From 34ecd81f7f22f0f0dbcf19f766cabfab74184728 Mon Sep 17 00:00:00 2001
From: David Sherret <dsherret@gmail.com>
Date: Sat, 17 Oct 2026 19:07:47 -0400
Subject: [PATCH] fix: use `gh release create` so releases work with immutable
 releases

---
 .github/workflows/ci.generated.yml | 12 +++++-------
 .github/workflows/ci.ts            | 19 ++++++++-----------
 2 files changed, 13 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/ci.generated.yml b/.github/workflows/ci.generated.yml
index 0977c19..eb34abf 100644
--- a/.github/workflows/ci.generated.yml
+++ b/.github/workflows/ci.generated.yml
@@ -74,16 +74,14 @@ jobs:
           # create release notes
           deno run -A ./scripts/generateReleaseNotes.ts ${{ steps.get_tag_version.outputs.TAG_VERSION }} > ${{ github.workspace }}-CHANGELOG.txt
       - name: Release
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844
         if: 'matrix.config.kind == ''test_release'' && startsWith(github.ref, ''refs/tags/'')'
         env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-        with:
-          files: |-
-            target/wasm32-unknown-unknown/release/plugin.wasm
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |-
+          gh release create "$GITHUB_REF_NAME" --verify-tag --title "$GITHUB_REF_NAME" \
+            --notes-file ${{ github.workspace }}-CHANGELOG.txt \
+            target/wasm32-unknown-unknown/release/plugin.wasm \
             deployment/schema.json
-          body_path: '${{ github.workspace }}-CHANGELOG.txt'
-          draft: false
       - name: Lint workflow generation
         if: matrix.config.kind == 'test_debug'
         run: |-
diff --git a/.github/workflows/ci.ts b/.github/workflows/ci.ts
index c673662..d0e5293 100755
--- a/.github/workflows/ci.ts
+++ b/.github/workflows/ci.ts
@@ -102,18 +102,15 @@ const buildJob = job("build", {
     },
     {
       name: "Release",
-      // pinned because softprops/action-gh-release was once compromised
-      uses: "softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844",
       if: isReleaseAndTag,
-      env: { GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" },
-      with: {
-        files: [
-          "target/wasm32-unknown-unknown/release/plugin.wasm",
-          "deployment/schema.json",
-        ].join("\n"),
-        body_path: "${{ github.workspace }}-CHANGELOG.txt",
-        draft: false,
-      },
+      // gh uploads the assets to a draft and then publishes it, which immutable releases require
+      env: { GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}" },
+      run: [
+        `gh release create "$GITHUB_REF_NAME" --verify-tag --title "$GITHUB_REF_NAME"`,
+        "--notes-file ${{ github.workspace }}-CHANGELOG.txt",
+        "target/wasm32-unknown-unknown/release/plugin.wasm",
+        "deployment/schema.json",
+      ].join(" \\\n  "),
     },
     {
       name: "Lint workflow generation",