fix(release): create untagged build drafts

.github/workflows/build.yml

@@ -740,21 +740,6 @@ jobs:
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "build_number=$BUILD_NUMBER" >> $GITHUB_OUTPUT
 
-      - name: Refuse to overwrite a published release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          if RELEASE_DRAFT=$(gh api "repos/$GITHUB_REPOSITORY/releases/tags/$VERSION" --jq '.draft' 2>&1); then
-            if [ "$RELEASE_DRAFT" != "true" ]; then
-              echo "::error::Release $VERSION is already published. Publish a new version instead of replacing immutable assets."
-              exit 1
-            fi
-          elif [[ "$RELEASE_DRAFT" != *"HTTP 404"* ]]; then
-            echo "::error::Failed to check whether release $VERSION is already published: $RELEASE_DRAFT"
-            exit 1
-          fi
-
       - name: Download Android artifacts
         if: ${{ inputs.build_android }}
         uses: actions/download-artifact@v4
@@ -916,10 +901,8 @@ jobs:
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{ steps.version.outputs.version }}
           files: ${{ steps.release-files.outputs.files }}
           draft: true
           prerelease: false
-          generate_release_notes: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

scripts/check_build_workflow.py

@@ -192,29 +192,15 @@ for build_input in (
         f"release publication must require {build_input}",
     )
 
-guard_name = "Refuse to overwrite a published release"
-require(guard_name in release, "release job must reject published tag reuse")
+require("draft: true" in release, "build output must remain a draft release")
+require("tag_name:" not in release, "build output must not bind a release tag")
 require(
-    'gh api "repos/$GITHUB_REPOSITORY/releases/tags/$VERSION"' in release,
-    "published release guard must query the exact version tag",
+    "generate_release_notes:" not in release,
+    "untagged draft releases must not request generated release notes",
 )
 require(
-    '"$RELEASE_DRAFT" != "true"' in release,
-    "published release guard must allow only draft releases",
-)
-require(
-    "HTTP 404" in release and "Failed to check whether release" in release,
-    "published release guard must distinguish missing releases and fail closed",
-)
-guard_position = release.find(guard_name)
-download_position = release.find("Download Android artifacts")
-require(
-    guard_position >= 0 and download_position >= 0 and guard_position < download_position,
-    "published release guard must run before artifact downloads",
-)
-require(
-    "tag_name: ${{ steps.version.outputs.version }}" in release,
-    "release must explicitly use the pubspec version as its tag",
+    "Refuse to overwrite a published release" not in release,
+    "untagged draft creation must not inspect or block on published releases",
 )
 
 if errors: