-    interval: weekly
-  ignore:
-  - dependency-name: node-fetch
-    versions:
-    - ">=3.0.0"
-- package-ecosystem: github-actions
-  directory: "/"
-  schedule:
-    interval: weekly
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      npm:
+        patterns:
+          - "*"
+    ignore:
+      - dependency-name: node-fetch
+        versions:
+          - ">=3.0.0"
+      - dependency-name: "@types/node"
+        versions:
+          - ">=22.0.0"
+    commit-message:
+      prefix: "chore(deps)"
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"

.github/release.yml

@@ -0,0 +1,22 @@
+changelog:
+  exclude:
+    labels:
+      - ignore-for-release
+      - github-actions
+    authors:
+      - octocat
+      - renovate[bot]
+  categories:
+    - title: Breaking Changes 🛠
+      labels:
+        - breaking-change
+    - title: Exciting New Features 🎉
+      labels:
+        - enhancement
+        - feature
+    - title: Bug fixes 🐛
+      labels:
+        - bug
+    - title: Other Changes 🔄
+      labels:
+        - "*"

.github/workflows/main.yml

@@ -1,26 +1,30 @@
-name: Main
+name: main
 
-on: [pull_request, push]
+on:
+  push:
+  pull_request:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      # https://github.com/actions/checkout
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
+
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version-file: ".tool-versions"
+          cache: "npm"
+
       - name: Install
         run: npm ci
       - name: Build
         run: npm run build
+      - name: Check dist freshness
+        run: |
+          git diff --exit-code --stat -- dist/index.js \
+          || (echo "##[error] found changed dist/index.js after build. please run 'npm run build' and commit the updated bundle" \
+              && exit 1)
       - name: Test
         run: npm run test
       - name: Format
         run: npm run fmtcheck
-      # - name: "check for uncommitted changes"
-      #   # Ensure no changes, but ignore node_modules dir since dev/fresh ci deps installed.
-      #   run: |
-      #     git diff --exit-code --stat -- . ':!node_modules' \
-      #     || (echo "##[error] found changed files after build. please 'npm run build && npm run fmt'" \
-      #             "and check in all changes" \
-      #         && exit 1)

.gitignore

@@ -2,3 +2,4 @@ __tests__/runner/*
 # actions requires a node_modules dir https://github.com/actions/toolkit/blob/master/docs/javascript-action.md#publish-a-releasesv1-action
 # but its recommended not to check these in https://github.com/actions/toolkit/blob/master/docs/action-versioning.md#recommendations
 node_modules
+coverage

.nvmrc

@@ -1 +0,0 @@
-20.11.1

.prettierignore

@@ -0,0 +1,16 @@
+# Build outputs
+dist/
+lib/
+coverage/
+
+# Dependencies
+node_modules/
+
+# Misc
+.github/
+*.log
+.DS_Store
+__tests__/release.txt
+
+# Package files
+package-lock.json

.prettierrc.js

@@ -0,0 +1,11 @@
+/**
+ * @type {import('prettier').Config}
+ */
+module.exports = {
+  trailingComma: 'all',
+  tabWidth: 2,
+  semi: true,
+  singleQuote: true,
+  printWidth: 100,
+  bracketSpacing: true,
+};

.tool-versions

@@ -0,0 +1 @@
+nodejs 24.11.0

AGENTS.md

@@ -0,0 +1,80 @@
+# action-gh-release
+
+This repository is maintained as a small, user-facing GitHub Action with a relatively wide compatibility surface.
+Optimize for stability, reproducibility, and clear user value over broad rewrites.
+
+## Core Rules
+
+- Prefer narrow behavior fixes over structural churn.
+- Reproduce current behavior on `master` before changing code.
+- Treat GitHub platform behavior as distinct from action behavior.
+  If GitHub controls the outcome, prefer docs or clearer errors over brittle workarounds.
+- Do not revive stale PRs mechanically.
+  Reuse the idea if it still has value, but reimplement on top of current `master`.
+- Avoid standalone refactors with no clear user-facing benefit.
+
+## Current Architecture
+
+- `src/main.ts` is the orchestration layer: parse config, validate inputs, create/update release, upload assets, finalize, set outputs.
+- `src/github.ts` owns release semantics: lookup, create/update/finalize, asset upload, race handling, and GitHub API interaction.
+- `src/util.ts` owns parsing and path normalization.
+- Keep behavior-specific logic in `src/github.ts` or `src/util.ts`; avoid growing `src/main.ts` with ad-hoc feature branches.
+
+## Bug-Fix Workflow
+
+- Reproduce the issue against current `master` first.
+- When available, use the companion consumer harness repo `action-gh-release-test`.
+- Capture exact workflow run URLs and release URLs before claiming a fix.
+- If the issue is really a docs/usage or platform-limit case, document it and close it as such instead of forcing a code change.
+- If a historical issue no longer reproduces on current `master`, prefer a short closeout note that asks the reporter to open a fresh issue if they still see it.
+
+## Feature Triage
+
+- Ship features only when there is clear user value or repeated demand.
+- Small convenience features are fine, but they should stay small.
+- Weak-demand features should not expand parsing complexity, cross-platform ambiguity, or maintenance surface.
+- For old feature PRs:
+  - check whether current `master` already covers the behavior
+  - prefer a tiny docs clarification if the behavior exists but is poorly explained
+  - close stale feature PRs when the idea is obsolete, low-value, or badly shaped for the current codebase
+
+## Contract Sync
+
+When behavior changes, keep the external contract in sync:
+
+- update `README.md`
+- update `action.yml`
+- update tests under `__tests__/`
+- regenerate `dist/index.js` with `npm run build`
+
+Docs-only changes do not need `dist/index.js` regeneration.
+
+## Verification
+
+For code changes, run:
+
+- `npm run fmtcheck`
+- `npm run typecheck`
+- `npm run build`
+- `npm test`
+
+For behavior changes, also run the relevant external regression workflow(s) in `action-gh-release-test` against the exact ref under test.
+
+## Release and Triage Conventions
+
+- Keep PR labels accurate. Release notes depend on them.
+  - bug fixes: `bug`
+  - docs-only changes: `documentation`
+  - additive features: `feature` or `enhancement`
+  - dependency updates: `dependencies`
+- Follow [RELEASE.md](RELEASE.md) for version bumps, changelog updates, tagging, and release publication.
+- Prefer manual issue/PR closeouts with a short rationale over implicit assumptions.
+- Do not auto-close old PRs or issues through unrelated docs PRs.
+
+## Implementation Preferences
+
+- Preserve the current upload/finalize flow unless there is strong evidence it needs to change.
+- Prefer upload-time semantics over filesystem mutation.
+- Be careful with parsing changes around `files`, path handling, and Windows compatibility.
+- Be careful with race-condition fixes; verify both local tests and consumer-repo concurrency harnesses.
+- Do not assume a refactor is safe just because tests are green. This action’s behavior is heavily shaped by GitHub API edge cases.

