From df80db682ef6211e67f04136a2b8ef5c6889d1e6 Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Mon, 9 Nov 2026 21:52:28 +0000
Subject: [PATCH] ci: Make the release scripts executable and check script
 modes in Build

#137 committed release-preflight.sh and drop-failed-release.sh as 100644.
The workflows run them directly, so every automatic Release has failed at
"Check what to release" with exit 126 since the merge. Build now fails a PR
that adds a non-executable script under .github/scripts.
---
 .github/scripts/check-script-modes.sh  | 19 +++++++++++++++++++
 .github/scripts/drop-failed-release.sh |  0
 .github/scripts/release-preflight.sh   |  0
 .github/workflows/build.yml            |  5 +++++
 4 files changed, 24 insertions(+)
 create mode 100755 .github/scripts/check-script-modes.sh
 mode change 100644 => 100755 .github/scripts/drop-failed-release.sh
 mode change 100644 => 100755 .github/scripts/release-preflight.sh

diff --git a/.github/scripts/check-script-modes.sh b/.github/scripts/check-script-modes.sh
new file mode 100755
index 00000000..8b4b41ac
--- /dev/null
+++ b/.github/scripts/check-script-modes.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+# Fails when a script in .github/scripts is not committed as executable.
+# Workflows run these scripts directly. A script committed as 100644 only fails
+# when a workflow reaches it, with exit 126 ("Permission denied"). For Release,
+# that is after the merge.
+set -eu
+
+files=$(git ls-files -s .github/scripts)
+status=0
+while read -r mode _ _ path; do
+  [ -n "$path" ] || continue
+  [ "$mode" = 100755 ] && continue
+  printf '::error file=%s::%s has mode %s. Run: git update-index --chmod=+x %s\n' \
+    "$path" "$path" "$mode" "$path"
+  status=1
+done <<LIST
+$files
+LIST
+exit "$status"
diff --git a/.github/scripts/drop-failed-release.sh b/.github/scripts/drop-failed-release.sh
old mode 100644
new mode 100755
diff --git a/.github/scripts/release-preflight.sh b/.github/scripts/release-preflight.sh
old mode 100644
new mode 100755
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index afcc58e6..2a9256d9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,6 +24,11 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
+      # Workflows run .github/scripts/* directly, so each one must be executable.
+      - if: matrix.pack
+        name: Check workflow scripts are executable
+        run: .github/scripts/check-script-modes.sh
+
       - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4