From 6d2d127ac1d585ae2cb8bd33ad98d819347328a0 Mon Sep 17 00:00:00 2001
From: Gnani Rahul <gnani.nutakki@gmail.com>
Date: Tue, 14 Jul 2026 15:58:55 -0500
Subject: [PATCH] fix(e9): publish beta drafts by release ID

GSTACK-Checkpoint: 2026-07-14/e9-beta-draft-publish#1
Signed-off-by: Gnani Rahul <gnani.nutakki@gmail.com>
---
 .github/workflows/release.yml                |  2 +-
 sessions/2026-07-14-e9-beta-draft-publish.md | 41 ++++++++++++++++++++
 tests/scripts/release_tag_policy_test.sh     |  6 +++
 3 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 sessions/2026-07-14-e9-beta-draft-publish.md

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6474567..29b313a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -162,7 +162,7 @@ jobs:
         run: |
           set -euo pipefail
           if [[ "$RELEASE_KIND" == "beta" ]]; then
-            release_id="$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${GITHUB_REF_NAME}" --jq '.id')"
+            release_id="$(gh release view "$GITHUB_REF_NAME" --json databaseId --jq '.databaseId')"
             gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${release_id}" \
               -F draft=false \
               -F prerelease=true \
diff --git a/sessions/2026-07-14-e9-beta-draft-publish.md b/sessions/2026-07-14-e9-beta-draft-publish.md
new file mode 100644
index 0000000..76fb5fc
--- /dev/null
+++ b/sessions/2026-07-14-e9-beta-draft-publish.md
@@ -0,0 +1,41 @@
+# E9 beta draft publication repair — 2026-07-14
+
+Issue: #159
+Branch: `gnanirahulnutakki/fix/e9-beta-draft-publish`
+Base: `origin/dev` at `ff07b60ff934508dd694f338ffa017d3503da171`
+
+## [G] Goal
+
+Repair the beta publication step so a workflow-created draft release is resolved by its database ID
+and can be published as a prerelease without replacing the latest stable release.
+
+## [S] Incident boundary
+
+- Signed `v0.3.0-beta.1` passed GitHub tag verification and the release workflow built, signed, and
+  attested the draft artifacts.
+- The final publication step used `GET /releases/tags/{tag}` and received 404 for the draft,
+  leaving the draft unpublished. Stable `v0.2.1` remained latest.
+- The failed tag and draft are preserved. No deletion, force-push, retagging, or manual publication
+  is permitted. The corrected workflow will publish a new immutable `v0.3.0-beta.2` tag.
+
+## [A] Evidence in progress
+
+- The workflow now resolves `gh release view <tag> --json databaseId`, whose draft-aware view is
+  already proven by the existing beta.1 draft.
+- The policy test requires that lookup, rejects the draft-invisible tags endpoint, and keeps the
+  raw-string `make_latest=false` assertion.
+- Pending: focused and full gates, red-team review, hosted PR/post-merge CI, release promotion, and
+  beta.2 artifact verification.
+
+## [T] Test plan
+
+1. Run policy scripts, `make ci`, and `make release-check` on the final diff.
+2. Confirm stable publication remains unchanged and beta mutation still requires
+   `draft=false`, `prerelease=true`, and raw string `make_latest=false`.
+3. Land through `dev` and a reviewed release PR, then create a new signed beta.2 tag and verify its
+   release state and macOS-arm64 archive.
+
+## [C] Completion criteria
+
+The issue closes only when beta.2 is published as a prerelease, `v0.2.1` remains latest, and the
+macOS-arm64 release archive passes checksum, provenance, and local launch verification.
diff --git a/tests/scripts/release_tag_policy_test.sh b/tests/scripts/release_tag_policy_test.sh
index 8d03a7c..5c7fd67 100755
--- a/tests/scripts/release_tag_policy_test.sh
+++ b/tests/scripts/release_tag_policy_test.sh
@@ -50,6 +50,12 @@ done
 
 grep -Fq 'hack/release-tag-classify.sh "$GITHUB_REF_NAME"' "${workflow}"
 printf '[release-tag-policy] PASS: workflow invokes the tested classifier\n'
+grep -Fq 'gh release view "$GITHUB_REF_NAME" --json databaseId' "${workflow}"
+if grep -Fq 'releases/tags/${GITHUB_REF_NAME}' "${workflow}"; then
+  printf '[release-tag-policy] FAIL: beta publication uses draft-invisible tag lookup\n' >&2
+  exit 1
+fi
+printf '[release-tag-policy] PASS: beta publication resolves the draft release by database ID\n'
 grep -Fq -- '-f make_latest=false' "${workflow}"
 printf '[release-tag-policy] PASS: beta publication cannot replace latest stable\n'
 grep -Fq 'vMAJOR.MINOR.PATCH-beta.N' "${guide}"