CHANGELOG.md

@@ -1,4 +1,254 @@
-## 2.0.3 (unreleased)
+## 2.5.3
+
+`2.5.3` is a patch release focused on the remaining path-handling and release-selection bugs uncovered after `2.5.2`.
+It fixes `#639`, `#571`, `#280`, `#614`, `#311`, `#403`, and `#368`.
+It also adds documentation clarifications for `#541`, `#645`, `#542`, `#393`, and `#411`,
+where the current behavior is either usage-sensitive or constrained by GitHub platform limits rather than an action-side runtime bug.
+
+If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.
+
+## What's Changed
+
+### Bug fixes 🐛
+
+* fix: prefer token input over GITHUB_TOKEN by @chenrui333 in https://github.com/softprops/action-gh-release/pull/751
+* fix: clean up duplicate drafts after canonicalization by @chenrui333 in https://github.com/softprops/action-gh-release/pull/753
+* fix: support Windows-style file globs by @chenrui333 in https://github.com/softprops/action-gh-release/pull/754
+* fix: normalize refs-tag inputs by @chenrui333 in https://github.com/softprops/action-gh-release/pull/755
+* fix: expand tilde file paths by @chenrui333 in https://github.com/softprops/action-gh-release/pull/756
+
+### Other Changes 🔄
+
+* docs: clarify token precedence by @chenrui333 in https://github.com/softprops/action-gh-release/pull/752
+* docs: clarify GitHub release limits by @chenrui333 in https://github.com/softprops/action-gh-release/pull/758
+* documentation clarifications for empty-token handling, `preserve_order`, and special-character asset filename behavior
+
+## 2.5.2
+
+`2.5.2` is a patch release focused on the remaining release-creation and prerelease regressions in the `2.5.x` bug-fix cycle.
+It fixes `#705`, fixes `#708`, fixes `#740`, fixes `#741`, and fixes `#722`.
+Regression testing covers the shared-tag race, prerelease event behavior, dotfile asset labels,
+same-filename concurrent uploads, and blocked-tag cleanup behavior.
+
+If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.
+
+## What's Changed
+
+### Bug fixes 🐛
+
+* fix: canonicalize releases after concurrent create by @chenrui333 in https://github.com/softprops/action-gh-release/pull/746
+* fix: preserve prereleased events for prereleases by @chenrui333 in https://github.com/softprops/action-gh-release/pull/748
+* fix: restore dotfile asset labels by @chenrui333 in https://github.com/softprops/action-gh-release/pull/749
+* fix: handle upload already_exists races across workflows by @api2062 in https://github.com/softprops/action-gh-release/pull/745
+* fix: clean up orphan drafts when tag creation is blocked by @chenrui333 in https://github.com/softprops/action-gh-release/pull/750
+
+## 2.5.1
+
+`2.5.1` is a patch release focused on regressions introduced in `2.5.0` and on release lookup reliability.
+It fixes `#713`, addresses `#703`, and fixes `#724`. Regression testing shows that
+current `master` no longer reproduces the finalize-race behavior reported in `#704` and `#709`.
+
+## What's Changed
+
+### Bug fixes 🐛
+
+* fix: fetch correct asset URL after finalization; test; some refactoring by @pzhlkj6612 in https://github.com/softprops/action-gh-release/pull/738
+* fix: release marked as 'latest' despite make_latest: false by @Boshen in https://github.com/softprops/action-gh-release/pull/715
+* fix: use getReleaseByTag API instead of iterating all releases by @kim-em in https://github.com/softprops/action-gh-release/pull/725
+
+### Other Changes 🔄
+
+* dependency updates, including the ESM/runtime compatibility refresh in https://github.com/softprops/action-gh-release/pull/731
+
+## 2.5.0
+
+## What's Changed
+
+### Exciting New Features 🎉
+
+* feat: mark release as draft until all artifacts are uploaded by @dumbmoron in https://github.com/softprops/action-gh-release/pull/692
+
+### Other Changes 🔄
+
+* dependency updates
+
+## 2.4.2
+
+## What's Changed
+
+### Exciting New Features 🎉
+
+* feat: Ensure generated release notes cannot be over 125000 characters by @BeryJu in https://github.com/softprops/action-gh-release/pull/684
+
+### Other Changes 🔄
+
+* dependency updates
+
+## 2.4.1
+
+## What's Changed
+
+### Other Changes 🔄
+
+* fix(util): support brace expansion globs containing commas in parseInputFiles by @Copilot in https://github.com/softprops/action-gh-release/pull/672
+* fix: gracefully fallback to body when body_path cannot be read by @Copilot in https://github.com/softprops/action-gh-release/pull/671
+
+## 2.4.0
+
+## What's Changed
+
+### Exciting New Features 🎉
+
+* feat(action): respect working_directory for files globs by @stephenway in https://github.com/softprops/action-gh-release/pull/667
+
+## 2.3.4
+
+## What's Changed
+
+### Bug fixes 🐛
+
+* fix(action): handle 422 already_exists race condition by @stephenway in https://github.com/softprops/action-gh-release/pull/665
+
+### Other Changes 🔄
+
+- dependency updates
+
+## 2.3.3
+
+## What's Changed
+
+### Exciting New Features 🎉
+
+* feat: add input option `overwrite_files` by @asfernandes in https://github.com/softprops/action-gh-release/pull/343
+
+### Other Changes 🔄
+
+- dependency updates
+
+## 2.3.2
+
+* fix: revert fs `readableWebStream` change
+
+## 2.3.1
+
+### Bug fixes 🐛
+
+* fix: fix file closing issue by @WailGree in https://github.com/softprops/action-gh-release/pull/629
+
+## 2.3.0
+
+* Migrate from jest to vitest
+* Replace `mime` with `mime-types`
+* Bump to use node 24
+* Dependency updates
+
+## 2.2.2
+
+## What's Changed
+
+### Bug fixes 🐛
+
+* fix: updating release draft status from true to false by @galargh in https://github.com/softprops/action-gh-release/pull/316
+
+### Other Changes 🔄
+
+* chore: simplify ref_type test by @steinybot in https://github.com/softprops/action-gh-release/pull/598
+* fix(docs): clarify the default for tag_name by @muzimuzhi in https://github.com/softprops/action-gh-release/pull/599
+* test(release): add unit tests when searching for a release by @rwaskiewicz in https://github.com/softprops/action-gh-release/pull/603
+* dependency updates
+
+## 2.2.1
+
+## What's Changed
+
+### Bug fixes 🐛
+
+* fix: big file uploads by @xen0n in https://github.com/softprops/action-gh-release/pull/562
+
+### Other Changes 🔄
+* chore(deps): bump @types/node from 22.10.1 to 22.10.2 by @dependabot in https://github.com/softprops/action-gh-release/pull/559
+* chore(deps): bump @types/node from 22.10.2 to 22.10.5 by @dependabot in https://github.com/softprops/action-gh-release/pull/569
+* chore: update error and warning messages for not matching files in files field by @ytimocin in https://github.com/softprops/action-gh-release/pull/568
+
+## 2.2.0
+
+## What's Changed
+
+### Exciting New Features 🎉
+
+* feat: read the release assets asynchronously by @xen0n in https://github.com/softprops/action-gh-release/pull/552
+
+### Bug fixes 🐛
+
+* fix(docs): clarify the default for tag_name by @alexeagle in https://github.com/softprops/action-gh-release/pull/544
+
+### Other Changes 🔄
+
+* chore(deps): bump typescript from 5.6.3 to 5.7.2 by @dependabot in https://github.com/softprops/action-gh-release/pull/548
+* chore(deps): bump @types/node from 22.9.0 to 22.9.4 by @dependabot in https://github.com/softprops/action-gh-release/pull/547
+* chore(deps): bump cross-spawn from 7.0.3 to 7.0.6 by @dependabot in https://github.com/softprops/action-gh-release/pull/545
+* chore(deps): bump @vercel/ncc from 0.38.2 to 0.38.3 by @dependabot in https://github.com/softprops/action-gh-release/pull/543
+* chore(deps): bump prettier from 3.3.3 to 3.4.1 by @dependabot in https://github.com/softprops/action-gh-release/pull/550
+* chore(deps): bump @types/node from 22.9.4 to 22.10.1 by @dependabot in https://github.com/softprops/action-gh-release/pull/551
+* chore(deps): bump prettier from 3.4.1 to 3.4.2 by @dependabot in https://github.com/softprops/action-gh-release/pull/554
+
+## 2.1.0
+
+## What's Changed
+
+### Exciting New Features 🎉
+* feat: add support for release assets with multiple spaces within the name by @dukhine in https://github.com/softprops/action-gh-release/pull/518
+* feat: preserve upload order by @richarddd in https://github.com/softprops/action-gh-release/pull/500
+
+### Other Changes 🔄
+* chore(deps): bump @types/node from 22.8.2 to 22.8.7 by @dependabot in https://github.com/softprops/action-gh-release/pull/539
+
+## 2.0.9
+
+- maintenance release with updated dependencies
+
+## 2.0.8
+
+### Other Changes 🔄
+* chore(deps): bump prettier from 2.8.0 to 3.3.3 by @dependabot in https://github.com/softprops/action-gh-release/pull/480
+* chore(deps): bump @types/node from 20.14.9 to 20.14.11 by @dependabot in https://github.com/softprops/action-gh-release/pull/483
+* chore(deps): bump @octokit/plugin-throttling from 9.3.0 to 9.3.1 by @dependabot in https://github.com/softprops/action-gh-release/pull/484
+* chore(deps): bump glob from 10.4.2 to 11.0.0 by @dependabot in https://github.com/softprops/action-gh-release/pull/477
+* refactor: write jest config in ts by @chenrui333 in https://github.com/softprops/action-gh-release/pull/485
+* chore(deps): bump @actions/github from 5.1.1 to 6.0.0 by @dependabot in https://github.com/softprops/action-gh-release/pull/470
+
+## 2.0.7
+
+### Bug fixes 🐛
+
+* Fix missing update release body by @FirelightFlagboy in https://github.com/softprops/action-gh-release/pull/365
+
+### Other Changes 🔄
+
+* Bump @octokit/plugin-retry from 4.0.3 to 7.1.1 by @dependabot in https://github.com/softprops/action-gh-release/pull/443
+* Bump typescript from 4.9.5 to 5.5.2 by @dependabot in https://github.com/softprops/action-gh-release/pull/467
+* Bump @types/node from 20.14.6 to 20.14.8 by @dependabot in https://github.com/softprops/action-gh-release/pull/469
+* Bump @types/node from 20.14.8 to 20.14.9 by @dependabot in https://github.com/softprops/action-gh-release/pull/473
+* Bump typescript from 5.5.2 to 5.5.3 by @dependabot in https://github.com/softprops/action-gh-release/pull/472
+* Bump ts-jest from 29.1.5 to 29.2.2 by @dependabot in https://github.com/softprops/action-gh-release/pull/479
+* docs: document that existing releases are updated by @jvanbruegge in https://github.com/softprops/action-gh-release/pull/474
+
+## 2.0.6
+
+- maintenance release with updated dependencies
+
+## 2.0.5
+
+- Factor in file names with spaces when upserting files [#446](https://github.com/softprops/action-gh-release/pull/446) via [@MystiPanda](https://github.com/MystiPanda)
+- Improvements to error handling [#449](https://github.com/softprops/action-gh-release/pull/449) via [@till](https://github.com/till)
+
+## 2.0.4
+
+- Minor follow up to [#417](https://github.com/softprops/action-gh-release/pull/417). [#425](https://github.com/softprops/action-gh-release/pull/425)
+
+## 2.0.3
+
+- Declare `make_latest` as an input field in `action.yml` [#419](https://github.com/softprops/action-gh-release/pull/419)
 
 ## 2.0.2
 
@@ -13,7 +263,7 @@
 
 ## 2.0.0
 
-- `2.0.0`!? this release corrects a disjunction between git tag versions used in the marketplace and versions list this file. Previous versions should have really been 1.\*. Going forward this should be better aligned.
+- `2.0.0`!? this release corrects a disjunction between git tag versions used in the marketplace and the versions listed in this file. Previous versions should have really been 1.\*. Going forward this should be better aligned.
 - Upgrade action.yml declaration to node20 to address deprecations
 
 ## 0.1.15
@@ -24,7 +274,7 @@
 
 ## 0.1.14
 
-- provides an new workflow input option `generate_release_notes` which when set to true will automatically generate release notes for you based on GitHub activity [#179](https://github.com/softprops/action-gh-release/pull/179). Please see the [GitHub docs for this feature](https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes) for more information
+- provides a new workflow input option `generate_release_notes` which when set to true will automatically generate release notes for you based on GitHub activity [#179](https://github.com/softprops/action-gh-release/pull/179). Please see the [GitHub docs for this feature](https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes) for more information
 
 ## 0.1.13
 
@@ -32,7 +282,7 @@
 
 ## 0.1.12
 
-- fix bug leading to empty strings subsituted for inputs users don't provide breaking api calls [#144](https://github.com/softprops/action-gh-release/pull/144)
+- fix bug leading to empty strings substituted for inputs users don't provide breaking api calls [#144](https://github.com/softprops/action-gh-release/pull/144)
 
 ## 0.1.11
 
@@ -49,7 +299,7 @@
 ## 0.1.8
 
 - address recent warnings in assert upload api as well as introduce asset upload overrides, allowing for multiple runs for the same release with the same named asserts [#134](https://github.com/softprops/action-gh-release/pull/134)
-- fix backwards compatibility with `GITHUB_TOKEN` resolution. `GITHUB_TOKEN` is no resolved first from an env varibale and then from and input [#133](https://github.com/softprops/action-gh-release/pull/133)
+- fix backwards compatibility with `GITHUB_TOKEN` resolution. `GITHUB_TOKEN` is now resolved first from an env variable and then from an input [#133](https://github.com/softprops/action-gh-release/pull/133)
 - trim white space in provided `tag_name` [#130](https://github.com/softprops/action-gh-release/pull/130)
 
 ## 0.1.7
@@ -62,14 +312,14 @@
 
 This is a release catch up have a hiatus. Future releases will happen more frequently
 
