Make Suno v6 generation, downloads, and agent workflows reliable

Author: longevityboris

.github/workflows/ci.yml

@@ -15,16 +15,19 @@ jobs:
         with:
           components: clippy, rustfmt
       - run: cargo fmt --check
-      - run: cargo clippy --all-targets -- -D warnings
-      - run: cargo test
-      - run: cargo build --release
+      - run: cargo clippy --locked --all-targets -- -D warnings
+      - run: cargo test --locked
+      - run: cargo build --locked --release
       # Vendored framework contract probe (conformance/ tracks
       # paperfoot/agent-cli-framework) — the release binary must conform.
       - run: ./conformance/conformance.sh target/release/suno
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - run: python -m pip install -r conformance/requirements.txt
+      - run: python conformance/validate.py target/release/suno
 
-  # release.yml ships Windows + macOS binaries; the guard's platform-specific
-  # process-liveness (libc::kill vs OpenProcess) only compiles here, so build +
-  # test on those runners to stop a windows-msvc regression reaching a release.
+  # Exercise filesystem locks, archive extraction, and paths on each desktop OS.
   cross-platform:
     strategy:
       fail-fast: false
@@ -34,5 +37,5 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
-      - run: cargo build --all-targets
-      - run: cargo test
+      - run: cargo build --locked --all-targets
+      - run: cargo test --locked

.github/workflows/release.yml

@@ -9,7 +9,26 @@ permissions:
   contents: write
 
 jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - run: cargo fmt --check
+      - run: cargo clippy --locked --all-targets -- -D warnings
+      - run: cargo test --locked
+      - run: cargo build --locked --release
+      - run: ./conformance/conformance.sh target/release/suno
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - run: python -m pip install -r conformance/requirements.txt
+      - run: python conformance/validate.py target/release/suno
+
   build:
+    needs: verify
     strategy:
       matrix:
         include:
@@ -45,7 +64,7 @@ jobs:
           sudo apt-get install -y gcc-aarch64-linux-gnu
 
       - name: Build
-        run: cargo build --release --target ${{ matrix.target }}
+        run: cargo build --locked --release --target ${{ matrix.target }}
         env:
           CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
 
@@ -79,12 +98,22 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           path: artifacts
+          merge-multiple: true
+
+      - name: Publish archive checksums
+        run: |
+          cd artifacts
+          sha256sum *.tar.gz *.zip > checksums.txt
+
+      - name: Prepare release notes
+        run: python -c "from pathlib import Path; s=Path('CHANGELOG.md').read_text(); Path('release-notes.md').write_text(s.split('\n## ',2)[1])"
 
       - name: Create release
         uses: softprops/action-gh-release@v2
         with:
+          body_path: release-notes.md
           generate_release_notes: true
-          files: artifacts/**/*
+          files: artifacts/*
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -95,5 +124,6 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - name: Publish to crates.io
-        run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }}
-        continue-on-error: true
+        run: cargo publish --locked
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}