fix: validate GitHub release list and guard against download-count collapse

On 2026-08-17 13:35 UTC the GitHub releases API returned an empty list.
getReleaseDetails() trusted it, so the build published totalDownloads=0
and an empty prodReleaseHistory to gh-pages, after which every hourly run
failed on the existing history guard. Live data was restored from the
last good deploy (53257d7) on gh-pages.

- index.js: check HTTP status, require a non-empty array containing at
  least one prod-app-v release with assets; retry 3x, then exit(1).
- downloadCounts.js: refuse to publish if the computed total drops >10%
  below the live value (override with ALLOW_HISTORY_RESET=true).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: abose

build/downloadCounts.js

@@ -59,6 +59,18 @@ async function updateDownloadStats(releases) {
     const existingData = await getCurrentDownloadData();
     console.log(`Current data from ${DOWNLOAD_COUNTS_URL}`, existingData);
     if (existingData && existingData.timestamp && existingData.totalDownloads) {
+        // Download counts are cumulative and only ever go up (barring a release being deleted from GitHub).
+        // A big drop means we got a bad/partial release list; don't publish it, as that would also feed the
+        // negative rate and (via download_history) wipe the history graphs.
+        const MAX_ALLOWED_DROP_FRACTION = 0.1;
+        const drop = existingData.totalDownloads - data.totalDownloads;
+        if (drop > existingData.totalDownloads * MAX_ALLOWED_DROP_FRACTION
+            && process.env.ALLOW_HISTORY_RESET !== 'true') {
+            console.error(`[download_counts] computed totalDownloads ${data.totalDownloads} is ${drop} lower than`
+                + ` the live value ${existingData.totalDownloads} (>${MAX_ALLOWED_DROP_FRACTION * 100}% drop).`);
+            console.error(`[download_counts] Refusing to publish. Re-run with ALLOW_HISTORY_RESET=true if this drop is genuine.`);
+            process.exit(1);
+        }
         const lastTimeStamp = new Date(existingData.timestamp).getTime();
         const currentTimeStamp = new Date(data.timestamp).getTime();
         const timeDifferenceMinutes = (currentTimeStamp - lastTimeStamp) / (1000 * 60);

build/index.js

@@ -2,7 +2,7 @@ const fs = require('fs');
 const downloadCounts = require("./downloadCounts");
 const downloadHistory = require("./downloadHistory");
 
-async function getReleaseDetails() {
+async function fetchAllReleasePages() {
     const headers = {
         'Accept': 'application/vnd.github.v3+json'
     };
@@ -18,7 +18,13 @@ async function getReleaseDetails() {
 
     while (nextPage) {
         const response = await fetch(nextPage, { headers });
+        if (!response.ok) {
+            throw new Error(`HTTP ${response.status} ${response.statusText} fetching ${nextPage}`);
+        }
         const data = await response.json();
+        if (!Array.isArray(data)) {
+            throw new Error(`unexpected payload: releases page is not an array (${JSON.stringify(data).slice(0, 200)})`);
+        }
         releases = releases.concat(data);
 
         const linkHeader = response.headers.get('link');
@@ -34,6 +40,43 @@ async function getReleaseDetails() {
     return releases;
 }
 
+// The GitHub API occasionally returns an empty/partial release list (transient glitches, rate limits, etc).
+// If we blindly trust that, we publish "0 downloads" and wipe download_history.json (this happened on
+// 2026-08-17 13:35 UTC). So we validate the payload and retry, and never proceed with an unusable list.
+function validateReleases(releases) {
+    if (!Array.isArray(releases)) return 'releases is not an array';
+    if (releases.length === 0) return 'GitHub returned an empty release list';
+    const prodReleases = releases.filter(r => !r.prerelease && (r.tag_name || "").startsWith("prod-app-v"));
+    if (prodReleases.length === 0) return 'no prod-app-v releases in payload';
+    if (!prodReleases.some(r => Array.isArray(r.assets) && r.assets.length > 0)) {
+        return 'no prod release has any assets';
+    }
+    return null;
+}
+
+async function getReleaseDetails(attempts = 3) {
+    let lastError;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        try {
+            const releases = await fetchAllReleasePages();
+            const problem = validateReleases(releases);
+            if (problem) {
+                throw new Error(`unexpected payload: ${problem}`);
+            }
+            return releases;
+        } catch (error) {
+            lastError = error;
+            console.warn(`[github_releases] attempt ${attempt}/${attempts} failed: ${error.message}`);
+            if (attempt < attempts) {
+                await new Promise(resolve => setTimeout(resolve, 5000 * attempt));
+            }
+        }
+    }
+    console.error(`[github_releases] fetch failed ${attempts} times. Last error: ${lastError && lastError.message}`);
+    console.error(`[github_releases] Refusing to publish stats computed from an invalid release list.`);
+    process.exit(1);
+}
+
 function ensureDirectoryExists(dirPath) {
     try {
         // The 'recursive' option ensures all parent directories are created if not existing