From 5be5abbaf67eb3b2f542b6ec247cf7c00d23bbbf Mon Sep 17 00:00:00 2001
From: Jonathan Langevin <jon@langevin.me>
Date: Fri, 8 May 2026 06:19:11 -0400
Subject: [PATCH 1/3] ci: keep GoReleaser releases draft during upload

---
 .goreleaser.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index c64a77c..9065708 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -32,3 +32,6 @@ checksum:
 
 changelog:
   sort: asc
+
+release:
+  draft: true

From 06cfa227957d95ba1d44992fc98c5b2d78555f06 Mon Sep 17 00:00:00 2001
From: Jon Langevin <codingsloth@pm.me>
Date: Fri, 8 May 2026 06:20:59 -0400
Subject: [PATCH 2/3] ci: publish GoReleaser draft releases after upload

---
 .github/workflows/release.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 58cc043..6a96dad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -93,3 +93,8 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.REGISTRY_PAT }}
         continue-on-error: true
+      - name: Publish GitHub release
+        if: ${{ success() }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release edit "${{ github.ref_name }}" --draft=false --repo "${{ github.repository }}"

From 2a3683bba34123ddf848957036b356e01d9bb66d Mon Sep 17 00:00:00 2001
From: Jon Langevin <codingsloth@pm.me>
Date: Fri, 8 May 2026 10:09:06 -0400
Subject: [PATCH 3/3] ci: publish draft releases through GitHub API

---
 .github/workflows/release.yml | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6a96dad..9b26519 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -94,7 +94,18 @@ jobs:
           GH_TOKEN: ${{ secrets.REGISTRY_PAT }}
         continue-on-error: true
       - name: Publish GitHub release
-        if: ${{ success() }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release edit "${{ github.ref_name }}" --draft=false --repo "${{ github.repository }}"
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.RELEASES_TOKEN || github.token }}
+          script: |
+            const tag = context.ref.replace('refs/tags/', '');
+            const { owner, repo } = context.repo;
+            const { data: release } = await github.rest.repos.getReleaseByTag({ owner, repo, tag });
+            if (release.draft) {
+              await github.rest.repos.updateRelease({
+                owner,
+                repo,
+                release_id: release.id,
+                draft: false,
+              });
+            }