-- Add 'fail_on_unmatched_files' input, useful for catching cases were your `files` input does not actually match what you expect [#55](https://github.com/softprops/action-gh-release/pull/55)
+- Add 'fail_on_unmatched_files' input, useful for catching cases where your `files` input does not actually match what you expect [#55](https://github.com/softprops/action-gh-release/pull/55)
 - Add `repository` input, useful for creating a release in an external repository [#61](https://github.com/softprops/action-gh-release/pull/61)
-- Add release `id` to outputs, useful for refering to release in workflow steps following the step that uses this action [#60](https://github.com/softprops/action-gh-release/pull/60)
+- Add release `id` to outputs, useful for referring to release in workflow steps following the step that uses this action [#60](https://github.com/softprops/action-gh-release/pull/60)
 - Add `upload_url` as action output, useful for managing uploads separately [#75](https://github.com/softprops/action-gh-release/pull/75)
 - Support custom `target_commitish` value, useful to customize the default [#76](https://github.com/softprops/action-gh-release/pull/76)
-- fix `body_path` input first then fall back on `body` input. this was the originally documented precedence but was implemened the the opposite order! [#85](https://github.com/softprops/action-gh-release/pull/85)
+- fix `body_path` input first then fall back on `body` input. This was the originally documented precedence but was implemented in the opposite order! [#85](https://github.com/softprops/action-gh-release/pull/85)
 - Retain original release info if the keys are not set, useful for filling in blanks for a release you've already started separately [#109](https://github.com/softprops/action-gh-release/pull/109)
-- Limit number of times github api request to create a release is retried, useful for avoiding eating up your rate limit and action minutes do to either an invalid token or other circumstance causing the api call to fail [#111](https://github.com/softprops/action-gh-release/pull/111)
+- Limit number of times github api request to create a release is retried, useful for avoiding eating up your rate limit and action minutes due to either an invalid token or other circumstance causing the api call to fail [#111](https://github.com/softprops/action-gh-release/pull/111)
 
 ## 0.1.5
 
@@ -79,7 +329,7 @@ This is a release catch up have a hiatus. Future releases will happen more frequ
 
 - Added support for updating releases body [#36](https://github.com/softprops/action-gh-release/pull/36)
 - Steps can now access the url of releases with the `url` output of this Action [#28](https://github.com/softprops/action-gh-release/pull/28)
-- Added basic GitHub API retry support to manage API turbulance [#26](https://github.com/softprops/action-gh-release/pull/26)
+- Added basic GitHub API retry support to manage API turbulence [#26](https://github.com/softprops/action-gh-release/pull/26)
 
 ## 0.1.3
 
@@ -94,7 +344,7 @@ This is now fixed.
 
 - Add support for newline-delimited asset list [#18](https://github.com/softprops/action-gh-release/pull/18)
 
-GitHub actions inputs don't inherently support lists of things and one might like to append a list of files to include in a release. Previously this was possible using a comma-delimited list of asset path patterns to upload. You can now provide these as a newline delimieted list for better readability
+GitHub actions inputs don't inherently support lists of things and one might like to append a list of files to include in a release. Previously this was possible using a comma-delimited list of asset path patterns to upload. You can now provide these as a newline delimited list for better readability
 
 ```yaml
 - name: Release

README.md

@@ -21,6 +21,16 @@
 
 <br />
 
+- [🤸 Usage](#-usage)
+  - [🚥 Limit releases to pushes to tags](#-limit-releases-to-pushes-to-tags)
+  - [⬆️ Uploading release assets](#️-uploading-release-assets)
+  - [📝 External release notes](#-external-release-notes)
+  - [💅 Customizing](#-customizing)
+    - [inputs](#inputs)
+    - [outputs](#outputs)
+    - [environment variables](#environment-variables)
+  - [Permissions](#permissions)
+
 ## 🤸 Usage
 
 ### 🚥 Limit releases to pushes to tags
@@ -41,10 +51,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Release
         uses: softprops/action-gh-release@v2
-        if: startsWith(github.ref, 'refs/tags/')
+        if: github.ref_type == 'tag'
 ```
 
 You can also use push config tag filter
@@ -62,7 +72,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Release
         uses: softprops/action-gh-release@v2
 ```
@@ -75,6 +85,7 @@ GitHub release and all are optional.
 A common case for GitHub releases is to upload your binary after its been validated and packaged.
 Use the `with.files` input to declare a newline-delimited list of glob expressions matching the files
 you wish to upload to GitHub releases. If you'd like you can just list the files by name directly.
+If a tag already has a GitHub release, the existing release will be updated with the release assets.
 
 Below is an example of uploading a single asset named `Release.txt`
 
@@ -88,14 +99,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Build
         run: echo ${{ github.sha }} > Release.txt
       - name: Test
         run: cat Release.txt
       - name: Release
         uses: softprops/action-gh-release@v2
-        if: startsWith(github.ref, 'refs/tags/')
+        if: github.ref_type == 'tag'
         with:
           files: Release.txt
 ```
@@ -112,14 +123,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Build
         run: echo ${{ github.sha }} > Release.txt
       - name: Test
         run: cat Release.txt
       - name: Release
         uses: softprops/action-gh-release@v2
-        if: startsWith(github.ref, 'refs/tags/')
+        if: github.ref_type == 'tag'
         with:
           files: |
             Release.txt
@@ -128,7 +139,21 @@ jobs:
 
 > **⚠️ Note:** Notice the `|` in the yaml syntax above ☝️. That lets you effectively declare a multi-line yaml string. You can learn more about multi-line yaml syntax [here](https://yaml-multiline.info)
 
-> **⚠️ Note for Windows:** Paths must use `/` as a separator, not `\`, as `\` is used to escape characters with special meaning in the pattern; for example, instead of specifying `D:\Foo.txt`, you must specify `D:/Foo.txt`. If you're using PowerShell, you can do this with `$Path = $Path -replace '\\','/'`
+> **⚠️ Note for Windows:** Both `\` and `/` path separators are accepted in `files` globs. If you need to match a literal glob metacharacter such as `[` or `]`, keep escaping the metacharacter itself in the pattern.
+
+If your release assets are generated under a subdirectory, set `working_directory`
+and keep the `files` patterns relative to that directory.
+
+```yaml
+- name: Release
+  uses: softprops/action-gh-release@v2
+  if: github.ref_type == 'tag'
+  with:
+    working_directory: dist
+    files: |
+      Release.txt
+      checksums/*.txt
+```
 
