[vmvarela]

Linked issue

None. No sql-pipe issue tracks this change; it implements the shared release contract planned in vmvarela/ghoten#238.

What

Release workflow now stages the GitHub release as a draft and publishes it only after every asset, package and checksum is in place. Native binaries are checked against sha256sums.txt before publication. Downstream channels (npm, Homebrew, AUR, WinGet, Scoop, Nix, APT, RPM, APK) run after publication instead of before. NetBSD targets are removed from the matrix until their Zig 0.17 link failure is fixed.

Why

The previous flow made the release public before packages and checksums existed, and allowed publication after a build failure (always()). Consumers could see an incomplete release, and channels could update from it.

How tested

• Local: git diff --check, YAML parse, and actionlint -shellcheck= pass. Shellcheck warnings already present in the original checksums step are unchanged.
• Local simulation of the verification step: passes with intact assets; fails when an asset is altered or an extra file is present.
• Real run in a private disposable repository with the same workflow and the same NetBSD removal: 12 native builds, draft staging, DEB/RPM/APK packaging, checksums and publication passed; release went public with 22 assets. Only the AUR job failed, because its LICENSE download is unauthenticated and the test repository was private.
• Not run against this repository: no tag has been pushed from this branch.

Remaining work

• NetBSD targets (x86_64-netbsd, aarch64-netbsd) must be restored once the __ssp_protected_* link failure with Zig 0.17 is fixed.
• Re-running an already published tag moves its release back to draft until publish-release publishes it again.
• publish-release does not set make_latest or check target_commitish.
• Prerelease version strings differ across DEB/RPM (0.99.0.test.2) and APK (0.99.0_test.2).
• Installation docs may still mention NetBSD binaries.

Definition of Done

• Code implemented and functional (workflow change)
• All acceptance criteria from the issue are met: N/A, no linked issue
• Tests written and passing: N/A, no test suite covers workflows; validation above
• No lint or compilation errors (zig build passes): not applicable, no Zig code changed
• Self-reviewed (read your own diff)
• Documentation updated (if user-facing behavior changed): pending, see Remaining work