From 3ac32ab651ce21e07cabd49577288ef361607686 Mon Sep 17 00:00:00 2001
From: Daniel Baker <dan@djacu.dev>
Date: Sun, 5 Jul 2026 22:34:38 -0700
Subject: [PATCH 1/2] nixos-branding.release-assets: init

Assets attached to a GitHub release: the branding guide plus the public
media-kit logos, flattened into one buildable package. Restores the
content of the removed nixos-media-kit (b1e12e2) combined with the guide,
excluding the internal logos and the index.html files that deployed-assets
generates for the Netlify web deploy.
---
 .../nixos-branding/release-assets/package.nix | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 package-sets/top-level/nixos-branding/release-assets/package.nix

diff --git a/package-sets/top-level/nixos-branding/release-assets/package.nix b/package-sets/top-level/nixos-branding/release-assets/package.nix
new file mode 100644
index 0000000..8fde1ca
--- /dev/null
+++ b/package-sets/top-level/nixos-branding/release-assets/package.nix
@@ -0,0 +1,32 @@
+{
+  artifacts,
+  lib,
+  nixos-branding-guide,
+  symlinkJoin,
+}:
+
+let
+
+  inherit (lib.attrsets)
+    attrValues
+    ;
+
+  inherit (lib.nixos-branding)
+    removeDirectoriesRecursiveAttrs
+    ;
+
+in
+
+# Assets attached to a GitHub release: the branding guide document plus the
+# public-facing logos (artifacts.media-kit), flattened into one directory.
+# This matches the pre-removal release contents (the old nixos-branding-guide
+# + nixos-media-kit uploads) in a single buildable package. It deliberately
+# excludes the internal logos and the browsable index.html files that
+# deployed-assets adds for the Netlify web deploy.
+symlinkJoin {
+  name = "release-assets";
+  paths = [
+    nixos-branding-guide
+  ]
+  ++ attrValues (removeDirectoriesRecursiveAttrs artifacts.media-kit);
+}

From 4b1ab1ce71869084e587324f29eb844cf393c264 Mon Sep 17 00:00:00 2001
From: Daniel Baker <dan@djacu.dev>
Date: Sun, 5 Jul 2026 22:34:40 -0700
Subject: [PATCH 2/2] ci: build release-assets and publish via gh release
 create

The release job built .#nixos-branding.nixos-media-kit, which was removed
in b1e12e2, so the release workflow has been broken at "Build Media Kit"
since. Build the new release-assets package instead (guide + public logos
in one derivation) and upload its contents.

Also replace softprops/action-gh-release with the pre-installed gh CLI
(clears zizmor superfluous-actions), removing third-party code from the
contents:write release job. gh release create fails if the release already
exists and if a file glob matches nothing, which is the intended behavior:
no accidental overwrite of an existing release, and fail loudly on a
missing artifact.
---
 .github/workflows/release-guide.yml | 30 +++++++++++++----------------
 1 file changed, 13 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/release-guide.yml b/.github/workflows/release-guide.yml
index 8cb9970..73676af 100644
--- a/.github/workflows/release-guide.yml
+++ b/.github/workflows/release-guide.yml
@@ -40,16 +40,11 @@ jobs:
             echo "NixOS Branding Guide tag version and file version DO NOT match"
             exit 1
           fi
-      - name: Build Guide
+      - name: Build release assets
         run: |
-          nix build .\#nixos-branding.nixos-branding-guide \
+          nix build .\#nixos-branding.release-assets \
             --print-build-logs \
-            --out-link result-guide
-      - name: Build Media Kit
-        run: |
-          nix build .\#nixos-branding.nixos-media-kit \
-            --print-build-logs \
-            --out-link result-media-kit
+            --out-link result-assets
       - name: Get latest release info
         id: query-release-info
         uses: release-flow/keep-a-changelog-action@74931dec7ecdbfc8e38ac9ae7e8dd84c08db2f32  # v3.0.0
@@ -71,15 +66,16 @@ jobs:
           NOTES: ${{ steps.query-release-info.outputs.release-notes }}
         run: printf '%s\n' "$NOTES" > release
       - name: Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
-        with:
-          name: "NixOS Branding Guide v${{ steps.split.outputs.version }}"
-          body_path: release
-          files: |
-            result-guide/*
-            result-media-kit/*
-          make_latest: true
-          overwrite_files: false
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.split.outputs.version }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            --title "NixOS Branding Guide v$VERSION" \
+            --notes-file release \
+            --latest \
+            --verify-tag \
+            result-assets/*
 
   deploy:
     uses: ./.github/workflows/netlify-deploy.yml