UID2-7340: publish service releases as pre-releases instead of drafts

[BehnamMozafari]

Summary

The shared release pipeline (shared_create_releases) creates every GitHub Release as a draft. Publishing a draft is a manual click most people skip, so release notes are silently lost, GET /releases/tags/{tag} 404s on the draft even though the git tag exists, and reading a draft needs a push-scoped token. This blocks UID2-6766 (release notes at the deploy approval gate) and the UID2-7327 read-only release PAT.

This PR lets deployed services publish a pre-release instead of a draft — durable and fetchable by tag, without claiming GA. Registry/SDK packages (Maven, PyPI, NuGet, iOS) keep their existing draft flow (a follow-up can move them later). Latest is never set automatically — it stays a deliberate manual promotion.

Changes

actions/shared_create_releases/action.yaml

• New prerelease input (default 'false'): prerelease: 'true' publishes a pre-release; omitted/'false' keeps the original draft behaviour. draft is derived (draft when not pre-release); the action can never auto-publish a full Latest release.
• Explicit tag_name: v<version> — softprops defaults it to github.ref_name (the dispatch branch), which drafts masked since they carry no tag; a published release needs the tag or get-by-tag still 404s. The tag already exists from commit_pr_and_merge.
• Resolve previous published tag (pre-release cuts only): computes the changelog fromTag from the most recent published release, so a tagged-but-unpublished run self-heals on the next cut. Explicit from_tag still wins; drafts/empty fall back to mikepenz auto-detection. Runs under set -euo pipefail so a gh failure fails the cut instead of silently building the changelog over the wrong window.
• Verify release tag exists (pre-release cuts only): fails if v<version> doesn't already exist, rather than letting softprops auto-create the tag at the checked-out commit. Every current consumer pushes the tag via commit_pr_and_merge before publishing; this guards future callers that don't.

Docker reusable workflows set prerelease: 'true' (all @v3 consumers inherit it, no per-repo change):

• shared-publish-to-docker-versioned.yaml
• shared-publish-java-to-docker-versioned.yaml

The Maven/PyPI/NuGet/iOS workflows are unchanged (omit prerelease → draft).

README.md — documents the prerelease input, the fromTag self-heal, and the tag-existence contract.

Notes

• Delete Draft Releases step left as-is — scope-down tracked in UID2-7070.
• Blast radius: the action ships under @v3 (moved only when this repo cuts a release). Validate a real service publish before relying on it.
• uid2-operator publish-all-operators.yaml (private-op artifacts) is handled in a separate PR per the proposal.

Validation

Smoke-tested by calling shared_create_releases@<branch> directly in a throwaway repo (UnifiedID2/bmz-prerelease-smoke):

Check	Result
prerelease: 'true'	draft:false, prerelease:true; GET /releases/tags/v<ver> → 200 (was 404 on drafts)
omitted	draft created (original behaviour preserved)
tag_name	release attaches to v<ver>, not the dispatch branch
fromTag self-heal	changelog spans from the most recent published release, skipping a tagged-but-unpublished gap

🤖 Generated with Claude Code

[jon8787]

Verify release tag exists: a transient API error is indistinguishable from a missing tag

Failing closed here is the right instinct — better to abort than let softprops auto-create v<version> at the checked-out SHA and durably mis-tag the release. Two downsides worth weighing:

1. New transient failure point on every service release. Any non-404 failure of this gh api call — auth blip, 5xx, rate-limit, network — now aborts the publish even when the tag is actually present.
2. Misleading error. When the real cause is a 5xx/rate-limit rather than a missing tag, the message still reads does not exist, which will misdirect whoever debugs the failed release.

Consider distinguishing a genuine 404 from a transport/5xx error — e.g. branch on the HTTP status, or add a short retry on non-404 — so a real missing tag aborts loudly while a transient blip retries instead of masquerading as a missing tag.