fix: only lock on published releases, keep updating drafts

The draft release is a staging area that gets continuously replaced as
main evolves.  Only a published (non-draft) release acts as a lock:

- prepare-release: skips only when a published release exists for the
  version (meaning it is already on PyPI).  Draft releases are freely
  overwritten by force-updating the release branch.
- release-artifacts: creates or replaces the draft after every green
  test run.  Skips only when a published release exists.

To start a fresh release cycle after publishing, the next push to main
with new fragments will compute a new version automatically.

Co-authored-by: Cursor AI <ai@cursor.sh>
Co-authored-by: Anthropic Claude Opus 4 <claude@anthropic.com>

Author: 3 people

.github/workflows/prepare-release.yml

@@ -36,12 +36,24 @@ jobs:
           echo "branch=release-$VERSION" >> "$GITHUB_OUTPUT"
           echo "Computed version: $VERSION"
 
-      - name: Check for existing identical release branch
+      - name: Check if release is already published or branch is up-to-date
         if: steps.version.outputs.version
         id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           VERSION="${{ steps.version.outputs.version }}"
           BRANCH="release-$VERSION"
+
+          # A published (non-draft) release means the version is locked in
+          # and already on PyPI — do not touch the release branch.
+          IS_DRAFT=$(gh release view "$VERSION" --json isDraft --jq '.isDraft' 2>/dev/null || echo "")
+          if [ "$IS_DRAFT" = "false" ]; then
+            echo "::notice::Release $VERSION is already published — nothing to do."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           # If the release branch already exists and was built from this
           # exact main commit, there is nothing to update.
           if git rev-parse --verify "origin/$BRANCH" >/dev/null 2>&1; then

.github/workflows/test.yml

@@ -189,28 +189,27 @@ jobs:
         run: |
           VERSION="${{ steps.version.outputs.version }}"
           TAG="$VERSION"
-
-          # Generate release notes from the PR's CHANGELOG.rst changes.
           NOTES="Release $VERSION — built from \`${{ github.head_ref }}\` at ${{ github.event.pull_request.head.sha }}."
 
-          if gh release view "$TAG" >/dev/null 2>&1; then
-            # Delete existing assets and re-upload.
+          if gh release view "$TAG" --json isDraft --jq '.isDraft' 2>/dev/null | grep -q 'true'; then
+            # Update existing draft: replace assets with freshly tested ones.
             gh release edit "$TAG" \
               --draft \
               --title "pluggy $VERSION" \
               --notes "$NOTES" \
               --target "${{ github.event.pull_request.head.sha }}"
-            # Remove old assets.
             for asset in $(gh release view "$TAG" --json assets --jq '.assets[].name'); do
               gh release delete-asset "$TAG" "$asset" --yes
             done
+            gh release upload "$TAG" dist/*
+          elif gh release view "$TAG" >/dev/null 2>&1; then
+            # A published (non-draft) release exists — version is locked.
+            echo "::notice::Release $VERSION is already published — skipping."
           else
-            gh release create "$TAG" \
+            # No release exists yet — create a fresh draft.
+            gh release create "$TAG" dist/* \
               --draft \
               --title "pluggy $VERSION" \
               --notes "$NOTES" \
               --target "${{ github.event.pull_request.head.sha }}"
           fi
-
-          # Upload the wheel and sdist as release assets.
-          gh release upload "$TAG" dist/* --clobber