fix(release): diagnose manifest access with Go updater client (#10705)

Problem: Candidate preflight still receives a Cloudflare challenge after adding the updater User-Agent to curl, while Node fetch with an updater User-Agent succeeds.

Root cause: User-Agent alone does not establish whether the shipped Go HTTP client can reach the public endpoint; client transport behavior may also matter.

Fix: Add read-only protected probes for the current and target Stable updater using Go net/http and Node fetch. Do not expose the Cloudflare token to the Go probe.

Verification: Go probes return HTTP 200 locally; gofmt, node --check, and git diff --check pass.

.github/workflows/cloudflare-download-access.yml

@@ -23,7 +23,12 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: "24"
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: desktop/go.mod
       - name: Inspect the public manifest and its challenge policy
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
         run: node scripts/inspect-cloudflare-download-access.mjs
+      - name: Probe the shipped updater HTTP client
+        run: go run scripts/inspect-cloudflare-download-access.go 1.38.11 1.38.12

scripts/inspect-cloudflare-download-access.go

@@ -0,0 +1,45 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"regexp"
+	"runtime"
+	"time"
+)
+
+var stableVersion = regexp.MustCompile(`^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$`)
+
+func main() {
+	if len(os.Args) < 2 {
+		fmt.Fprintln(os.Stderr, "usage: inspect-cloudflare-download-access.go VERSION...")
+		os.Exit(2)
+	}
+	client := &http.Client{Timeout: 30 * time.Second}
+	for _, version := range os.Args[1:] {
+		if !stableVersion.MatchString(version) {
+			fmt.Fprintln(os.Stderr, "invalid Stable version")
+			os.Exit(2)
+		}
+		request, err := http.NewRequest(http.MethodGet, "https://dl.reasonix.io/latest/latest.json", nil)
+		if err != nil {
+			panic(err)
+		}
+		request.Header.Set("User-Agent", fmt.Sprintf("Reasonix-Updater/v%s (%s/%s; build=stable; update=stable)", version, runtime.GOOS, runtime.GOARCH))
+		response, err := client.Do(request)
+		if err != nil {
+			panic(err)
+		}
+		result := map[string]any{
+			"kind": "go-updater-manifest", "version": version,
+			"status": response.StatusCode, "mitigation": response.Header.Get("cf-mitigated"),
+			"ray": response.Header.Get("cf-ray"), "contentType": response.Header.Get("content-type"),
+		}
+		response.Body.Close()
+		if err := json.NewEncoder(os.Stdout).Encode(result); err != nil {
+			panic(err)
+		}
+	}
+}

scripts/inspect-cloudflare-download-access.mjs

@@ -35,7 +35,8 @@ async function request(endpoint, body) {
 
 for (const [profile, userAgent] of [
   ["node-default", undefined],
-  ["desktop-updater", "Reasonix-Updater/1.38.11 (linux/amd64; build=stable; update=stable)"],
+  ["desktop-updater-current", "Reasonix-Updater/v1.38.11 (linux/amd64; build=stable; update=stable)"],
+  ["desktop-updater-target", "Reasonix-Updater/v1.38.12 (linux/amd64; build=stable; update=stable)"],
 ]) {
   const probe = await fetch("https://dl.reasonix.io/latest/latest.json", {
     headers: userAgent ? { "User-Agent": userAgent } : undefined,