fix(release): publish as draft until desktop assets upload (#802)

The release flow previously promoted a tag to "latest" the moment the CLI
publish step completed (via `gh release create --latest`). The desktop
build then ran for another 15-20 min before attaching DMG/zip/exe/AppImage/
deb/rpm/latest*.yml, leaving `/releases/latest/download/<desktop-asset>`
to 404 for any user hitting it during that window.

Create the release as a draft instead, and flip `--draft=false` as the
final step of publish-desktop.yml once every asset is uploaded. GitHub
auto-promotes the undrafted release to "latest" based on semver. While in
draft, `/releases/latest/...` continues to redirect to the previous
release, so install.sh and the download links in release notes keep
working.

Also harden the upload loop: drop the `|| true` that was swallowing
upload failures, switch to `set -euo pipefail` and process substitution
so a failed `gh release upload` aborts the job instead of silently
leaving the release short an asset.

Author: RhysSullivan

.github/workflows/publish-desktop.yml

@@ -170,10 +170,18 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          find artifacts -type f \
+          set -euo pipefail
+          while IFS= read -r file; do
+            echo "Uploading: $file"
+            gh release upload "$RELEASE_TAG" "$file" --repo "$GITHUB_REPOSITORY" --clobber
+          done < <(find artifacts -type f \
             \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" \
             -o -name "*.AppImage" -o -name "*.deb" -o -name "*.rpm" \
-            -o -name "latest*.yml" \) | while read file; do
-            echo "Uploading: $file"
-            gh release upload "$RELEASE_TAG" "$file" --repo "$GITHUB_REPOSITORY" --clobber || true
-          done
+            -o -name "latest*.yml" \))
+
+      # Flip draft → published only after every desktop asset is uploaded —
+      # this is the atomic point where the new tag becomes "latest".
+      - name: Promote release (draft → published)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release edit "$RELEASE_TAG" --draft=false --repo "$GITHUB_REPOSITORY"

apps/cli/src/release.ts

@@ -200,6 +200,9 @@ const syncGitHubRelease = async (input: {
   const notesPath = resolve(cliRoot, "release-notes", "next.md");
   const notesFile = existsSync(notesPath) ? notesPath : null;
 
+  // Draft until publish-desktop.yml finishes uploading installers and flips
+  // it; otherwise /releases/latest/download/<desktop-asset> 404s during the
+  // ~15-20 min desktop build window.
   const args = [
     "release",
     "create",
@@ -211,12 +214,11 @@ const syncGitHubRelease = async (input: {
     input.tag,
     ...(notesFile ? ["--notes-file", notesFile] : ["--generate-notes"]),
     "--verify-tag",
+    "--draft",
   ];
 
   if (input.channel === "beta") {
     args.push("--prerelease");
-  } else {
-    args.push("--latest");
   }
 
   await runCommand({