fix(release): isolate draft validation from published assets

.github/workflows/release-desktop.yml

@@ -15,6 +15,11 @@ on:
         required: false
         default: true
         type: boolean
+      publish_draft_release:
+        description: 'Publish manual draft artifacts to GitHub Releases'
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   actions: read
@@ -700,6 +705,7 @@ jobs:
           if-no-files-found: error
 
   publish-release:
+    if: github.event_name == 'push' || inputs.draft == false || inputs.publish_draft_release == true
     needs: build
     runs-on: ubuntu-latest
 
@@ -724,6 +730,31 @@ jobs:
             exit 1
           fi
 
+      - name: Refuse to overwrite an existing published release
+        if: github.event_name == 'workflow_dispatch' && inputs.draft == true
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          error_file="${RUNNER_TEMP}/release-view-error.txt"
+          set +e
+          release_state=$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/v${{ steps.version.outputs.value }}" --jq '.draft' 2>"$error_file")
+          status=$?
+          set -e
+
+          if [ "$status" -ne 0 ]; then
+            if grep -q 'HTTP 404' "$error_file"; then
+              exit 0
+            fi
+            cat "$error_file" >&2
+            exit "$status"
+          fi
+
+          if [ "$release_state" = "false" ]; then
+            echo "::error::Refusing to overwrite published release v${{ steps.version.outputs.value }} with manual draft artifacts."
+            exit 1
+          fi
+
       - name: Load release notes
         id: release_notes
         shell: bash