 ### 📝 External release notes
 
@@ -146,19 +171,34 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Generate Changelog
         run: echo "# Good things have arrived" > ${{ github.workspace }}-CHANGELOG.txt
       - name: Release
         uses: softprops/action-gh-release@v2
-        if: startsWith(github.ref, 'refs/tags/')
+        if: github.ref_type == 'tag'
         with:
           body_path: ${{ github.workspace }}-CHANGELOG.txt
+          repository: my_gh_org/my_gh_repo
           # note you'll typically need to create a personal access token
-          # with permissions to create releases in the other repo
+          # with permissions to create releases in the other repo.
+          # A non-empty explicit token overrides GITHUB_TOKEN.
+          # Omit the input to use github.token; passing "" treats the token as unset.
           token: ${{ secrets.CUSTOM_GITHUB_TOKEN }}
-        env:
-          GITHUB_REPOSITORY: my_gh_org/my_gh_repo
+```
+
+When you use GitHub's built-in `generate_release_notes` support, you can optionally
+pin the comparison base explicitly with `previous_tag`. This is useful when the default
+comparison range does not match the release series you want to publish.
+
+```yaml
+- name: Release
+  uses: softprops/action-gh-release@v2
+  with:
+    tag_name: stage-2026-03-15
+    target_commitish: ${{ github.sha }}
+    previous_tag: prod-2026-03-01
+    generate_release_notes: true
 ```
 
 ### 💅 Customizing
@@ -171,37 +211,58 @@ The following are optional as `step.with` keys
 | -------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `body`                     | String  | Text communicating notable changes in this release                                                                                                                                                                                                                                                                                                                                                                                              |
 | `body_path`                | String  | Path to load text communicating notable changes in this release                                                                                                                                                                                                                                                                                                                                                                                 |
-| `draft`                    | Boolean | Indicator of whether or not this release is a draft                                                                                                                                                                                                                                                                                                                                                                                             |
+| `draft`                    | Boolean | Keep the release as a draft. Defaults to false. When reusing an existing draft release, set this to true to keep it draft; omit it to publish after upload.                                                                                                                                                                                                                                                                                 |
 | `prerelease`               | Boolean | Indicator of whether or not is a prerelease                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `files`                    | String  | Newline-delimited globs of paths to assets to upload for release                                                                                                                                                                                                                                                                                                                                                                                |
+| `preserve_order`           | Boolean | Upload assets sequentially in the provided order. This controls the action's upload behavior, but it does not control the final asset ordering that GitHub may display on the release page or return from the Releases API.                                                                                                                                                                                                                 |
+| `files`                    | String  | Newline-delimited globs of paths to assets to upload for release. Escape glob metacharacters when you need to match a literal filename that contains them, such as `[` or `]`. `~/...` expands to the runner home directory. On Windows, both `\` and `/` separators are accepted. GitHub may normalize raw asset filenames that contain special characters; the action restores the asset label when possible, but the final download name remains GitHub-controlled. |
+| `working_directory`        | String  | Base directory to resolve `files` globs against. Use this when release assets live under a subdirectory. If omitted, the action resolves `files` from `${{ github.workspace }}`.                                                                                                                                                                                                                                                          |
+| `overwrite_files`          | Boolean | Indicator of whether files should be overwritten when they already exist. Defaults to true                                                                                                                                                                                                                                                                                                                                                      |
 | `name`                     | String  | Name of the release. defaults to tag name                                                                                                                                                                                                                                                                                                                                                                                                       |
-| `tag_name`                 | String  | Name of a tag. defaults to `github.ref`                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `tag_name`                 | String  | Name of a tag. defaults to `github.ref_name`. `refs/tags/<name>` values are normalized to `<name>`.                                                                                                                                                                                                                                                                                                                                                |
 | `fail_on_unmatched_files`  | Boolean | Indicator of whether to fail if any of the `files` globs match nothing                                                                                                                                                                                                                                                                                                                                                                          |
 | `repository`               | String  | Name of a target repository in `<owner>/<repo>` format. Defaults to GITHUB_REPOSITORY env variable                                                                                                                                                                                                                                                                                                                                              |
-| `target_commitish`         | String  | Commitish value that determines where the Git tag is created from. Can be any branch or commit SHA. Defaults to repository default branch.                                                                                                                                                                                                                                                                                                      |
-| `token`                    | String  | Secret GitHub Personal Access Token. Defaults to `${{ github.token }}`                                                                                                                                                                                                                                                                                                                                                                          |
+| `target_commitish`         | String  | Commitish value that determines where the Git tag is created from. Can be any branch or commit SHA. Defaults to repository default branch. When creating a new tag for an older commit, `github.token` may not have permission to create the ref; use a PAT or another token with sufficient contents permissions if you hit `403 Resource not accessible by integration`.                                                                 |
+| `token`                    | String  | Authorized GitHub token or PAT. Defaults to `${{ github.token }}` when omitted. A non-empty explicit token overrides `GITHUB_TOKEN`. Passing `""` treats the token as explicitly unset, so omit the input entirely or use an expression such as `${{ inputs.token || github.token }}` when wrapping this action in a composite action.                                                                                                                                                  |
 | `discussion_category_name` | String  | If specified, a discussion of the specified category is created and linked to the release. The value must be a category that already exists in the repository. For more information, see ["Managing categories for discussions in your repository."](https://docs.github.com/en/discussions/managing-discussions-for-your-community/managing-categories-for-discussions-in-your-repository)                                                     |
 | `generate_release_notes`   | Boolean | Whether to automatically generate the name and body for this release. If name is specified, the specified name will be used; otherwise, a name will be automatically generated. If body is specified, the body will be pre-pended to the automatically generated notes. See the [GitHub docs for this feature](https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes) for more information |
+| `previous_tag`             | String  | Optional. When `generate_release_notes` is enabled, use this tag as GitHub's `previous_tag_name` comparison base. If omitted, GitHub chooses the comparison base automatically.                                                                                                                                                                                                               |
 | `append_body`              | Boolean | Append to existing body instead of overwriting it                                                                                                                                                                                                                                                                                                                                                                                               |
-| `make_latest` | Boolean | Whether to mark the release as latest or not. |
+| `make_latest`              | String  | Specifies whether this release should be set as the latest release for the repository. Drafts and prereleases cannot be set as latest. Can be `true`, `false`, or `legacy`. Uses GitHub api defaults if not provided                                                                                                                                                                                                                            |
 
 💡 When providing a `body` and `body_path` at the same time, `body_path` will be
 attempted first, then falling back on `body` if the path can not be read from.
 
-💡 When the release info keys (such as `name`, `body`, `draft`, `prerelease`, etc.)
-are not explicitly set and there is already an existing release for the tag, the
-release will retain its original info.
+💡 When the release info keys (such as `name`, `body`, `prerelease`, etc.) are not
+explicitly set and there is already an existing release for the tag, the release
+will retain its original info.
+
+💡 Draft status is handled separately during finalization. If the action reuses an
+existing draft release, set `draft: true` to keep it draft; if `draft` is omitted,
