Release: publish on tag, no draft

The release job creates the GitHub Release published, marked latest for a
stable version and prerelease otherwise. A draft left by an earlier run is
filled with fresh assets and published. An already published tag still fails
the job: bump and tag again.

Author: its-janghoon

.github/workflows/release.yml

@@ -1,12 +1,12 @@
-# Release pipeline: a `vX.Y.Z` tag builds installers for macOS, Windows and Linux and creates or
-# updates the draft GitHub Release "Redrob Board vX.Y.Z". Adapted from redrob-launcher.
+# Release pipeline: a `vX.Y.Z` tag builds installers for macOS, Windows and Linux and the browser
+# build, then publishes the GitHub Release "Redrob Board vX.Y.Z". Adapted from redrob-launcher.
 #
 # The tag must equal the Cargo.toml version; the version job fails otherwise. The jobs that sign
-# (macOS, Windows) and the one that drafts the GitHub Release run in the `release` environment.
+# (macOS, Windows) and the one that publishes the GitHub Release run in the `release` environment.
 # Signing secrets are the redrob-labs organization's (Apple Developer ID certificate + App Store
 # Connect API key for notarization; Azure Artifact Signing account IDs, reached over OpenID Connect,
 # for Windows). Every secret is optional: missing ones produce unsigned artifacts and a warning,
-# never a failed build. A manual dispatch is a dry run: it builds every job and drafts nothing.
+# never a failed build. A manual dispatch is a dry run: it builds every job and publishes nothing.
 #
 # Every job checks out the one commit the version job resolved, so a push that lands mid-run
 # cannot split the binaries from the tag.
@@ -291,7 +291,7 @@ jobs:
           if-no-files-found: error
 
   release:
-    name: Draft GitHub Release
+    name: Publish GitHub Release
     needs: [version, macos, windows, linux, web]
     # Only a version tag publishes; a manual dispatch stops before this job.
     if: github.ref_type == 'tag'
@@ -315,30 +315,32 @@ jobs:
         working-directory: artifacts
         run: |
           sha256sum -- * | tee SHA256SUMS.txt
-      - name: Create or update the draft release
+      - name: Publish the release
         working-directory: artifacts
         run: |
           tag="v$VERSION"
           title="Redrob Board v$VERSION"
-          pre=()
-          if [ "$PRERELEASE" = true ]; then pre=(--prerelease); fi
+          # A stable version becomes "latest"; a prerelease never does.
+          flags=(--latest)
+          if [ "$PRERELEASE" = true ]; then flags=(--prerelease --latest=false); fi
           if draft="$(gh release view "$tag" --json isDraft --jq .isDraft 2>/dev/null)"; then
             if [ "$draft" != "true" ]; then
               echo "::error::Release $tag is already published. Bump the version (cargo xtask version set) and tag again."
               exit 1
             fi
-            echo "Updating draft $tag: replacing its assets"
+            # A draft left by an earlier run (or made by hand): replace its assets and publish it.
+            echo "Publishing existing draft $tag with fresh assets"
             gh release view "$tag" --json assets --jq '.assets[].name' | while read -r asset; do
               gh release delete-asset "$tag" "$asset" --yes
             done
-            gh release edit "$tag" --draft --title "$title" --target "$SHA" --prerelease="$PRERELEASE"
             gh release upload "$tag" --clobber -- *
+            gh release edit "$tag" --draft=false --title "$title" --target "$SHA" "${flags[@]}"
           else
-            echo "Creating draft $tag"
-            gh release create "$tag" --draft --title "$title" --target "$SHA" --generate-notes "${pre[@]}" -- *
+            echo "Publishing $tag"
+            gh release create "$tag" --title "$title" --target "$SHA" --generate-notes "${flags[@]}" -- *
           fi
           {
-            echo "Draft release **$title** at \`${SHA::9}\`:"
+            echo "Published **$title** at \`${SHA::9}\`:"
             echo
             sed 's/^/    /' SHA256SUMS.txt
           } >>"$GITHUB_STEP_SUMMARY"

README.ko.md

@@ -66,7 +66,7 @@ KiCad 플롯과 픽셀 일치, KiCad DRC 0), 자체 스트로크 폰트 실크
 릴리즈에는 서명·공증된 macOS 디스크 이미지(universal), 서명된 Windows 설치 파일과 포터블 zip(x64·arm64),
 Linux AppImage/deb/rpm/tar.gz(x86_64·aarch64)가 있습니다:
 [github.com/redrob-labs/redrob-board/releases](https://github.com/redrob-labs/redrob-board/releases).
-`vX.Y.Z` 태그가 `.github/workflows/release.yml`을 돌려 한 커밋에서 모든 잡을 빌드하고 드래프트 릴리즈를 만듭니다.
+`vX.Y.Z` 태그가 `.github/workflows/release.yml`을 돌려 한 커밋에서 모든 잡을 빌드하고 릴리즈를 발행합니다.
 패키징 스크립트는 `packaging/`에 있습니다. 릴리즈에는 브라우저 빌드(`redrob-board-web-<버전>.zip`, 정적 WebAssembly 사이트,
 호스팅 안내는 `packaging/web/README.md`)도 들어갑니다: 엔진 없는 같은 창이라 AGENT 팔레트가 그 사실을 말합니다.
 

README.md

@@ -86,7 +86,7 @@ Releases carry a signed and notarized macOS disk image (universal), signed Windo
 and portable zips (x64, arm64) and Linux AppImage/deb/rpm/tar.gz (x86_64, aarch64):
 [github.com/redrob-labs/redrob-board/releases](https://github.com/redrob-labs/redrob-board/releases).
 A `vX.Y.Z` tag runs `.github/workflows/release.yml`, which builds every job from one commit and
-drafts the release; the packaging scripts live in `packaging/`. The release also carries a
+publishes the release; the packaging scripts live in `packaging/`. The release also carries a
 browser build (`redrob-board-web-<version>.zip`, a static WebAssembly site; `packaging/web/README.md`
 has the hosting notes): the same window without the engine, so the AGENT palette says so.