From d830a003d3da92c985e5b969f0336a6708c12664 Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Wed, 16 Sep 2026 22:57:28 +1000
Subject: [PATCH] fix(release): upload standalone assets before publishing the
 release

The repository uses immutable releases, which reject assets once published. v3.0.2 published through changelogithub first, so its asset upload failed with HTTP 422 and npm never published.
---
 .github/workflows/release.yml | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a01680dc..4c3ee945 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -152,22 +152,30 @@ jobs:
         env:
           SKILLD_RELEASE_SIGNING_KEY: ${{ secrets.SKILLD_RELEASE_SIGNING_KEY }}
         run: node scripts/release/release-signing.mjs stage packages release-assets
-      - run: npx changelogithub
+      - name: Create draft release
+        shell: bash
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Immutable releases reject assets after publication, so assets go on a draft first.
+          if state="$(gh release view "$GITHUB_REF_NAME" --json isDraft --jq .isDraft 2>/dev/null)"; then
+            if test "$state" = false; then
+              echo "Release $GITHUB_REF_NAME is already published and immutable. Tag a new version." >&2
+              exit 1
+            fi
+          else
+            npx changelogithub --draft
+          fi
       - name: Upload standalone release
         shell: bash
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          # Binaries first: a client treats a release as ready once its signed manifest exists.
-          find release-assets -type f -name 'skilld-cli-*' -print0 \
-            | xargs -0 gh release upload "$GITHUB_REF_NAME" --clobber
-          gh release upload "$GITHUB_REF_NAME" --clobber \
-            release-assets/skilld-release.txt release-assets/skilld-release.sig
           sed "s/__SKILLD_RELEASE_PUBLIC_KEY__/$SKILLD_RELEASE_PUBLIC_KEY/" install.sh >release-assets/install.sh
           grep -q "RELEASE_PUBLIC_KEY=\"$SKILLD_RELEASE_PUBLIC_KEY\"" release-assets/install.sh
-          gh release upload "$GITHUB_REF_NAME" --clobber release-assets/install.sh install.ps1
+          find release-assets -type f -print0 \
+            | xargs -0 gh release upload "$GITHUB_REF_NAME" --clobber
+          gh release upload "$GITHUB_REF_NAME" --clobber install.ps1
       - name: Publish native packages
         shell: bash
         run: |
@@ -191,3 +199,8 @@ jobs:
       - name: Publish independent protocol
         if: steps.protocol_release.outputs.publish == 'true'
         run: pnpm --dir packages/protocol publish --access public --no-git-checks
+      - name: Publish GitHub release
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release edit "$GITHUB_REF_NAME" --draft=false