Fix race condition in release process (#4766)

* Close window between release and artifact creation

* Use alternate method of falling back

* Remove unused env vars

Author: bill-rich

.github/workflows/release-guard.yml

@@ -0,0 +1,33 @@
+name: Release Guard
+on:
+  release:
+    types: [created]
+
+permissions:
+  contents: write
+
+jobs:
+  unset-latest:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Restore previous release as latest if needed
+        run: |
+          LATEST_TAG=$(gh release list --json tagName,isLatest -q '.[] | select(.isLatest) | .tagName')
+          if [ "$LATEST_TAG" != "${{ github.event.release.tag_name }}" ]; then
+            echo "Release is not marked as latest (latest is $LATEST_TAG), skipping."
+            exit 0
+          fi
+
+          echo "Release ${{ github.event.release.tag_name }} is marked as latest, finding previous release..."
+
+          # Get the second release in the list (sorted by date, excluding drafts/prereleases by default)
+          # The first one is the current release, so we want the second one
+          PREVIOUS_TAG=$(gh release list --exclude-drafts --exclude-pre-releases --json tagName -q '.[1].tagName')
+
+          if [ -z "$PREVIOUS_TAG" ]; then
+            echo "No previous release found, cannot restore. Exiting."
+            exit 0
+          fi
+
+          echo "Restoring $PREVIOUS_TAG as latest..."
+          gh release edit "$PREVIOUS_TAG" --latest

.github/workflows/release.yml

@@ -53,3 +53,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
           GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+      - name: Mark release as latest
+        run: gh release edit ${{ github.ref_name }} --latest
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.goreleaser.yml

@@ -1,4 +1,6 @@
 version: 2
+release:
+  make_latest: false
 builds:
   - id: trufflehog-upx
     binary: trufflehog