Use GoReleaser release.disable to prevent tag creation on GitHub before build completes

- Set release.disable: true in both goreleaser configs so GoReleaser builds
  artifacts and uploads to S3/Docker without ever calling the GitHub Releases
  API (which previously created the immutable tag as a side effect of draft
  release creation)
- Replace the draft publish step with an explicit push-tag + gh release create
  sequence: tag only hits GitHub after all artifacts are fully built and signed,
  making the entire build phase safely retryable under org-level immutable tag rules
- Dev builds get --prerelease, prod builds get --latest via gh release create

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: cx-aniket-shinde

.github/workflows/release.yml

@@ -141,12 +141,24 @@ jobs:
         env:
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
 
-      - name: Push tag and publish release
+      - name: Push tag
+        run: git push origin "${{ inputs.tag }}"
+
+      - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          git push origin "${{ inputs.tag }}"
-          gh release edit "${{ inputs.tag }}" --draft=false --latest
+          if [ "${{ inputs.dev }}" = "true" ]; then
+            gh release create "${{ inputs.tag }}" dist/*.tar.gz dist/*.zip dist/*checksums* \
+              --title "Checkmarx One CLI ${{ inputs.tag }}" \
+              --generate-notes \
+              --prerelease
+          else
+            gh release create "${{ inputs.tag }}" dist/*.tar.gz dist/*.zip dist/*checksums* \
+              --title "Checkmarx One CLI ${{ inputs.tag }}" \
+              --generate-notes \
+              --latest
+          fi
 
   notify:
     name: Update Teams & JIRA About New Release

.goreleaser-dev.yml

@@ -3,7 +3,7 @@ project_name: ast-cli
 release:
   prerelease: true
   name_template: 'Checkmarx One CLI {{.Version}}'
-  draft: true
+  disable: true
 
 builds:
   - main: ./cmd/main.go

.goreleaser.yml

@@ -2,7 +2,7 @@ project_name: ast-cli
 
 release:
   name_template: 'Checkmarx One CLI {{.Version}}'
-  draft: true
+  disable: true
 
 builds:
   - main: ./cmd/main.go