fix: address PR review feedback from CodeRabbit

- Upgrade softprops/action-gh-release@v1 to @v2 (Node 16 EOL)
- Fail-fast on checksum fetch failure instead of extracting unverified archives
- Abort packaging if no NVIDIA files found (prevents empty cuda-libs archive)
- Fix nvidia/ path detection bug (list membership vs substring check)
- Fix justfile Copy-Item nesting (copy contents, not the directory itself)

.github/workflows/release.yml

@@ -216,7 +216,7 @@ jobs:
 
       - name: Upload archives to GitHub Release
         if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         with:
           files: |
             release-assets/voicebox-server-cuda.tar.gz

backend/services/cuda.py

@@ -156,16 +156,16 @@ async def _download_and_extract_archive(
     if temp_path.exists():
         temp_path.unlink()
 
-    # Fetch expected checksum
+    # Fetch expected checksum (fail-fast: never extract an unverified archive)
     expected_sha = None
     if sha256_url:
         try:
             sha_resp = await client.get(sha256_url)
-            if sha_resp.status_code == 200:
-                expected_sha = sha_resp.text.strip().split()[0]
-                logger.info(f"{label}: expected SHA-256: {expected_sha[:16]}...")
+            sha_resp.raise_for_status()
+            expected_sha = sha_resp.text.strip().split()[0]
+            logger.info(f"{label}: expected SHA-256: {expected_sha[:16]}...")
         except Exception as e:
-            logger.warning(f"{label}: could not fetch checksum — skipping verification: {e}")
+            raise RuntimeError(f"{label}: failed to fetch checksum from {sha256_url}") from e
 
     # Stream download
     downloaded = 0

justfile

@@ -210,7 +210,8 @@ build-server-cuda: _ensure-venv
     if ($LASTEXITCODE -ne 0) { throw "build_binary.py --cuda failed with exit code $LASTEXITCODE" }; \
     $dest = "$env:APPDATA/com.voicebox.app/backends/cuda"; \
     if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }; \
-    Copy-Item "backend/dist/voicebox-server-cuda" $dest -Recurse -Force; \
+    New-Item -ItemType Directory -Path $dest -Force | Out-Null; \
+    Copy-Item "backend/dist/voicebox-server-cuda/*" $dest -Recurse -Force; \
     Write-Host "Copied CUDA backend to $dest"
 
 # Build everything locally: CPU server + CUDA server + installable Tauri app

scripts/package_cuda.py

@@ -64,7 +64,7 @@ def is_nvidia_file(rel_path: str) -> bool:
         return False
 
     # Files under nvidia/ subdirectory tree (older torch layout)
-    if rel_lower.startswith("nvidia/") or "nvidia/" in rel_lower.split("/", 1)[-1:]:
+    if rel_lower.startswith("nvidia/") or "/nvidia/" in rel_lower:
         # Only DLLs/shared objects — not .py, .dist-info, etc.
         if rel_lower.endswith((".dll", ".so")):
             return True
@@ -127,13 +127,15 @@ def package(
 
     if not nvidia_files:
         print(
-            "WARNING: No NVIDIA files found! The CUDA libs archive will be empty.",
+            f"ERROR: No NVIDIA files found in {onedir_path}. "
+            "Refusing to create an empty CUDA libs archive.",
             file=sys.stderr,
         )
         print(
             "Make sure you built with --cuda and the NVIDIA packages are present.",
             file=sys.stderr,
         )
+        sys.exit(1)
 
     # Create server core archive
     # Files are stored relative to the archive root (no parent directory prefix)