ci(release): publish the release after the SBOM uploads

Merged
JI
18h ago
+12-0

The release workflow uploads the container SBOMs to the GitHub release after goreleaser publishes it. With GitHub immutable releases, a published release cannot get new assets, so these uploads fail.

With this change:

  • goreleaser creates the release as a draft (draft: true). replace_existing_draft: true lets a new run of the job replace the draft.
  • A new step publishes the release with gh release edit --draft=false --latest after the SBOM uploads.
  • The source code step downloads the archive from the published release, as before.

Users and tools that read the latest release see the new version only after all assets are uploaded.

Refs PFM-8051.

AI disclosure: Claude Code helped to write this change.