fix(release): read draft package assets through API

[jbdevprimary]

Fixes the v0.35.5 package-manifest publication failure. The publisher now resolves signed manifest assets through the draft-aware release view and authenticated asset APIs; gh release download cannot retrieve a draft. The job uses only its short-lived repo token for draft visibility, while PKGS_GITHUB_TOKEN remains the sole package-repo writer.\n\nValidation: bash scripts/ci/test_publish_cli_manifests.sh; go test ./tests/releasecontrol -count=1; actionlint .github/workflows/release.yml.

[coderabbitai]

Warning

Review limit reached

Next included review available in 14 seconds.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6a1fc6a8-6797-4371-8248-4c1add47c820

📥 Commits

Reviewing files that changed from the base of the PR and between 3932873 and f3e84d3.

📒 Files selected for processing (4)

• .github/workflows/release.yml
• packaging/publish-cli-manifests.sh
• scripts/ci/test_publish_cli_manifests.sh
• tests/releasecontrol/release_control_test.go

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[amazon-q-developer]

The changes correctly fix the draft package asset access issue by switching from gh release download to the GitHub API with Accept: application/octet-stream. The implementation properly uses the short-lived repository token with contents: write permission (limited to the release job), while PKGS_GITHUB_TOKEN remains the package-repo writer. The test updates and contract validations ensure the new asset retrieval pattern is enforced.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[jbdevprimary]

Follow-up hardening added in the latest commit: the package-head verifier and premerge smoke use only their short-lived repository token with contents: write to read draft assets. The organization credential is not exposed; package writes stay isolated to PKGS_GITHUB_TOKEN, and Homebrew/Scoop runs after credentials are removed.\n\nValidation: go test ./tests/releasecontrol -count=1; actionlint .github/workflows/release.yml.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud