fix: harden release-guard workflow and prevent race condition

.github/workflows/release-guard.yml

@@ -5,23 +5,34 @@ on:
 
 permissions:
   contents: write
+  actions: read
 
 jobs:
   unset-latest:
     runs-on: ubuntu-latest
     steps:
       - name: Restore previous release as latest if needed
         run: |
+          # If the Release workflow already succeeded for this tag, the
+          # pipeline intentionally set "latest" — don't undo it.
+          RELEASE_RUN_STATUS=$(gh run list \
+            --workflow=release.yml \
+            --json conclusion,headBranch \
+            -q "[.[] | select(.headBranch == \"$RELEASE_TAG\")] | .[0].conclusion")
+
+          if [ "$RELEASE_RUN_STATUS" = "success" ]; then
+            echo "Release workflow succeeded for $RELEASE_TAG, skipping guard."
+            exit 0
+          fi
+
           LATEST_TAG=$(gh release list --json tagName,isLatest -q '.[] | select(.isLatest) | .tagName')
-          if [ "$LATEST_TAG" != "${{ github.event.release.tag_name }}" ]; then
+          if [ "$LATEST_TAG" != "$RELEASE_TAG" ]; then
             echo "Release is not marked as latest (latest is $LATEST_TAG), skipping."
             exit 0
           fi
 
-          echo "Release ${{ github.event.release.tag_name }} is marked as latest, finding previous release..."
+          echo "Release $RELEASE_TAG is marked as latest, finding previous release..."
 
-          # Get the second release in the list (sorted by date, excluding drafts/prereleases by default)
-          # The first one is the current release, so we want the second one
           PREVIOUS_TAG=$(gh release list --exclude-drafts --exclude-pre-releases --json tagName -q '.[1].tagName')
 
           if [ -z "$PREVIOUS_TAG" ]; then
@@ -33,3 +44,5 @@ jobs:
           gh release edit "$PREVIOUS_TAG" --latest
         env:
           GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}

.github/workflows/release.yml

@@ -54,6 +54,7 @@ jobs:
           HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
           GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
       - name: Mark release as latest
-        run: gh release edit ${{ github.ref_name }} --latest
+        run: gh release edit "$TAG" --latest
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}