[agent] fix: publish releases only after every asset is uploaded

[alexng353]

[agent]

What and why

release-please published the GitHub release before the CD build jobs uploaded archives, so /releases/latest pointed at a release with no assets for several minutes after every release and both install.sh and install.ps1 failed (observed on v2.17.0: published 09:43:02, Windows zip uploaded 09:48:28). release-please now creates the release as a draft with the tag forced immediately (so the next changelog still finds it), each build uploads to the draft with gh release upload, and a final publish-release job publishes only after every target succeeds. Tags stay vX.Y.Z, the release PR/changelog flow is unchanged, and checksum sidecars still upload. Installer logic and the build matrix are out of scope.

Review

Full comb (correctness, halal boundary, premise, simplification; Claude + vassal each), then a one-round re-comb of the fix commit (Claude + vassal, correctness and premise).

• AGREED (fixed): gh release edit --latest let a delayed or re-run older release displace a newer one as /releases/latest. Publishing now PATCHes the release with draft=false, make_latest=legacy (GitHub picks latest by version and date). Dropping --latest alone would not help: the API defaults newly published releases to latest.
• AGREED (fixed): the job-level if: on publish-release was redundant; needs already skips it unless every build-release leg succeeds.
• CLAUDE-ONLY (applied): upload step moves version/target into env vars; comments point at the config file that holds the draft policy.
• Halal (both models, clean): release-please-action v4.4.1 bundles release-please 17.3.0, which supports draft, force-tag-creation (creates refs/tags/<tag> before the draft), and include-component-in-tag; manifest mode emits unprefixed release_created/major/minor/patch for . including for drafts; gh release upload/view resolve drafts by tag.
• Refuted: "a custom if: drops the implicit success() gate, so a failed build still publishes" (CLAUDE-ONLY). GitHub docs: "A default status check of success() is applied unless you include one of these functions."
• Re-comb: no findings. -F draft=false confirmed to send a JSON boolean by capturing the request.

Deferred

• Restricting uploads to drafts (so a re-run after publication cannot --clobber assets): a policy choice the task didn't settle; a successful job isn't re-run by "Re-run failed jobs".
• workflow_dispatch entry point to publish an orphaned draft: recovery is "Re-run failed jobs" (documented in the workflow); a full re-run does not re-emit release_created.
• make_latest=legacy semantics for backport branches: the repo releases from main only.

Verification

• actionlint: clean apart from two pre-existing SC2086 info notes on $GITHUB_ENV lines not touched here.
• Config validated against the release-please 17.3.0 schema (vassal halal pass); manifest 2.17.0 matches Cargo.toml and tag v2.17.0.
• Not exercised live: the next real release is the first end-to-end run.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

🤖 Generated with Claude Code