fix(workflows): delete and recreate draft release to publish

[WilliamBerryiii]

Description

The publish-release job at the end of the release pipeline uses gh release edit --draft=false to publish the draft release after asset uploads complete. This fails with HTTP 422: tag_name was used by an immutable release — GitHub enforces immutability at the tag level, so any release using a tag that was previously associated with an immutable release cannot be edited via gh release edit.

This applies the same delete-and-recreate pattern from PR #550 to the publish-release job: capture the draft's metadata, delete it, and recreate as a published release.

Also consolidates both recreate steps (draft and publish) to use a single gh release view --json name,body API call with jq instead of two separate queries.

Related Issue(s)

Fixes #543

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Testing

• v2.3.6 release confirmed that asset uploads succeeded with the draft recreate from PR fix(workflows): delete and recreate immutable release as draft #550
• The only failure was the publish-release job's gh release edit --draft=false — this PR fixes that final step

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues
• Security-related scripts follow the principle of least privilege

Additional Notes

After this change, the full release lifecycle is: release-please creates published (immutable) release → delete and recreate as draft (mutable) → package/attest/upload assets → delete draft and recreate as published. No gh release edit calls remain in the pipeline.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Pull request overview

Updates the release pipeline in .github/workflows/main.yml to avoid gh release edit failures caused by GitHub release immutability tied to a tag, by switching the final “publish” step to a delete-and-recreate approach.

Changes:

• Replace gh release edit --draft=false in the publish-release job with a delete-and-recreate flow.
• Consolidate release metadata capture to a single gh release view --json name,body call parsed via jq.

[Copilot]

Deleting the draft release here will also delete all release assets that were uploaded in the earlier attest-and-upload and upload-plugin-packages jobs. The subsequent gh release create recreates the release metadata but does not restore those assets, so the published release will end up missing binaries. Consider either (a) re-uploading the previously built artifacts after recreating the release (e.g., download workflow artifacts in this job and gh release upload them), or (b) using an API approach that can publish without deleting the release object (if GitHub allows it for your immutability mode).

Suggested change

	# Capture draft release metadata
	RELEASE_JSON=$(gh release view "$TAG" --json name,body -R "$REPO")
	NAME=$(echo "$RELEASE_JSON" | jq -r '.name')
	echo "$RELEASE_JSON" | jq -r '.body' > /tmp/release-body.md
	# Delete mutable draft; recreate as published
	gh release delete "$TAG" --yes -R "$REPO"
	gh release create "$TAG" --verify-tag \
	--title "$NAME" --notes-file /tmp/release-body.md -R "$REPO"
	# Publish existing draft release without deleting assets
	gh release edit "$TAG" --draft=false -R "$REPO"

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.34%. Comparing base (c30e21a) to head (dc97a77).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #552      +/-   ##
==========================================
- Coverage   85.36%   85.34%   -0.03%     
==========================================
  Files          23       23              
  Lines        4475     4475              
==========================================
- Hits         3820     3819       -1     
- Misses        655      656       +1     

Flag	Coverage Δ
pester	85.34% <ø> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.