fix(release): replace softprops/action-gh-release with gh CLI to fix missing releases

softprops/action-gh-release v2.5.0 (SHA a06a81a0) introduced a
"draft until all artifacts are uploaded" feature (PR #692) that has
known bugs causing releases to silently fail finalization. The action
creates a draft release, uploads artifacts, then attempts to un-draft
it, but the finalization can fail without surfacing errors (see
softprops/action-gh-release#709, #704, #713). This left 46 tags
(v0.1.45-v0.1.64) with zero published GitHub releases.

The fix replaces the action with a direct `gh release create` CLI
call, which creates the release atomically with all assets attached
in a single operation. This avoids the draft-then-finalize pattern
entirely. A post-creation verification step confirms the release is
publicly accessible.

Also adds a fallback in install.sh: when no GitHub releases exist,
the installer now queries the tags API to find the latest version
tag before falling back to build-from-source.

Fixes #77, fixes #78.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Dicklesworthstone

.github/workflows/release.yml

@@ -148,6 +148,7 @@ jobs:
           fi
           VERSION="${RAW_TAG#v}"
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "tag=${RAW_TAG}" >> "$GITHUB_OUTPUT"
 
       - name: Validate tag matches Cargo.toml version
         shell: bash
@@ -208,38 +209,69 @@ jobs:
           done
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
-        with:
-          name: v${{ steps.version.outputs.version }}
-          files: artifacts/*
-          generate_release_notes: true
-          body: |
-            ## Installation
-
-            ### Quick Install (recommended)
-            ```bash
-            # Linux/macOS
-            curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/coding_agent_session_search/main/install.sh" | bash -s -- --easy-mode --verify
-
-            # Windows (PowerShell)
-            irm https://raw.githubusercontent.com/Dicklesworthstone/coding_agent_session_search/main/install.ps1 | iex
-            ```
-
-            ### Package Managers
-            ```bash
-            # Homebrew
-            brew install dicklesworthstone/tap/cass
-
-            # Scoop
-            scoop bucket add dicklesworthstone https://github.com/Dicklesworthstone/scoop-bucket
-            scoop install dicklesworthstone/cass
-            ```
-
-            ### Verify Downloads
-            All binaries include SHA256 checksums. Download `SHA256SUMS.txt` and verify:
-            ```bash
-            sha256sum -c SHA256SUMS.txt
-            ```
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.version.outputs.tag }}
+          VERSION: ${{ steps.version.outputs.version }}
+        shell: bash
+        run: |
+          echo "Creating release for tag: ${TAG}"
+
+          # Delete any leftover draft/broken release for this tag (from prior failed runs)
+          EXISTING_ID=$(gh api "repos/${{ github.repository }}/releases" \
+            --paginate --jq ".[] | select(.tag_name == \"${TAG}\") | .id" 2>/dev/null || true)
+          if [[ -n "$EXISTING_ID" ]]; then
+            echo "Deleting existing release id=${EXISTING_ID} for tag ${TAG}"
+            gh api -X DELETE "repos/${{ github.repository }}/releases/${EXISTING_ID}" || true
+          fi
+
+          # Build release body
+          cat > "$RUNNER_TEMP/release-body.md" <<'EOF'
+          ## Installation
+
+          ### Quick Install (recommended)
+          ```bash
+          # Linux/macOS
+          curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/coding_agent_session_search/main/install.sh" | bash -s -- --easy-mode --verify
+
+          # Windows (PowerShell)
+          irm https://raw.githubusercontent.com/Dicklesworthstone/coding_agent_session_search/main/install.ps1 | iex
+          ```
+
+          ### Package Managers
+          ```bash
+          # Homebrew
+          brew install dicklesworthstone/tap/cass
+
+          # Scoop
+          scoop bucket add dicklesworthstone https://github.com/Dicklesworthstone/scoop-bucket
+          scoop install dicklesworthstone/cass
+          ```
+
+          ### Verify Downloads
+          All binaries include SHA256 checksums. Download `SHA256SUMS.txt` and verify:
+          ```bash
+          sha256sum -c SHA256SUMS.txt
+          ```
+          EOF
+          sed -i 's/^          //' "$RUNNER_TEMP/release-body.md"
+
+          # Create the release with all artifacts attached atomically
+          # Using gh CLI directly avoids softprops/action-gh-release v2.5.0 draft
+          # finalization bugs (see: https://github.com/softprops/action-gh-release/issues/709)
+          gh release create "${TAG}" artifacts/* \
+            --repo "${{ github.repository }}" \
+            --title "v${VERSION}" \
+            --notes-file "$RUNNER_TEMP/release-body.md" \
+            --generate-notes \
+            --latest \
+            --verify-tag
+
+          echo "Release created successfully for ${TAG}."
+
+          # Verify the release is publicly accessible
+          gh release view "${TAG}" --repo "${{ github.repository }}" --json tagName,isDraft,assets \
+            --jq '{tag: .tagName, draft: .isDraft, asset_count: (.assets | length)}'
 
     outputs:
       version: ${{ steps.version.outputs.version }}

install.sh

@@ -28,15 +28,21 @@ err() { log "\033[0;31m✗\033[0m $*"; }
 
 resolve_version() {
   if [ -n "$VERSION" ]; then return 0; fi
-  # Fetch latest release tag from GitHub API
   local latest=""
   if command -v curl >/dev/null 2>&1; then
+    # Try 1: Fetch latest release tag from GitHub API
     latest=$(curl -fsSL "https://api.github.com/repos/$OWNER/$REPO/releases/latest" 2>/dev/null \
       | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')
+    # Try 2: If no releases exist, fall back to latest git tag (sorted by version)
+    if [ -z "$latest" ]; then
+      warn "No GitHub releases found; falling back to latest git tag"
+      latest=$(curl -fsSL "https://api.github.com/repos/$OWNER/$REPO/tags?per_page=1" 2>/dev/null \
+        | grep '"name"' | head -1 | sed 's/.*"name": *"\([^"]*\)".*/\1/')
+    fi
   fi
   if [ -n "$latest" ]; then
     VERSION="$latest"
-    info "Using latest release: $VERSION"
+    info "Using latest version: $VERSION"
   elif [ -n "$FALLBACK_VERSION" ]; then
     VERSION="$FALLBACK_VERSION"
     info "Using fallback version: $VERSION"