ci: use draft releases for immutable GitHub releases support

.github/actions/publish-ghcr/action.yml

@@ -7,11 +7,16 @@ inputs:
   token:
     description: "The GitHub token used to upload artifacts to the published release"
     required: true
+  ref:
+    description: "Git ref to checkout (e.g. a tag name)."
+    required: true
 
 runs:
   using: composite
   steps:
     - uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.ref }}
 
     - name: Login to GitHub Container Registry
       uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0

.github/workflows/manual-publish.yml

@@ -2,6 +2,10 @@ name: Publish Package
 on:
   workflow_dispatch:
     inputs:
+      tag:
+        description: 'Tag of an existing draft release to upload artifacts to.'
+        type: string
+        required: true
       dry_run:
         description: "Is this a dry run? If so no package will be published."
         type: boolean
@@ -16,17 +20,24 @@ on:
         type: boolean
         required: false
         default: false
+      publish_release:
+        description: "Publish (un-draft) the release after all artifacts are uploaded?"
+        type: boolean
+        required: false
+        default: true
 
 jobs:
   build-publish:
     runs-on: ubuntu-latest
     # Needed to get tokens during publishing.
     permissions:
       id-token: write # Needed if using OIDC to get release secrets.
-      contents: write # Contents and pull-requests are for release-please to make releases.
+      contents: write # Needed for publish-gh-pages to upload release assets.
       packages: write # needed for ghcr access
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag }}
 
       - uses: azure/setup-helm@29960d0f5f19214b88e1d9ba750a9914ab0f1a2f # v4.0.0
 
@@ -44,3 +55,20 @@ jobs:
         with:
           dry_run: ${{ inputs.dry_run }}
           token: ${{ secrets.GITHUB_TOKEN }}
+          ref: ${{ inputs.tag }}
+
+  publish-release:
+    needs: build-publish
+    if: ${{ format('{0}', inputs.publish_release) == 'true' && format('{0}', inputs.dry_run) == 'false' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ inputs.tag }}
+        run: >
+          gh release edit "$TAG_NAME"
+          --repo ${{ github.repository }}
+          --draft=false

.github/workflows/release-please.yml

@@ -5,37 +5,89 @@ on:
     branches: [main]
 
 jobs:
-  release-package:
+  release-please:
     runs-on: ubuntu-latest
     permissions:
-      id-token: write # Needed if using OIDC to get release secrets.
-      contents: write # Contents and pull-requests are for release-please to make releases.
-      packages: write # needed for ghcr access
+      contents: write
       pull-requests: write
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
-      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4
+      # Create any releases first, then create tags, and then optionally create any new PRs.
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
         id: release
+        with:
+          skip-github-pull-request: true
 
+      # Need the repository content to be able to create and push a tag.
       - uses: actions/checkout@v4
-        if: ${{ steps.release.outputs.releases_created == 'true' }}
+        if: ${{ steps.release.outputs.release_created == 'true' }}
+
+      - name: Create release tag
+        if: ${{ steps.release.outputs.release_created == 'true' }}
+        env:
+          TAG_NAME: ${{ steps.release.outputs.tag_name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if gh api "repos/${{ github.repository }}/git/ref/tags/${TAG_NAME}" >/dev/null 2>&1; then
+            echo "Tag ${TAG_NAME} already exists, skipping creation."
+          else
+            echo "Creating tag ${TAG_NAME}."
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git tag "${TAG_NAME}"
+            git push origin "${TAG_NAME}"
+          fi
+
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
+        if: ${{ steps.release.outputs.release_created != 'true' }}
+        id: release-prs
         with:
+          skip-github-release: true
+
+  release-package:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # Needed if using OIDC to get release secrets.
+      contents: write # Needed for publish-gh-pages to upload release assets.
+      packages: write # needed for ghcr access
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.release-please.outputs.tag_name }}
           fetch-depth: 0 # Full history is required for proper changelog generation
 
       - uses: azure/setup-helm@29960d0f5f19214b88e1d9ba750a9914ab0f1a2f # v4.0.0
-        if: ${{ steps.release.outputs.releases_created == 'true' }}
 
       - name: Run quality control checks
-        if: ${{ steps.release.outputs.releases_created == 'true' }}
         uses: ./.github/actions/ci
 
       - uses: ./.github/actions/publish-gh-pages
-        if: ${{ steps.release.outputs.releases_created == 'true' }}
         with:
           dry_run: false
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: ./.github/actions/publish-ghcr
-        if: ${{ steps.release.outputs.releases_created == 'true' }}
         with:
           dry_run: false
           token: ${{ secrets.GITHUB_TOKEN }}
+          ref: ${{ needs.release-please.outputs.tag_name }}
+
+  publish-release:
+    needs: ['release-please', 'release-package']
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ needs.release-please.outputs.tag_name }}
+        run: >
+          gh release edit "$TAG_NAME"
+          --repo ${{ github.repository }}
+          --draft=false

release-please-config.json

@@ -4,7 +4,9 @@
       "release-type": "helm",
       "versioning": "default",
       "include-v-in-tag": false,
-      "include-component-in-tag": false
+      "include-component-in-tag": false,
+      "draft": true,
+      "force-tag-creation": true
     }
   }
 }