release: draft from an existing tag

.github/workflows/release.yaml

@@ -4,6 +4,12 @@ on:
   push:
     tags:
       - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing release tag
+        required: true
+        type: string
 
 env:
   REGISTRY: ghcr.io
@@ -17,22 +23,57 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+          fetch-depth: 0
 
       - name: Extract version from tag
         id: version
-        run: echo "version=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+        env:
+          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+        run: |
+          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || exit 1
+          git rev-parse -q --verify "refs/tags/$RELEASE_TAG^{commit}" >/dev/null
+          echo "version=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Check GitHub Release
+        id: release_state
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ steps.version.outputs.version }}
+        run: |
+          is_draft=$(gh release list --limit 1000 --json tagName,isDraft \
+            --jq ".[] | select(.tagName == \"$RELEASE_TAG\") | .isDraft")
+          case "$is_draft" in
+            true) echo "exists=true" >> "$GITHUB_OUTPUT" ;;
+            false) echo "Release $RELEASE_TAG is already published" >&2; exit 1 ;;
+            '') echo "exists=false" >> "$GITHUB_OUTPUT" ;;
+            *) echo "Unexpected release state: $is_draft" >&2; exit 1 ;;
+          esac
 
       - name: Log in to GHCR
         run: podman login -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }} ${{ env.REGISTRY }}
 
-      - name: Build bink binary
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libgpgme-dev \
+            libbtrfs-dev \
+            libdevmapper-dev \
+            pkg-config
+
+      - name: Build and verify bink binary
+        env:
+          RELEASE_TAG: ${{ steps.version.outputs.version }}
         run: |
-          podman build --build-arg VERSION=${{ steps.version.outputs.version }} \
-            --target builder -t localhost/bink-builder:latest -f Containerfile .
-          podman create --name bink-builder-tmp localhost/bink-builder:latest
-          podman cp bink-builder-tmp:/output/bink ./bink
-          podman rm bink-builder-tmp
-          chmod +x ./bink
+          make build-bink VERSION="${RELEASE_TAG}"
           ./bink version
 
       - name: Build and push bink image
@@ -59,11 +100,21 @@ jobs:
           podman push ${{ env.REGISTRY }}/${{ github.repository }}/dns:${{ steps.version.outputs.version }}
           podman push ${{ env.REGISTRY }}/${{ github.repository }}/dns:latest
 
-      - name: Create GitHub Release
+      - name: Create or update draft GitHub Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ steps.version.outputs.version }}
+          RELEASE_EXISTS: ${{ steps.release_state.outputs.exists }}
         run: |
-          gh release create ${{ steps.version.outputs.version }} \
-            ./bink \
-            --title "${{ steps.version.outputs.version }}" \
-            --generate-notes
+          if [[ "$RELEASE_EXISTS" == true ]]; then
+            [[ $(gh release view "$RELEASE_TAG" --json isDraft --jq .isDraft) == true ]] || {
+              echo "Release $RELEASE_TAG is no longer a draft" >&2
+              exit 1
+            }
+            gh release upload "$RELEASE_TAG" ./bink --clobber
+          else
+            gh release create "$RELEASE_TAG" \
+              ./bink \
+              --title "$RELEASE_TAG" \
+              --generate-notes --draft
+          fi