fix: use draft releases to support immutable release policy

.github/release-please-config.json

@@ -8,6 +8,7 @@
       "changelog-path": ".github/CHANGELOG.md",
       "bump-minor-pre-major": true,
       "bump-patch-for-minor-pre-major": true,
+      "draft": true,
       "changelog-sections": [
         { "type": "feat", "section": "Features" },
         { "type": "fix", "section": "Bug Fixes" },

.github/workflows/finalize-release.yml

@@ -0,0 +1,71 @@
+name: Finalize Release
+
+# Publish draft releases once both CLI and Docker workflows succeed.
+# Release Please creates draft releases (immutable once published),
+# then CLI (GoReleaser) and Docker (GHCR) attach assets to the draft.
+# This workflow fires on each completion and publishes when both are done.
+
+on:
+  workflow_run:
+    workflows: [Docker, CLI]
+    types: [completed]
+
+permissions: {}
+
+jobs:
+  publish:
+    name: Publish Draft Release
+    # Only process tag-triggered runs (release builds)
+    if: startsWith(github.event.workflow_run.head_branch, 'v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Check both workflows and publish draft
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          set -euo pipefail
+
+          echo "Triggered by: ${{ github.event.workflow.name }}"
+          echo "Tag: $TAG"
+          echo "Triggering run conclusion: ${{ github.event.workflow_run.conclusion }}"
+
+          # If the triggering workflow failed, no point checking the other
+          if [ "${{ github.event.workflow_run.conclusion }}" != "success" ]; then
+            echo "Triggering workflow failed — skipping."
+            exit 0
+          fi
+
+          # Check status of both workflows for this tag.
+          # gh run list --branch works for both branches and tags.
+          CLI_CONCLUSION=$(gh run list --repo "$GITHUB_REPOSITORY" \
+            --workflow cli.yml --branch "$TAG" --limit 1 \
+            --json conclusion --jq '.[0].conclusion // "pending"')
+
+          DOCKER_CONCLUSION=$(gh run list --repo "$GITHUB_REPOSITORY" \
+            --workflow docker.yml --branch "$TAG" --limit 1 \
+            --json conclusion --jq '.[0].conclusion // "pending"')
+
+          echo "CLI: $CLI_CONCLUSION"
+          echo "Docker: $DOCKER_CONCLUSION"
+
+          if [ "$CLI_CONCLUSION" != "success" ] || [ "$DOCKER_CONCLUSION" != "success" ]; then
+            echo "Not all workflows succeeded yet (CLI=$CLI_CONCLUSION, Docker=$DOCKER_CONCLUSION)."
+            echo "The other workflow's completion will trigger another attempt."
+            exit 0
+          fi
+
+          # Both succeeded — check if release is still a draft
+          IS_DRAFT=$(gh release view "$TAG" --repo "$GITHUB_REPOSITORY" \
+            --json isDraft --jq '.isDraft')
+
+          if [ "$IS_DRAFT" != "true" ]; then
+            echo "Release $TAG is not a draft (isDraft=$IS_DRAFT). Already published or not found."
+            exit 0
+          fi
+
+          # Publish the draft release (makes it immutable)
+          gh release edit "$TAG" --repo "$GITHUB_REPOSITORY" --draft=false
+          echo "Release $TAG published successfully."

CLAUDE.md

@@ -272,7 +272,8 @@ site/               # Astro landing page (synthorg.io)
 - **DAST**: `.github/workflows/dast.yml` — ZAP API scan against the backend OpenAPI spec on push to main + weekly schedule. Builds backend image locally, starts container, runs ZAP. Results available as workflow artifacts (no SARIF — action v0.10.0 lacks native SARIF output). Not on PRs (too slow).
 - **Socket.dev**: GitHub App — supply chain attack detection on PRs (typosquatting, malware, suspicious ownership changes, obfuscated code). No config file needed, auto-comments on PRs.
 - **CLA**: `.github/workflows/cla.yml` — Contributor License Agreement signature check on PRs via `contributor-assistant/github-action`. Triggers on `pull_request_target` and `issue_comment`. Skips Dependabot. Signatures stored in `.github/cla-signatures.json` on the `cla-signatures` branch (unprotected, so the action can commit directly).
-- **Release**: `.github/workflows/release.yml` — Release Please (Google) auto-creates a release PR on every push to main. Merging the release PR creates a git tag (`vX.Y.Z`) + GitHub Release with changelog. Tag push triggers the Docker workflow to build version-tagged images. Uses `RELEASE_PLEASE_TOKEN` secret (PAT/GitHub App token) so tag creation triggers downstream workflows (GITHUB_TOKEN cannot). Config in `.github/release-please-config.json` and `.github/.release-please-manifest.json`. After creating/updating a release PR, auto-updates the BSL Change Date in LICENSE to 3 years ahead.
+- **Release**: `.github/workflows/release.yml` — Release Please (Google) auto-creates a release PR on every push to main. Merging the release PR creates a git tag (`vX.Y.Z`) + **draft** GitHub Release with changelog. Tag push triggers Docker and CLI workflows to attach assets to the draft. Uses `RELEASE_PLEASE_TOKEN` secret (PAT/GitHub App token) so tag creation triggers downstream workflows (GITHUB_TOKEN cannot). Config in `.github/release-please-config.json` (`"draft": true`) and `.github/.release-please-manifest.json`. After creating/updating a release PR, auto-updates the BSL Change Date in LICENSE to 3 years ahead.
+- **Finalize Release**: `.github/workflows/finalize-release.yml` — publishes draft releases after both Docker and CLI workflows succeed. Triggers on `workflow_run` completion of Docker and CLI. Checks both workflow conclusions for the tag, publishes the draft only when both are successful. Immutable releases are enabled on the repo — once published, release assets and body cannot be modified.
 
 ## Dependencies
 

docs/security.md

@@ -153,6 +153,7 @@ Images are **only pushed to GHCR after both scanners pass**.
 - **CLI binaries**: SLSA Level 3 provenance attestations (verify via `gh attestation verify`)
 - **Git commits**: GPG/SSH signed (enforced by branch protection ruleset)
 - **GitHub Actions**: All actions pinned by full SHA commit hash
+- **GitHub Releases**: Immutable releases enabled — once published, assets and body cannot be modified (prevents supply chain tampering). Releases are created as drafts by Release Please, finalized after all assets are attached.
 
 ---