From 00dfc1d2ea967d8b88fe9bad46191e961e9bfe9c Mon Sep 17 00:00:00 2001
From: csd113 <xxcsd113xx@gmail.com>
Date: Thu, 1 Oct 2026 09:10:19 -0700
Subject: [PATCH] Resolve draft release IDs before signing update artifacts

---
 .github/workflows/release.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 419887b6..4348104b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -307,7 +307,16 @@ jobs:
             fi
             gh release create "$GITHUB_REF_NAME" --draft --title "Release $GITHUB_REF_NAME" --notes-file RELEASE_NOTES.md
           fi
-          release_id="$(gh api "repos/$GITHUB_REPOSITORY/releases/tags/$GITHUB_REF_NAME" --jq '.id')"
+          release_id="$(gh api graphql \
+            -f owner="$GITHUB_REPOSITORY_OWNER" \
+            -f name="${GITHUB_REPOSITORY#*/}" \
+            -f tag="$GITHUB_REF_NAME" \
+            -f query='query($owner: String!, $name: String!, $tag: String!) { repository(owner: $owner, name: $name) { release(tagName: $tag) { databaseId isDraft } } }' \
+            --jq '.data.repository.release | select(.isDraft) | .databaseId')"
+          if [[ ! "$release_id" =~ ^[1-9][0-9]*$ ]]; then
+            echo "Expected a draft release with a positive numeric ID" >&2
+            exit 1
+          fi
           python3 tools/update_package.py sign --directory release-assets --key "$key_file" --release-id "$release_id" --version "$GITHUB_REF_NAME"
           rm release-assets/build-info-*.json