+the action will publish that draft after uploading assets.
+
+💡 When the action creates a new release that uploads assets, it stages the release
+as a draft first, uploads the assets, and then publishes it unless `draft: true`
+keeps it as a draft. This keeps new prereleases compatible with GitHub immutable
+releases.
+
+💡 `files` is glob-based, so literal filenames that contain glob metacharacters such as
+`[` or `]` must be escaped in the pattern.
+
+💡 GitHub may normalize or rewrite uploaded asset filenames that contain special or
+non-ASCII characters. This action uploads the requested file, but it cannot force the
+final asset name that GitHub stores or returns from the Releases API. In particular,
+4-byte Unicode characters such as emoji cannot currently be restored via asset labels.
 
 #### outputs
 
 The following outputs can be accessed via `${{ steps.<step-id>.outputs }}` from this action
 
-| Name         | Type   | Description                                                                                                                                                                                                |
-| ------------ | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `url`        | String | Github.com URL for the release                                                                                                                                                                             |
-| `id`         | String | Release ID                                                                                                                                                                                                 |
-| `upload_url` | String | URL for uploading assets to the release                                                                                                                                                                    |
-| `assets`     | String | JSON array containing information about each uploaded asset, in the format given [here](https://docs.github.com/en/rest/releases/assets#get-a-release-asset) (minus the `uploader` field) |
+| Name         | Type   | Description                                                                                                                                                                               |
+| ------------ | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `url`        | String | Github.com URL for the release                                                                                                                                                            |
+| `id`         | String | Release ID                                                                                                                                                                                |
+| `upload_url` | String | URL for uploading assets to the release                                                                                                                                                   |
+| `assets`     | String | JSON array containing information about each updated (newly uploaded or overwritten) asset, in the format given [here](https://docs.github.com/en/rest/releases/assets#get-a-release-asset) (minus the `uploader` field) |
 
 As an example, you can use `${{ fromJSON(steps.<step-id>.outputs.assets)[0].browser_download_url }}` to get the download URL of the first asset.
 

RELEASE.md

@@ -0,0 +1,41 @@
+# Release Workflow
+
+Use this checklist when cutting a new `action-gh-release` release.
+
+## Inputs
+
+- Decide the semantic version bump first: `major`, `minor`, or `patch`.
+- Review recent merged PRs and labels before drafting the changelog entry.
+- Make sure `master` is current and the worktree is clean before starting.
+
+## Checklist
+
+1. Update [package.json](package.json) to the new version.
+2. Add the new entry at the top of [CHANGELOG.md](CHANGELOG.md).
+   - Summarize the release in 1 short paragraph.
+   - Prefer user-facing fixes and features over internal churn.
+   - Keep the merged PR list aligned with `.github/release.yml` categories.
+3. Run `npm i` to refresh [package-lock.json](package-lock.json).
+4. Run the full local verification set:
+   - `npm run fmtcheck`
+   - `npm run typecheck`
+   - `npm run build`
+   - `npm test`
+5. Commit the release prep.
+   - Use a plain release commit message like `release 2.5.4`.
+6. Create the annotated tag for the release commit.
+   - Example: `git tag -a v2.5.4 -m "v2.5.4"`
+7. Push the commit and tag.
+   - Example: `git push origin master && git push origin v2.5.4`
+8. Move the floating major tag to the new release tag.
+   - For the current major line, either run `npm run updatetag` or update the script first if the major ever changes.
+   - Verify the floating tag points at the same commit as the new full tag.
+9. Create the GitHub release from the new tag.
+   - Prefer the release body from [CHANGELOG.md](CHANGELOG.md), then let GitHub append generated notes only if they add value.
+   - Verify the release shows the expected tag, title, notes, and attached artifacts.
+
+## Notes
+
+- Behavior changes should already have matching updates in [README.md](README.md), [action.yml](action.yml), tests, and `dist/index.js` before release prep begins.
+- Docs-only releases still need an intentional changelog entry and version bump decision.
+- If a release is mainly bug fixes, keep the title and summary patch-oriented; do not bury the actual fixes under dependency noise.

__tests__/util.test.ts

@@ -1,106 +1,203 @@
 import {
-  releaseBody,
+  alignAssetName,
+  expandHomePattern,
   isTag,
-  paths,
+  normalizeFilePattern,
+  normalizeGlobPattern,
+  normalizeTagName,
   parseConfig,
   parseInputFiles,
+  paths,
+  releaseBody,
   unmatchedPatterns,
   uploadUrl,
-} from "../src/util";
-import * as assert from "assert";
+} from '../src/util';
 
-describe("util", () => {
-  describe("uploadUrl", () => {
-    it("strips template", () => {
+import { assert, describe, expect, it } from 'vitest';
+
+describe('util', () => {
+  describe('uploadUrl', () => {
+    it('strips template', () => {
       assert.equal(
         uploadUrl(
-          "https://uploads.github.com/repos/octocat/Hello-World/releases/1/assets{?name,label}"
+          'https://uploads.github.com/repos/octocat/Hello-World/releases/1/assets{?name,label}',
         ),
-        "https://uploads.github.com/repos/octocat/Hello-World/releases/1/assets"
+        'https://uploads.github.com/repos/octocat/Hello-World/releases/1/assets',
       );
     });
   });
-  describe("parseInputFiles", () => {
-    it("parses empty strings", () => {
-      assert.deepStrictEqual(parseInputFiles(""), []);
+  describe('parseInputFiles', () => {
+    it('parses empty strings', () => {
+      assert.deepStrictEqual(parseInputFiles(''), []);
     });
-    it("parses comma-delimited strings", () => {
-      assert.deepStrictEqual(parseInputFiles("foo,bar"), ["foo", "bar"]);
+    it('parses comma-delimited strings', () => {
+      assert.deepStrictEqual(parseInputFiles('foo,bar'), ['foo', 'bar']);
     });
-    it("parses newline and comma-delimited (and then some)", () => {
-      assert.deepStrictEqual(
-        parseInputFiles("foo,bar\nbaz,boom,\n\ndoom,loom "),
-        ["foo", "bar", "baz", "boom", "doom", "loom"]
-      );
+    it('parses newline and comma-delimited (and then some)', () => {
+      assert.deepStrictEqual(parseInputFiles('foo,bar\nbaz,boom,\n\ndoom,loom '), [
+        'foo',
+        'bar',
+        'baz',
+        'boom',
+        'doom',
+        'loom',
+      ]);
+    });
+    it('handles globs with brace groups containing commas', () => {
+      assert.deepStrictEqual(parseInputFiles('./**/*.{exe,deb,tar.gz}\nfoo,bar'), [
+        './**/*.{exe,deb,tar.gz}',
+        'foo',
+        'bar',
+      ]);
+    });
+    it('handles single-line brace pattern correctly', () => {
+      assert.deepStrictEqual(parseInputFiles('./**/*.{exe,deb,tar.gz}'), [
+        './**/*.{exe,deb,tar.gz}',
+      ]);
     });
   });
-  describe("releaseBody", () => {
-    it("uses input body", () => {
+  describe('releaseBody', () => {
+    it('uses input body', () => {
       assert.equal(
-        "foo",
+        'foo',
         releaseBody({
-          github_ref: "",
-          github_repository: "",
-          github_token: "",
-          input_body: "foo",
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_body: 'foo',
           input_body_path: undefined,
           input_draft: false,
           input_prerelease: false,
+          input_preserve_order: undefined,
           input_files: [],
+          input_overwrite_files: undefined,
           input_name: undefined,
           input_tag_name: undefined,
           input_target_commitish: undefined,
           input_discussion_category_name: undefined,
           input_generate_release_notes: false,
           input_make_latest: undefined,
-        })
+        }),
       );
     });
-    it("uses input body path", () => {
+    it('uses input body path', () => {
       assert.equal(
-        "bar",
+        'bar',
         releaseBody({
-          github_ref: "",
-          github_repository: "",
-          github_token: "",
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
           input_body: undefined,
-          input_body_path: "__tests__/release.txt",
+          input_body_path: '__tests__/release.txt',
           input_draft: false,
           input_prerelease: false,
+          input_preserve_order: undefined,
           input_files: [],
+          input_overwrite_files: undefined,
           input_name: undefined,
           input_tag_name: undefined,
           input_target_commitish: undefined,
           input_discussion_category_name: undefined,
           input_generate_release_notes: false,
           input_make_latest: undefined,
-        })
+        }),
       );
     });
-    it("defaults to body path when both body and body path are provided", () => {
+    it('defaults to body path when both body and body path are provided', () => {
       assert.equal(
-        "bar",
+        'bar',
         releaseBody({
-          github_ref: "",
-          github_repository: "",
-          github_token: "",
-          input_body: "foo",
-          input_body_path: "__tests__/release.txt",
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_body: 'foo',
+          input_body_path: '__tests__/release.txt',
           input_draft: false,
           input_prerelease: false,
+          input_preserve_order: undefined,
           input_files: [],
+          input_overwrite_files: undefined,
           input_name: undefined,
           input_tag_name: undefined,
           input_target_commitish: undefined,
           input_discussion_category_name: undefined,
           input_generate_release_notes: false,
           input_make_latest: undefined,
-        })
+        }),
+      );
+    });
+    it('falls back to body when body_path is missing', () => {
+      assert.equal(
+        releaseBody({
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_body: 'fallback-body',
+          input_body_path: '__tests__/does-not-exist.txt',
+          input_draft: false,
+          input_prerelease: false,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_preserve_order: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        }),
+        'fallback-body',
+      );
+    });
+    it('returns undefined when body_path is missing and body is not provided', () => {
+      assert.equal(
+        releaseBody({
+          github_ref: '',
+          github_repository: '',
+          github_token: '',
+          input_body: undefined,
+          input_body_path: '__tests__/does-not-exist.txt',
+          input_draft: false,
+          input_prerelease: false,
+          input_files: [],
+          input_overwrite_files: undefined,
+          input_preserve_order: undefined,
+          input_name: undefined,
+          input_tag_name: undefined,
+          input_target_commitish: undefined,
+          input_discussion_category_name: undefined,
+          input_generate_release_notes: false,
+          input_make_latest: undefined,
+        }),
+        undefined,
       );
     });
   });
-  describe("parseConfig", () => {
-    it("parses basic config", () => {
+  describe('parseConfig', () => {
+    const baseParsedConfig = {
+      github_ref: '',
+      github_repository: '',
+      github_token: '',
+      input_working_directory: undefined,
+      input_append_body: false,
+      input_body: undefined,
+      input_body_path: undefined,
+      input_draft: undefined,
+      input_prerelease: undefined,
+      input_preserve_order: undefined,
+      input_files: [],
+      input_overwrite_files: undefined,
+      input_name: undefined,
+      input_tag_name: undefined,
+      input_fail_on_unmatched_files: false,
+      input_target_commitish: undefined,
+      input_discussion_category_name: undefined,
+      input_generate_release_notes: false,
+      input_previous_tag: undefined,
+      input_make_latest: undefined,
+    };
+
