ci: resolve draft release assets via API in smoke-test

.github/workflows/publish.yml

@@ -261,7 +261,7 @@ jobs:
     needs:
       - version
       - build-cli
-    if: false # Disable the smoketest job until it works when called on draft releases
+    if: github.repository == 'Kilo-Org/kilocode'
     uses: ./.github/workflows/smoke-test.yml
     with:
       cli_version: ${{ needs.version.outputs.version }}
@@ -272,7 +272,7 @@ jobs:
       - version
       - build-cli
       - build-vscode
-      # - smoke-test # Disable the smoketest job until it works when called on draft releases
+      - smoke-test
       # - build-tauri
     runs-on: ubuntu-24.04
     steps:

.github/workflows/smoke-test.yml

@@ -35,7 +35,7 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
-  contents: read
+  contents: write # needed to read draft release assets when called from publish.yml
 
 jobs:
   smoke-test:
@@ -77,18 +77,31 @@ jobs:
             exit 1
           fi
 
-      - name: Resolve CLI version
+      - name: Resolve CLI asset URL
         id: cli
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           VERSION="${{ inputs.cli_version }}"
-          if [[ -n "$VERSION" ]]; then
-            URL="https://github.com/Kilo-Org/kilocode/releases/download/v${VERSION}/kilo-linux-x64.tar.gz"
-            echo "cli_url=$URL" >> "$GITHUB_OUTPUT"
-            echo "::notice::Testing CLI v${VERSION} from release: $URL"
-          else
+          if [[ -z "$VERSION" ]]; then
             echo "cli_url=" >> "$GITHUB_OUTPUT"
             echo "::notice::Testing latest CLI from npm"
+            exit 0
+          fi
+          # Resolve the release asset via the API so this works for draft
+          # releases too (browser /releases/download/... URLs 404 on drafts).
+          # The installer passes Accept: application/octet-stream + bearer
+          # auth, which is what the API asset endpoint expects.
+          # The tag_name filter yields at most one release and one asset,
+          # so --jq returns a single URL without needing head/pipefail games.
+          URL=$(gh api "repos/${{ github.repository }}/releases" \
+            --jq ".[] | select(.tag_name == \"v${VERSION}\") | .assets[] | select(.name == \"kilo-linux-x64.tar.gz\") | .url")
+          if [[ -z "$URL" ]]; then
+            echo "::error::asset kilo-linux-x64.tar.gz not found for v${VERSION}"
+            exit 1
           fi
+          echo "cli_url=$URL" >> "$GITHUB_OUTPUT"
+          echo "::notice::Testing CLI v${VERSION} via asset API: $URL"
 
       - name: Run smoke test — hello-world
         env: