Start with the failing boundary.

The Action cannot find the artifact

• An exact artifact path must exist and be a file.
• A glob must match exactly one file.
• The v1 Action publishes immediately and supports one artifact target for a channel/version. For a multi-target matrix release, create one draft through the publishing API, upload every target, and publish once.
• An explicit signature path must exist and contain non-empty text.
• Without signature, the Action checks for <artifact>.sig.

Authentication fails

Confirm the secret contains the full key, the workflow uses MATEALITY_RELEASES_KEY, the key is not revoked, and the app input matches the app slug. Generate a replacement if the one-time value was lost.

Draft creation fails

• channel_not_found: create or restore the named channel.
• release_already_published: choose a new version in that channel.
• invalid_version: use 1–128 allowed letters, numbers, ., +, _, or -, beginning with a letter or number.
• notes_too_large: reduce notes below 64 KiB.

Presign or upload fails

• Confirm format begins with . and sha256 contains 64 lowercase hex characters.
• artifact_too_large: the default per-artifact ceiling is 5 GiB unless the deployment overrides it.
• storage_quota_exceeded: remove unneeded drafts where possible or change plan allowance.
• artifact_count_limit_exceeded: use no more than 32 distinct targets in one release.
• Send every returned upload header without altering the declared byte length.

Publish fails

• draft_release_artifacts_required: upload at least one artifact.
• artifact_upload_missing: the presigned PUT did not finish successfully.
• artifact_size_mismatch: uploaded bytes differ from the presign request.
• draft_release_not_found: confirm the release ID, app, and draft state.

Updater returns 204 unexpectedly

Check that a published release exists in the requested channel, the release version is newer than current_version, and the stored target matches the request. For Tauri, {target} plus {arch} becomes values such as darwin-aarch64.

Download returns 402, 404, 410, or 503

• 402: distribution allowance or configured invoice cap has been reached.
• 404: the release/target does not identify a published artifact.
• 410: retention pruned the artifact.
• 503: billing enforcement or control-plane state is temporarily unavailable.

Custom domain stays pending

Use the exact CNAME target shown in Domains, keep the record DNS-only during setup, allow propagation time, and use Check status.