+    it('parses basic config', () => {
       assert.deepStrictEqual(
         parseConfig({
           // note: inputs declared in actions.yml, even when declared not required,
@@ -109,263 +206,285 @@ describe("util", () => {
           // as an empty string !== undefined in terms of what we pass to the api
           // so we cover that in a test case here to ensure undefined values are actually
           // resolved as undefined and not empty strings
-          INPUT_TARGET_COMMITISH: "",
-          INPUT_DISCUSSION_CATEGORY_NAME: "",
+          INPUT_TARGET_COMMITISH: '',
+          INPUT_DISCUSSION_CATEGORY_NAME: '',
         }),
-        {
-          github_ref: "",
-          github_repository: "",
-          github_token: "",
-          input_append_body: false,
-          input_body: undefined,
-          input_body_path: undefined,
-          input_draft: undefined,
-          input_prerelease: undefined,
-          input_files: [],
-          input_name: undefined,
-          input_tag_name: undefined,
-          input_fail_on_unmatched_files: false,
-          input_target_commitish: undefined,
-          input_discussion_category_name: undefined,
-          input_generate_release_notes: false,
-          input_make_latest: undefined,
-        }
+        baseParsedConfig,
       );
     });
 
-    it("parses basic config with commitish", () => {
+    it('parses basic config with commitish', () => {
       assert.deepStrictEqual(
         parseConfig({
-          INPUT_TARGET_COMMITISH: "affa18ef97bc9db20076945705aba8c516139abd",
+          INPUT_TARGET_COMMITISH: 'affa18ef97bc9db20076945705aba8c516139abd',
         }),
         {
-          github_ref: "",
-          github_repository: "",
-          github_token: "",
-          input_append_body: false,
-          input_body: undefined,
-          input_body_path: undefined,
-          input_draft: undefined,
-          input_prerelease: undefined,
-          input_files: [],
-          input_name: undefined,
-          input_tag_name: undefined,
-          input_fail_on_unmatched_files: false,
-          input_target_commitish: "affa18ef97bc9db20076945705aba8c516139abd",
-          input_discussion_category_name: undefined,
-          input_generate_release_notes: false,
-          input_make_latest: undefined,
-        }
+          ...baseParsedConfig,
+          input_target_commitish: 'affa18ef97bc9db20076945705aba8c516139abd',
+        },
       );
     });
-    it("supports discussion category names", () => {
+    it('supports discussion category names', () => {
       assert.deepStrictEqual(
         parseConfig({
-          INPUT_DISCUSSION_CATEGORY_NAME: "releases",
+          INPUT_DISCUSSION_CATEGORY_NAME: 'releases',
         }),
         {
-          github_ref: "",
-          github_repository: "",
-          github_token: "",
-          input_append_body: false,
-          input_body: undefined,
-          input_body_path: undefined,
-          input_draft: undefined,
-          input_prerelease: undefined,
-          input_files: [],
-          input_name: undefined,
-          input_tag_name: undefined,
-          input_fail_on_unmatched_files: false,
-          input_target_commitish: undefined,
-          input_discussion_category_name: "releases",
-          input_generate_release_notes: false,
-          input_make_latest: undefined,
-        }
+          ...baseParsedConfig,
+          input_discussion_category_name: 'releases',
+        },
       );
     });
 
-    it("supports generating release notes", () => {
+    it('supports generating release notes', () => {
       assert.deepStrictEqual(
         parseConfig({
-          INPUT_GENERATE_RELEASE_NOTES: "true",
+          INPUT_GENERATE_RELEASE_NOTES: 'true',
         }),
         {
-          github_ref: "",
-          github_repository: "",
-          github_token: "",
-          input_append_body: false,
-          input_body: undefined,
-          input_body_path: undefined,
-          input_draft: undefined,
-          input_prerelease: undefined,
-          input_files: [],
-          input_name: undefined,
-          input_tag_name: undefined,
-          input_fail_on_unmatched_files: false,
-          input_target_commitish: undefined,
-          input_discussion_category_name: undefined,
+          ...baseParsedConfig,
           input_generate_release_notes: true,
-          input_make_latest: undefined,
-        }
+        },
       );
     });
 
-    it("prefers GITHUB_TOKEN over token input for backwards compatibility", () => {
+    it('supports an explicit previous tag for release notes generation', () => {
       assert.deepStrictEqual(
         parseConfig({
-          INPUT_DRAFT: "false",
-          INPUT_PRERELEASE: "true",
-          GITHUB_TOKEN: "env-token",
-          INPUT_TOKEN: "input-token",
+          INPUT_PREVIOUS_TAG: '  v1.2.3  ',
         }),
         {
-          github_ref: "",
-          github_repository: "",
-          github_token: "env-token",
-          input_append_body: false,
-          input_body: undefined,
-          input_body_path: undefined,
+          ...baseParsedConfig,
+          input_previous_tag: 'v1.2.3',
+        },
+      );
+    });
+
+    it('prefers token input over GITHUB_TOKEN', () => {
+      assert.deepStrictEqual(
+        parseConfig({
+          INPUT_DRAFT: 'false',
+          INPUT_PRERELEASE: 'true',
+          INPUT_PRESERVE_ORDER: 'true',
+          GITHUB_TOKEN: 'env-token',
+          INPUT_TOKEN: 'input-token',
+        }),
+        {
+          ...baseParsedConfig,
+          github_token: 'input-token',
           input_draft: false,
           input_prerelease: true,
-          input_files: [],
-          input_name: undefined,
-          input_tag_name: undefined,
-          input_fail_on_unmatched_files: false,
-          input_target_commitish: undefined,
-          input_discussion_category_name: undefined,
-          input_generate_release_notes: false,
-          input_make_latest: undefined,
-        }
+          input_preserve_order: true,
+        },
       );
     });
-    it("uses input token as the source of GITHUB_TOKEN by default", () => {
+    it('falls back to GITHUB_TOKEN when token input is empty', () => {
       assert.deepStrictEqual(
         parseConfig({
-          INPUT_DRAFT: "false",
-          INPUT_PRERELEASE: "true",
-          INPUT_TOKEN: "input-token",
+          GITHUB_TOKEN: 'env-token',
+          INPUT_TOKEN: '   ',
         }),
         {
-          github_ref: "",
-          github_repository: "",
-          github_token: "input-token",
-          input_append_body: false,
-          input_body: undefined,
-          input_body_path: undefined,
+          ...baseParsedConfig,
+          github_token: 'env-token',
+        },
+      );
+    });
+    it('uses input token as the source of GITHUB_TOKEN by default', () => {
+      assert.deepStrictEqual(
+        parseConfig({
+          INPUT_DRAFT: 'false',
+          INPUT_PRERELEASE: 'true',
+          INPUT_TOKEN: 'input-token',
+        }),
+        {
+          ...baseParsedConfig,
+          github_token: 'input-token',
           input_draft: false,
           input_prerelease: true,
-          input_files: [],
-          input_name: undefined,
-          input_tag_name: undefined,
-          input_fail_on_unmatched_files: false,
-          input_target_commitish: undefined,
-          input_discussion_category_name: undefined,
-          input_generate_release_notes: false,
-          input_make_latest: undefined,
-        }
+        },
       );
     });
-    it("parses basic config with draft and prerelease", () => {
+    it('parses basic config with draft and prerelease', () => {
       assert.deepStrictEqual(
         parseConfig({
-          INPUT_DRAFT: "false",
-          INPUT_PRERELEASE: "true",
+          INPUT_DRAFT: 'false',
+          INPUT_PRERELEASE: 'true',
         }),
         {
-          github_ref: "",
-          github_repository: "",
-          github_token: "",
-          input_append_body: false,
-          input_body: undefined,
-          input_body_path: undefined,
+          ...baseParsedConfig,
           input_draft: false,
           input_prerelease: true,
-          input_files: [],
-          input_name: undefined,
-          input_tag_name: undefined,
-          input_fail_on_unmatched_files: false,
-          input_target_commitish: undefined,
-          input_discussion_category_name: undefined,
-          input_generate_release_notes: false,
-          input_make_latest: undefined,
-        }
+        },
       );
     });
-    it("parses basic config where make_latest is passed", () => {
+    it('parses basic config where make_latest is passed', () => {
       assert.deepStrictEqual(
         parseConfig({
-          INPUT_MAKE_LATEST: "false",
+          INPUT_MAKE_LATEST: 'false',
         }),
         {
-          github_ref: "",
-          github_repository: "",
-          github_token: "",
-          input_append_body: false,
-          input_body: undefined,
-          input_body_path: undefined,
-          input_draft: undefined,
-          input_prerelease: undefined,
-          input_files: [],
-          input_name: undefined,
-          input_tag_name: undefined,
-          input_fail_on_unmatched_files: false,
-          input_target_commitish: undefined,
-          input_discussion_category_name: undefined,
-          input_generate_release_notes: false,
-          input_make_latest: "false",
-        }
+          ...baseParsedConfig,
+          input_make_latest: 'false',
+        },
       );
     });
-    it("parses basic config with append_body", () => {
+    it('parses basic config with append_body', () => {
       assert.deepStrictEqual(
         parseConfig({
-          INPUT_APPEND_BODY: "true",
+          INPUT_APPEND_BODY: 'true',
         }),
         {
-          github_ref: "",
-          github_repository: "",
-          github_token: "",
+          ...baseParsedConfig,
           input_append_body: true,
-          input_body: undefined,
-          input_body_path: undefined,
-          input_draft: undefined,
-          input_prerelease: undefined,
-          input_files: [],
-          input_name: undefined,
-          input_tag_name: undefined,
-          input_fail_on_unmatched_files: false,
-          input_target_commitish: undefined,
-          input_discussion_category_name: undefined,
-          input_generate_release_notes: false,
-          input_make_latest: undefined,
-        }
+        },
       );
     });
-  });
-  describe("isTag", () => {
-    it("returns true for tags", async () => {
-      assert.equal(isTag("refs/tags/foo"), true);
+
+    it('normalizes refs/tags-prefixed input_tag_name values', () => {
+      expect(parseConfig({ INPUT_TAG_NAME: 'refs/tags/v1.2.3' }).input_tag_name).toBe('v1.2.3');
     });
-    it("returns false for other kinds of refs", async () => {
-      assert.equal(isTag("refs/heads/master"), false);
+  });
+  describe('isTag', () => {
+    it('returns true for tags', async () => {
+      assert.equal(isTag('refs/tags/foo'), true);
+    });
+    it('returns false for other kinds of refs', async () => {
+      assert.equal(isTag('refs/heads/master'), false);
     });
   });
 
-  describe("paths", () => {
-    it("resolves files given a set of paths", async () => {
-      assert.deepStrictEqual(
-        paths(["tests/data/**/*", "tests/data/does/not/exist/*"]),
-        ["tests/data/foo/bar.txt"]
-      );
+  describe('normalizeTagName', () => {
+    it('strips refs/tags/ from explicit tag names', () => {
+      assert.equal(normalizeTagName('refs/tags/v1.2.3'), 'v1.2.3');
+    });
+
+    it('leaves plain tag names unchanged', () => {
+      assert.equal(normalizeTagName('v1.2.3'), 'v1.2.3');
     });
   });
 
-  describe("unmatchedPatterns", () => {
+  describe('paths', () => {
+    it('resolves files given a set of paths', async () => {
+      assert.deepStrictEqual(paths(['tests/data/**/*', 'tests/data/does/not/exist/*']), [
+        'tests/data/foo/bar.txt',
+      ]);
+    });
+
+    it('resolves files relative to working_directory', async () => {
+      assert.deepStrictEqual(paths(['data/**/*'], 'tests'), ['tests/data/foo/bar.txt']);
+    });
+  });
+
+  describe('unmatchedPatterns', () => {
     it("returns the patterns that don't match any files", async () => {
       assert.deepStrictEqual(
-        unmatchedPatterns(["tests/data/**/*", "tests/data/does/not/exist/*"]),
-        ["tests/data/does/not/exist/*"]
+        unmatchedPatterns(['tests/data/**/*', 'tests/data/does/not/exist/*']),
+        ['tests/data/does/not/exist/*'],
       );
     });
+
+    it('resolves unmatched relative to working_directory', async () => {
+      assert.deepStrictEqual(unmatchedPatterns(['data/does/not/exist/*'], 'tests'), [
+        'data/does/not/exist/*',
+      ]);
+    });
+  });
+
+  describe('normalizeGlobPattern', () => {
+    it('preserves posix-style patterns on non-windows platforms', () => {
+      assert.equal(normalizeGlobPattern('./dist/**/*.tgz', 'linux'), './dist/**/*.tgz');
