release: mark prereleases, and publish via a draft for immutability

[yesdevnull]

Two release-publishing fixes, both prompted by v1.0.0-alpha.1.

The alpha published as the latest stable release

GoReleaser defaults release.prerelease to false, so v1.0.0-alpha.1 went out as an ordinary release and took GitHub's "Latest" badge — an alpha presented as the current stable version to anyone landing on the repository. The release workflow reported success, because from its point of view nothing had gone wrong, which is what makes this worth fixing in config rather than remembering.

That release has been corrected by hand. prerelease: auto reads the semver prerelease suffix, so the next -beta or -rc is marked without anyone having to notice.

Preparing for immutable releases

GitHub's immutable releases lock a release's assets and its git tag the moment it is published. This workflow published first and uploaded into the live release, which is precisely the order that has to fight the lock.

GoReleaser now builds the release as a draft with every archive attached, and a separate step publishes it — the order GitHub prescribes:

Create the release as a draft. Attach all associated assets to the draft release. Publish the draft release.

This is the better failure mode either way. A run that dies partway now leaves an unpublished draft holding whatever it built, rather than a published release missing half its binaries — and a draft can be finished by hand, where a published immutable release cannot.

Note that immutability itself is not enabled by this PR. It has no REST API — PATCH /repos/{owner}/{repo} with immutable_releases is silently ignored — so it has to be switched on in Settings → Releases → Enable release immutability. These changes are safe to land before or after that, and are worth having regardless.

Verification

goreleaser check passes and actionlint is clean. The tag reaches the shell through env: rather than inline expansion, matching the other workflows.

Three things config cannot prove, all observable at the next tag and worth a glance then:

• prerelease: auto marking a -rc/-beta tag — accepted by goreleaser check, but the behaviour only shows on a real prerelease.
• gh release edit --draft=false preserving the prerelease flag GoReleaser set. It sends only the fields named, so it should.
• A draft release being addressable by tag name. The tag exists before the workflow runs, so it should.

The changelog is deliberately untouched. The first release's spanned the entire history only because there was no previous tag to diff against; subsequent tags diff from their predecessor.

🤖 Generated with Claude Code

https://claude.ai/code/session_0136bDtWBAdKtufTHcXoSwQK

[Copilot]

Pull request overview

This PR updates the GoReleaser configuration to ensure semver prerelease tags (e.g., v1.0.0-alpha.1) are published on GitHub as prereleases, preventing them from taking the repository’s “Latest” release badge.

Changes:

• Add release.prerelease: auto to .goreleaser.yaml so prerelease status is inferred from the tag’s semver prerelease component.
• Document in-config why this is needed (to avoid prerelease tags being treated as stable releases).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.