[jinxiao]

Issue

Closes #17
Closes #19
Refs #15

Summary

The first full-release rollout exposed two GitHub API/event behaviors that offline fixtures had modeled incorrectly. Green workflow_dispatch jobs did not satisfy the protected PR's required checks, and querying a newly created Release draft by tag returned 404 because that endpoint returns published Releases.

Preparation now activates native pull_request checks, binds them to the repository, PR, and exact head, waits for asynchronous creation, and requests authorization for action_required runs. It retains pending/successful native runs and preserves their event association during failure recovery. If GitHub forbids automatic authorization, report the maintainer's Approve workflows to run action. No synthetic passing checks or protection exemptions are used.

Publication resolves published Releases by tag and matching drafts through authenticated listing, rejects duplicate matches, and validates reviewed notes/tag targets before recovery. GoReleaser still owns draft creation/finalization, after fresh public consumer verification. Progress artifacts include reports, reviewed notes, configurations, and logs; consumer dependency/build caches are excluded.

Testing

• 19 automation regressions passed locally, including native event/PR/head/repository binding, asynchronous creation, approval, pending/success retention, failed native recovery, and forbidden-approval guidance.
• 30 release regressions passed, including real GoReleaser OSS v2.18.2 root/nested/prerelease checks and draft creation/finalization against an API fixture that now returns 404 for draft-by-tag lookup. Draft-list fallback, duplicate rejection, conflict gates, and consumer-before-finalization recovery pass.
• actionlint v1.7.12, clean strict Zensical build, and git diff whitespace checks passed; Go commands kept CGO disabled.
• Hosted evidence: native PR checks passed and PR chore(release): prepare auto-36f4844999-c882b3686aea #16 merged after dispatched jobs were rejected. Publication created the reviewed root tag and draft, then stopped at the old lookup. That exact batch remains open for recovery under [Release]: auto-36f4844999-c882b3686aea #15; no tag or notes will be rewritten.

Risks and compatibility

The existing Actions write permission is used for native activation; no additional secret is introduced. Default-token authorization depends on GitHub policy and has a maintainer fallback. Only same-repository runs associated with this preparation PR/head are activated; fork checks are excluded.

The frozen publication SHA and module versions stay unchanged. After this fix merges, Publish Go modules can resume PR #16 using the updated adapter while checking out the exact reviewed publication commit. Existing library source, module paths, notes, consumer gates, and main protection remain intact. The draft tag is already public; preserve it.

Release notes

• repository | fix | Activate native PR checks for prepared releases so successful checks satisfy protected-branch merge rules without duplicate manual dispatches.
• repository | fix | Discover and reuse matching GitHub Release drafts during GoReleaser publication recovery instead of treating them as missing published releases.

Checklist

• The issues record hosted failures and acceptance criteria
• Regression fixtures now model actual GitHub event and draft lookup behavior
• CGO remains disabled and no cloud AWS tests were run
• Credentials and generated caches are excluded