+    });
+
+    it('normalizes relative windows-style glob patterns', () => {
+      assert.equal(
+        normalizeGlobPattern('.\\release-assets\\rssguard-*win7.exe', 'win32'),
+        './release-assets/rssguard-*win7.exe',
+      );
+    });
+
+    it('normalizes absolute windows-style glob patterns', () => {
+      assert.equal(
+        normalizeGlobPattern('D:\\a\\repo\\build\\packages\\*', 'win32'),
+        'D:/a/repo/build/packages/*',
+      );
+    });
+  });
+
+  describe('expandHomePattern', () => {
+    it('expands a bare tilde to the provided home directory', () => {
+      assert.equal(expandHomePattern('~', '/home/runner'), '/home/runner');
+    });
+
+    it('expands posix-style tilde paths', () => {
+      assert.equal(expandHomePattern('~/release.txt', '/home/runner'), '/home/runner/release.txt');
+    });
+
+    it('leaves non-tilde paths unchanged', () => {
+      assert.equal(expandHomePattern('./release.txt', '/home/runner'), './release.txt');
+    });
+  });
+
+  describe('normalizeFilePattern', () => {
+    it('expands tilde paths before globbing', () => {
+      assert.equal(
+        normalizeFilePattern('~/release-assets/*.tgz', 'linux', '/home/runner'),
+        '/home/runner/release-assets/*.tgz',
+      );
+    });
+
+    it('expands tilde paths and normalizes windows separators', () => {
+      assert.equal(
+        normalizeFilePattern('~\\release-assets\\*.zip', 'win32', 'C:\\Users\\runner'),
+        'C:/Users/runner/release-assets/*.zip',
+      );
+    });
+  });
+
+  describe('replaceSpacesWithDots', () => {
+    it('replaces all spaces with dots', () => {
+      expect(alignAssetName('John Doe.bla')).toBe('John.Doe.bla');
+    });
+
+    it('handles names with multiple spaces', () => {
+      expect(alignAssetName('John William Doe.bla')).toBe('John.William.Doe.bla');
+    });
+
+    it('returns the same string if there are no spaces', () => {
+      expect(alignAssetName('JohnDoe')).toBe('JohnDoe');
+    });
+  });
+});
+
+describe('parseInputFiles edge cases', () => {
+  it('handles multiple brace groups on same line', () => {
+    assert.deepStrictEqual(parseInputFiles('./**/*.{exe,deb},./dist/**/*.{zip,tar.gz}'), [
+      './**/*.{exe,deb}',
+      './dist/**/*.{zip,tar.gz}',
+    ]);
+  });
+
+  it('handles nested braces', () => {
+    assert.deepStrictEqual(parseInputFiles('path/{a,{b,c}}/file.txt'), ['path/{a,{b,c}}/file.txt']);
+  });
+
+  it('handles empty comma-separated values', () => {
+    assert.deepStrictEqual(parseInputFiles('foo,,bar'), ['foo', 'bar']);
+  });
+
+  it('handles commas with spaces around braces', () => {
+    assert.deepStrictEqual(parseInputFiles(' ./**/*.{exe,deb} , file.txt '), [
+      './**/*.{exe,deb}',
+      'file.txt',
+    ]);
+  });
+
+  it('handles mixed newlines and commas with braces', () => {
+    assert.deepStrictEqual(parseInputFiles('file1.txt\n./**/*.{exe,deb},file2.txt\nfile3.txt'), [
+      'file1.txt',
+      './**/*.{exe,deb}',
+      'file2.txt',
+      'file3.txt',
+    ]);
   });
 });

action.yml

@@ -13,17 +13,27 @@ inputs:
     description: "Gives the release a custom name. Defaults to tag name"
     required: false
   tag_name:
-    description: "Gives a tag name. Defaults to github.GITHUB_REF"
+    description: "Gives a tag name. Defaults to github.ref_name. refs/tags/<name> values are normalized to <name>."
     required: false
   draft:
-    description: "Creates a draft release. Defaults to false"
+    description: "Keeps the release as a draft. Defaults to false. New releases that upload assets are staged as drafts first; set this to true to keep the release draft instead of publishing it after upload."
     required: false
   prerelease:
     description: "Identify the release as a prerelease. Defaults to false"
     required: false
-  files:
-    description: "Newline-delimited list of path globs for asset files to upload"
+  preserve_order:
+    description: "Upload artifacts sequentially in the provided order. This does not control the final display order GitHub uses for release assets."
     required: false
+  files:
+    description: "Newline-delimited list of path globs for asset files to upload. Escape glob metacharacters when matching literal filenames that contain them. `~/...` expands to the runner home directory. On Windows, both \\ and / path separators are accepted. GitHub may normalize raw asset filenames that contain special characters; the action restores the asset label when possible, but the final download name remains GitHub-controlled."
+    required: false
+  working_directory:
+    description: "Base directory to resolve 'files' globs against. Defaults to the workspace root used by the action step."
+    required: false
+  overwrite_files:
+    description: "Overwrite existing files with the same name. Defaults to true"
+    required: false
+    default: 'true'
   fail_on_unmatched_files:
     description: "Fails if any of the `files` globs match nothing. Defaults to false"
     required: false
@@ -31,11 +41,11 @@ inputs:
     description: "Repository to make releases against, in <owner>/<repo> format"
     required: false
   token:
-    description: "Authorized secret GitHub Personal Access Token. Defaults to github.token"
+    description: "Authorized GitHub token or PAT. Defaults to github.token when omitted. A non-empty explicit token overrides GITHUB_TOKEN. Passing an empty string treats the token as unset."
     required: false
     default: ${{ github.token }}
   target_commitish:
-    description: "Commitish value that determines where the Git tag is created from. Can be any branch or commit SHA."
+    description: "Commitish value that determines where the Git tag is created from. Can be any branch or commit SHA. When creating a new tag for an older commit, `github.token` may not have permission to create the ref; use a PAT or another token with sufficient contents permissions if you hit 403 `Resource not accessible by integration`."
     required: false
   discussion_category_name:
     description: "If specified, a discussion of the specified category is created and linked to the release. The value must be a category that already exists in the repository. If there is already a discussion linked to the release, this parameter is ignored."
@@ -43,11 +53,18 @@ inputs:
   generate_release_notes:
     description: "Whether to automatically generate the name and body for this release. If name is specified, the specified name will be used; otherwise, a name will be automatically generated. If body is specified, the body will be pre-pended to the automatically generated notes."
     required: false
+  previous_tag:
+    description: "Optional. When generate_release_notes is enabled, use this tag as GitHub's previous_tag_name comparison base. If omitted, GitHub chooses the comparison base automatically."
+    required: false
+    default: ""
   append_body:
     description: "Append to existing body instead of overwriting it. Default is false."
     required: false
+  make_latest:
+    description: "Specifies whether this release should be set as the latest release for the repository. Drafts and prereleases cannot be set as latest. Can be `true`, `false`, or `legacy`. Uses GitHub api default if not provided"
+    required: false
 env:
-  "GITHUB_TOKEN": "As provided by Github Actions"
+  GITHUB_TOKEN: "As provided by Github Actions"
 outputs:
   url:
     description: "URL to the Release HTML Page"

jest.config.js

@@ -1,11 +0,0 @@
-module.exports = {
-  clearMocks: true,
-  moduleFileExtensions: ['js', 'ts'],
-  testEnvironment: 'node',
-  testMatch: ['**/*.test.ts'],
-  testRunner: 'jest-circus/runner',
-  transform: {
-    '^.+\\.ts$': 'ts-jest'
-  },
-  verbose: true
-}

package.json

@@ -1,14 +1,17 @@
 {
   "name": "action-gh-release",
-  "version": "0.1.15",
+  "version": "2.5.3",
   "private": true,
   "description": "GitHub Action for creating GitHub Releases",
   "main": "lib/main.js",
   "scripts": {
-    "build": "ncc build src/main.ts --minify",
-    "test": "jest",
+    "build": "esbuild src/main.ts --bundle --platform=node --format=cjs --target=node20 --outfile=dist/index.js --minify",
+    "build-debug": "esbuild src/main.ts --bundle --platform=node --format=cjs --target=node20 --outfile=dist/index.js --sourcemap --keep-names",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest --coverage",
     "fmt": "prettier --write \"src/**/*.ts\" \"__tests__/**/*.ts\"",
-    "fmtcheck": "prettier --check \"src/**/*.ts\" \"__tests__/**/*.ts\""
+    "fmtcheck": "prettier --check \"src/**/*.ts\" \"__tests__/**/*.ts\"",
+    "updatetag": "git tag -d v2 && git push origin :v2 && git tag -a v2 -m '' && git push origin v2"
   },
   "repository": {
     "type": "git",
@@ -19,24 +22,23 @@
   ],
   "author": "softprops",
   "dependencies": {
-    "@actions/core": "^1.10.0",
-    "@actions/github": "^5.1.1",
-    "@octokit/plugin-retry": "^4.0.3",
-    "@octokit/plugin-throttling": "^4.3.2",
-    "glob": "^8.0.3",
-    "mime": "^3.0.0"
+    "@actions/core": "^3.0.0",
+    "@actions/github": "^9.0.0",
+    "@octokit/plugin-retry": "^8.1.0",
+    "@octokit/plugin-throttling": "^11.0.3",
+    "glob": "^13.0.6",
+    "mime-types": "^3.0.2"
   },
   "devDependencies": {
-    "@types/glob": "^8.0.0",
-    "@types/jest": "^29.2.3",
-    "@types/mime": "^3.0.1",
-    "@types/node": "^18.11.9",
-    "@vercel/ncc": "^0.34.0",
-    "jest": "^29.3.1",
-    "jest-circus": "^29.3.1",
-    "prettier": "2.8.0",
-    "ts-jest": "^29.0.3",
-    "typescript": "^4.9.3",
-    "typescript-formatter": "^7.2.2"
+    "@types/glob": "^9.0.0",
+    "@types/mime-types": "^3.0.1",
+    "@types/node": "^20.19.37",
+    "@vitest/coverage-v8": "^4.1.0",
+    "esbuild": "^0.27.3",
+    "prettier": "3.8.1",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.9.3",
+    "typescript-formatter": "^7.2.2",
+    "vitest": "^4.0.4"
   }
 }

src/main.ts

@@ -1,29 +1,18 @@
-import {
-  paths,
-  parseConfig,
-  isTag,
-  unmatchedPatterns,
-  uploadUrl,
-} from "./util";
-import { release, upload, GitHubReleaser } from "./github";
-import { getOctokit } from "@actions/github";
-import { setFailed, setOutput } from "@actions/core";
-import { GitHub, getOctokitOptions } from "@actions/github/lib/utils";
+import { setFailed, setOutput } from '@actions/core';
+import { getOctokit } from '@actions/github';
+import { GitHubReleaser, release, finalizeRelease, upload, listReleaseAssets } from './github';
+import { isTag, parseConfig, paths, unmatchedPatterns, uploadUrl } from './util';
 
-import { env } from "process";
+import { env } from 'process';
 
 async function run() {
   try {
     const config = parseConfig(env);
-    if (
-      !config.input_tag_name &&
-      !isTag(config.github_ref) &&
-      !config.input_draft
-    ) {
+    if (!config.input_tag_name && !isTag(config.github_ref) && !config.input_draft) {
       throw new Error(`⚠️ GitHub Releases requires a tag`);
     }
     if (config.input_files) {
-      const patterns = unmatchedPatterns(config.input_files);
+      const patterns = unmatchedPatterns(config.input_files, config.input_working_directory);
       patterns.forEach((pattern) => {
         if (config.input_fail_on_unmatched_files) {
           throw new Error(`⚠️  Pattern '${pattern}' does not match any files.`);
@@ -45,9 +34,7 @@ async function run() {
       //new oktokit(
       throttle: {
         onRateLimit: (retryAfter, options) => {
-          console.warn(
-            `Request quota exhausted for request ${options.method} ${options.url}`
-          );
+          console.warn(`Request quota exhausted for request ${options.method} ${options.url}`);
           if (options.request.retryCount === 0) {
             // only retries once
             console.log(`Retrying after ${retryAfter} seconds!`);
@@ -56,41 +43,69 @@ async function run() {
         },
         onAbuseLimit: (retryAfter, options) => {
           // does not retry, only logs a warning
-          console.warn(
-            `Abuse detected for request ${options.method} ${options.url}`
-          );
+          console.warn(`Abuse detected for request ${options.method} ${options.url}`);
         },
       },
     });
     //);
-    const rel = await release(config, new GitHubReleaser(gh));
+    const releaser = new GitHubReleaser(gh);
+    const releaseResult = await release(config, releaser);
+    let rel = releaseResult.release;
+    const releaseWasCreated = releaseResult.created;
+    let uploadedAssetIds: Set<number> = new Set();
     if (config.input_files && config.input_files.length > 0) {
-      const files = paths(config.input_files);
+      const files = paths(config.input_files, config.input_working_directory);
       if (files.length == 0) {
-        throw new Error(`⚠️ ${config.input_files} not include valid file.`);
+        if (config.input_fail_on_unmatched_files) {
+          throw new Error(`⚠️ ${config.input_files} does not include a valid file.`);
+        } else {
+          console.warn(`🤔 ${config.input_files} does not include a valid file.`);
+        }
       }
