fix: publish GitHub releases without pushing to main

[tknopp-ld]

Summary

• Stop the Release workflow from pushing HEAD to main (blocked by Bot Bouncer + PR-required rulesets). That skip is why v2.17.0 shipped with no assets (REL-15681, run 31702824366).
• Push the version tag only; create the GitHub release as a draft, upload artifacts, then undraft (immutable releases reject post-publish uploads).
• Record RELEASE_COMMIT after prepare-release.sh so a missing remote tag is created from the bump commit, not main.
• Do not overwrite GITHUB_TOKEN when GITHUB_RELEASE_TOKEN is empty.

Test plan

• ./scripts/release/push-to-origin_test.sh — local bare remote: tag is pushed, origin/main does not move; second run skips an existing tag. This also runs on PRs in go-tests.
• Cannot fully exercise release.yml on this PR. It is workflow_dispatch only and make publish pushes Docker Hub + Homebrew. After merge, optional dryRun: true dispatch still skips GitHub release/tag push by design.
• Next real release: confirm the run creates a draft, attaches the 15 archives, then publishes; main is unchanged except via a normal version-bump PR.
• Confirm a failed tag push still creates the release (continue-on-error on the tag step).

Made with Cursor

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit eb2eda7. Configure here.}

[cursor]

Publish aborts on unset GITHUB_TOKEN

High Severity

When GITHUB_RELEASE_TOKEN is empty, GITHUB_TOKEN is no longer exported to GITHUB_ENV. stage-artifacts.sh later expands $GITHUB_TOKEN under set -u, so the publish step dies before Docker Hub, Homebrew, or the GitHub release run.

 

^{Reviewed by Cursor Bugbot for commit eb2eda7. Configure here.}

[cursor]

Failed tag push cannot create release

Medium Severity

If the tag push fails, the bump commit never reaches GitHub. ncipollo/release-action cannot create a tag at RELEASE_COMMIT because the GitHub API only tags SHAs that already exist on the remote, so continue-on-error does not still produce a release.

Additional Locations (1)

• scripts/release/push-to-origin.sh#L10-L17

 

^{Reviewed by Cursor Bugbot for commit eb2eda7. Configure here.}