fix: fail the release job when the latest-release lookup errors (#DS-3378)

The badge decision read the release currently holding Latest with
`2> /dev/null || true`, so auth, rate-limit and transient GitHub failures all
came back as an empty `current` — indistinguishable from "this repository has
no releases yet". Empty means "nothing holds the badge", so a 19.x patch tagged
during a GitHub blip would have created itself with `--latest=true` and taken
the badge off 20.x. Verified against the pre-fix line with a stubbed gh: a 503
on the lookup yields `--latest=true` for tag 19.9.0.

Same treatment the existence check above already got: "release not found" is
the answer for a repository with no releases at all — checked against
github/gitignore with gh 2.97.0, it is the same string the tag lookup returns —
and there the first release does legitimately take the badge. Anything else
fails the job. stdout and stderr stay separate here because stdout carries the
tag name, so the message goes through a file rather than the `2>&1 1>/dev/null`
swap used above.

Author: lskramarov

.github/workflows/publish.yml

@@ -121,7 +121,21 @@ jobs:
               prerelease=(--prerelease) # a prerelease can never be latest
               ;;
             *)
-              current=$(gh release view --json tagName --jq .tagName 2> /dev/null || true)
+              # Same distinction as above, and the same message: a repository with no releases at
+              # all answers "release not found" too — verified against github/gitignore with `gh`
+              # 2.97.0 — and there the first release does take the badge. Any other failure would
+              # otherwise read as "nothing holds the badge" and move it here, so it fails instead.
+              # The two streams stay separate: stdout carries the tag name, stderr the message.
+              if ! current=$(gh release view --json tagName --jq .tagName 2> "$RUNNER_TEMP/latest-release.err"); then
+                latest_error=$(cat "$RUNNER_TEMP/latest-release.err")
+
+                if [ "$latest_error" != "release not found" ]; then
+                  echo "::error::gh release view --json tagName failed: $latest_error"
+                  exit 1
+                fi
+
+                current=''
+              fi
 
               if [ -z "$current" ] || [ "$(printf '%s\n%s\n' "$TAG" "$current" | sort -V | tail -1)" = "$TAG" ]; then
                 latest=true