       const currentAssets = rel.assets;
-      const assets = await Promise.all(
-        files.map(async (path) => {
-          const json = await upload(
-            config,
-            gh,
-            uploadUrl(rel.upload_url),
-            path,
-            currentAssets
-          );
-          delete json.uploader;
-          return json;
-        })
-      ).catch((error) => {
-        throw error;
-      });
-      setOutput("assets", assets);
+
+      const uploadFile = async (path: string) => {
+        const json = await upload(config, releaser, uploadUrl(rel.upload_url), path, currentAssets);
+        return json ? (json.id as number) : undefined;
+      };
+
+      let results: (number | undefined)[];
+      if (!config.input_preserve_order) {
+        results = await Promise.all(files.map(uploadFile));
+      } else {
+        results = [];
+        for (const path of files) {
+          results.push(await uploadFile(path));
+        }
+      }
+
+      uploadedAssetIds = new Set(results.filter((id): id is number => id !== undefined));
     }
+
+    console.log('Finalizing release...');
+    rel = await finalizeRelease(config, releaser, rel, releaseWasCreated);
+
+    // Draft releases use temporary "untagged-..." URLs for assets.
+    // URLs will be changed to correct ones once the release is published.
+    console.log('Getting assets list...');
+    {
+      let assets: any[] = [];
+      if (uploadedAssetIds.size > 0) {
+        const updatedAssets = await listReleaseAssets(config, releaser, rel);
+        assets = updatedAssets
+          .filter((a) => uploadedAssetIds.has(a.id))
+          .map((a) => {
+            const { uploader, ...rest } = a;
+            return rest;
+          });
+      }
+      setOutput('assets', assets);
+    }
+
     console.log(`🎉 Release ready at ${rel.html_url}`);
-    setOutput("url", rel.html_url);
-    setOutput("id", rel.id.toString());
-    setOutput("upload_url", rel.upload_url);
+    setOutput('url', rel.html_url);
+    setOutput('id', rel.id.toString());
+    setOutput('upload_url', rel.upload_url);
   } catch (error) {
     setFailed(error.message);
   }

src/util.ts

@@ -1,5 +1,7 @@
-import * as glob from "glob";
-import { statSync, readFileSync } from "fs";
+import * as glob from 'glob';
+import { statSync, readFileSync } from 'fs';
+import { homedir } from 'os';
+import * as pathLib from 'path';
 
 export interface Config {
   github_token: string;
@@ -12,18 +14,22 @@ export interface Config {
   input_body?: string;
   input_body_path?: string;
   input_files?: string[];
+  input_working_directory?: string;
+  input_overwrite_files?: boolean;
   input_draft?: boolean;
+  input_preserve_order?: boolean;
   input_prerelease?: boolean;
   input_fail_on_unmatched_files?: boolean;
   input_target_commitish?: string;
   input_discussion_category_name?: string;
   input_generate_release_notes?: boolean;
+  input_previous_tag?: string;
   input_append_body?: boolean;
-  input_make_latest: string | undefined;
+  input_make_latest: 'true' | 'false' | 'legacy' | undefined;
 }
 
 export const uploadUrl = (url: string): string => {
-  const templateMarkerPos = url.indexOf("{");
+  const templateMarkerPos = url.indexOf('{');
   if (templateMarkerPos > -1) {
     return url.substring(0, templateMarkerPos);
   }
@@ -31,70 +37,167 @@ export const uploadUrl = (url: string): string => {
 };
 
 export const releaseBody = (config: Config): string | undefined => {
-  return (
-    (config.input_body_path &&
-      readFileSync(config.input_body_path).toString("utf8")) ||
-    config.input_body
-  );
+  if (config.input_body_path) {
+    try {
+      const contents = readFileSync(config.input_body_path, 'utf8');
+      return contents;
+    } catch (err: any) {
+      console.warn(
+        `⚠️ Failed to read body_path "${config.input_body_path}" (${err?.code ?? 'ERR'}). Falling back to 'body' input.`,
+      );
+    }
+  }
+  return config.input_body;
 };
 
 type Env = { [key: string]: string | undefined };
 
+const smartSplit = (input: string): string[] => {
+  const result: string[] = [];
+  let current = '';
+  let braceDepth = 0;
+
+  for (const ch of input) {
+    if (ch === '{') {
+      braceDepth++;
+    }
+    if (ch === '}') {
+      braceDepth--;
+    }
+    if (ch === ',' && braceDepth === 0) {
+      if (current.trim()) {
+        result.push(current.trim());
+      }
+      current = '';
+    } else {
+      current += ch;
+    }
+  }
+  if (current.trim()) {
+    result.push(current.trim());
+  }
+  return result;
+};
+
 export const parseInputFiles = (files: string): string[] => {
-  return files.split(/\r?\n/).reduce<string[]>(
-    (acc, line) =>
-      acc
-        .concat(line.split(","))
-        .filter((pat) => pat)
-        .map((pat) => pat.trim()),
-    []
-  );
+  return files
+    .split(/\r?\n/)
+    .flatMap((line) => smartSplit(line))
+    .filter((pat) => pat.trim() !== '');
+};
+
+const parseToken = (env: Env): string => {
+  const inputToken = env.INPUT_TOKEN?.trim();
+  if (inputToken) {
+    return inputToken;
+  }
+  return env.GITHUB_TOKEN?.trim() || '';
 };
 
 export const parseConfig = (env: Env): Config => {
   return {
-    github_token: env.GITHUB_TOKEN || env.INPUT_TOKEN || "",
-    github_ref: env.GITHUB_REF || "",
-    github_repository: env.INPUT_REPOSITORY || env.GITHUB_REPOSITORY || "",
+    github_token: parseToken(env),
+    github_ref: env.GITHUB_REF || '',
+    github_repository: env.INPUT_REPOSITORY || env.GITHUB_REPOSITORY || '',
     input_name: env.INPUT_NAME,
-    input_tag_name: env.INPUT_TAG_NAME?.trim(),
+    input_tag_name: normalizeTagName(env.INPUT_TAG_NAME?.trim()),
     input_body: env.INPUT_BODY,
     input_body_path: env.INPUT_BODY_PATH,
-    input_files: parseInputFiles(env.INPUT_FILES || ""),
-    input_draft: env.INPUT_DRAFT ? env.INPUT_DRAFT === "true" : undefined,
-    input_prerelease: env.INPUT_PRERELEASE
-      ? env.INPUT_PRERELEASE == "true"
+    input_files: parseInputFiles(env.INPUT_FILES || ''),
+    input_working_directory: env.INPUT_WORKING_DIRECTORY || undefined,
+    input_overwrite_files: env.INPUT_OVERWRITE_FILES
+      ? env.INPUT_OVERWRITE_FILES == 'true'
       : undefined,
-    input_fail_on_unmatched_files: env.INPUT_FAIL_ON_UNMATCHED_FILES == "true",
+    input_draft: env.INPUT_DRAFT ? env.INPUT_DRAFT === 'true' : undefined,
+    input_preserve_order: env.INPUT_PRESERVE_ORDER ? env.INPUT_PRESERVE_ORDER == 'true' : undefined,
+    input_prerelease: env.INPUT_PRERELEASE ? env.INPUT_PRERELEASE == 'true' : undefined,
+    input_fail_on_unmatched_files: env.INPUT_FAIL_ON_UNMATCHED_FILES == 'true',
     input_target_commitish: env.INPUT_TARGET_COMMITISH || undefined,
-    input_discussion_category_name:
-      env.INPUT_DISCUSSION_CATEGORY_NAME || undefined,
-    input_generate_release_notes: env.INPUT_GENERATE_RELEASE_NOTES == "true",
-    input_append_body: env.INPUT_APPEND_BODY == "true",
-    input_make_latest: env.INPUT_MAKE_LATEST
-      ? env.INPUT_MAKE_LATEST
-      : undefined,
+    input_discussion_category_name: env.INPUT_DISCUSSION_CATEGORY_NAME || undefined,
+    input_generate_release_notes: env.INPUT_GENERATE_RELEASE_NOTES == 'true',
+    input_previous_tag: env.INPUT_PREVIOUS_TAG?.trim() || undefined,
+    input_append_body: env.INPUT_APPEND_BODY == 'true',
+    input_make_latest: parseMakeLatest(env.INPUT_MAKE_LATEST),
   };
 };
 
-export const paths = (patterns: string[]): string[] => {
+const parseMakeLatest = (value: string | undefined): 'true' | 'false' | 'legacy' | undefined => {
+  if (value === 'true' || value === 'false' || value === 'legacy') {
+    return value;
+  }
+  return undefined;
+};
+
+export const normalizeGlobPattern = (
+  pattern: string,
+  platform: NodeJS.Platform = process.platform,
+): string => {
+  if (platform === 'win32') {
+    return pattern.replace(/\\/g, '/');
+  }
+  return pattern;
+};
+
+export const expandHomePattern = (pattern: string, homeDirectory: string = homedir()): string => {
+  if (pattern === '~') {
+    return homeDirectory;
+  }
+  if (pattern.startsWith('~/') || pattern.startsWith('~\\')) {
+    return pathLib.join(homeDirectory, pattern.slice(2));
+  }
+  return pattern;
+};
+
+export const normalizeFilePattern = (
+  pattern: string,
+  platform: NodeJS.Platform = process.platform,
+  homeDirectory: string = homedir(),
+): string => {
+  return normalizeGlobPattern(expandHomePattern(pattern, homeDirectory), platform);
+};
+
+export const paths = (patterns: string[], cwd?: string): string[] => {
   return patterns.reduce((acc: string[], pattern: string): string[] => {
-    return acc.concat(
-      glob.sync(pattern).filter((path) => statSync(path).isFile())
-    );
+    const matches = glob.sync(normalizeFilePattern(pattern), { cwd, dot: true, absolute: false });
+    const resolved = matches
+      .map((p) => (cwd && !pathLib.isAbsolute(p) ? pathLib.join(cwd, p) : p))
+      .filter((p) => {
+        try {
+          return statSync(p).isFile();
+        } catch {
+          return false;
+        }
+      });
+    return acc.concat(resolved);
   }, []);
 };
 
-export const unmatchedPatterns = (patterns: string[]): string[] => {
+export const unmatchedPatterns = (patterns: string[], cwd?: string): string[] => {
   return patterns.reduce((acc: string[], pattern: string): string[] => {
-    return acc.concat(
-      glob.sync(pattern).filter((path) => statSync(path).isFile()).length == 0
-        ? [pattern]
-        : []
-    );
+    const matches = glob.sync(normalizeFilePattern(pattern), { cwd, dot: true, absolute: false });
+    const files = matches.filter((p) => {
+      try {
+        const full = cwd && !pathLib.isAbsolute(p) ? pathLib.join(cwd, p) : p;
+        return statSync(full).isFile();
+      } catch {
+        return false;
+      }
+    });
+    return acc.concat(files.length == 0 ? [pattern] : []);
   }, []);
 };
 
 export const isTag = (ref: string): boolean => {
-  return ref.startsWith("refs/tags/");
+  return ref.startsWith('refs/tags/');
+};
+
+export const normalizeTagName = (tag: string | undefined): string | undefined => {
+  if (!tag) {
+    return tag;
+  }
+  return isTag(tag) ? tag.replace('refs/tags/', '') : tag;
+};
+
+export const alignAssetName = (assetName: string): string => {
+  return assetName.replace(/ /g, '.');
 };

tsconfig.json

@@ -3,8 +3,8 @@
     "useUnknownInCatchVariables": false,
     /* Basic Options */
     // "incremental": true,                   /* Enable incremental compilation */
-    "target": "es6",                          /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
-    "module": "commonjs",                     /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */
+    "target": "es2022",
+    "module": "NodeNext",
     // "allowJs": true,                       /* Allow javascript files to be compiled. */
     // "checkJs": true,                       /* Report errors in .js files. */
     // "jsx": "preserve",                     /* Specify JSX code generation: 'preserve', 'react-native', or 'react'. */
@@ -25,6 +25,7 @@
     /* Strict Type-Checking Options */
     "strict": true,                           /* Enable all strict type-checking options. */
     "noImplicitAny": false,                 /* Raise error on expressions and declarations with an implied 'any' type. */
+    "skipLibCheck": true,
     // "strictNullChecks": true,              /* Enable strict null checks. */
     // "strictFunctionTypes": true,           /* Enable strict checking of function types. */
     // "strictBindCallApply": true,           /* Enable strict 'bind', 'call', and 'apply' methods on functions. */
@@ -44,7 +45,7 @@
     // "paths": {},                           /* A series of entries which re-map imports to lookup locations relative to the 'baseUrl'. */
     // "rootDirs": [],                        /* List of root folders whose combined content represents the structure of the project at runtime. */
     // "typeRoots": [],                       /* List of folders to include type definitions from. */
-    // "types": [],                           /* Type declaration files to be included in compilation. */
+    "types": ["node", "vitest/globals"],
     // "allowSyntheticDefaultImports": true,  /* Allow default imports from modules with no default export. This does not affect code emit, just typechecking. */
     "esModuleInterop": true                   /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
     // "preserveSymlinks": true,              /* Do not resolve the real path of symlinks. */
@@ -60,5 +61,5 @@
     // "experimentalDecorators": true,        /* Enables experimental support for ES7 decorators. */
     // "emitDecoratorMetadata": true,         /* Enables experimental support for emitting type metadata for decorators. */
   },
-  "exclude": ["node_modules", "**/*.test.ts"]
-}
+  "exclude": ["node_modules", "**/*.test.ts", "vitest.config.ts"]
+}

vitest.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    coverage: {
+      reporter: ['text', 'lcov'],
+    },
+    include: ['__tests__/**/*.ts'],
+  },
+});