From 930057204bf2f16087fb120220281cea8d2265de Mon Sep 17 00:00:00 2001
From: Yves Vogl <yves.vogl@mac.com>
Date: Thu, 16 Jul 2026 05:14:28 +0200
Subject: [PATCH] ci(release): create the release object before asset uploads

Both release jobs upload assets via `gh release upload`, which requires the
release object to already exist for the tag - neither job created it, so a
fresh tag push failed with "release not found" on both platforms. Adds a
create-release job (idempotent: `gh release view` first, so re-runs after a
transient failure don't error on an already-created release) and gates both
build jobs on it via `needs: create-release`, matching the fixed suite-wide
pattern already on basilica-audio/crypta main.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a07aa9d..39524e0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,8 +18,29 @@ permissions:
   contents: write
 
 jobs:
+  create-release:
+    name: Create release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create the GitHub release for this tag (idempotent)
+        # Both release-macos and release-windows upload assets via
+        # `gh release upload`, which requires the release object to already
+        # exist for the tag - neither job created it, so both failed with
+        # "release not found" on a fresh tag push. `gh release view` first
+        # makes re-runs (e.g. after a transient build failure) idempotent
+        # instead of erroring on an already-created release.
+        run: |
+          set -euo pipefail
+          if ! gh release view "$GITHUB_REF_NAME" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release create "$GITHUB_REF_NAME" -R "$GITHUB_REPOSITORY" \
+              --title "$GITHUB_REF_NAME" --generate-notes
+          fi
+        env:
+          GH_TOKEN: ${{ github.token }}
+
   release-macos:
     name: Signed macOS release
+    needs: create-release
     runs-on: macos-14
     steps:
       - uses: actions/checkout@v4
@@ -118,6 +139,7 @@ jobs:
 
   release-windows:
     name: Windows release (unsigned)
+    needs: create-release
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v4