From 484772937e71c62f924bc54781aebda1d2e3931e Mon Sep 17 00:00:00 2001
From: Brad Ison <bison@netbird.io>
Date: Tue, 11 Aug 2026 18:21:14 +0200
Subject: [PATCH] [misc] Don't mark releases latest before signing

goreleaser's release.make_latest defaults to true, and all four goreleaser
configs publish into the GitHub release on a tag push, so a release became
GitHub's "Latest release" the moment it was published -- while its Windows
and macOS artifacts were still unsigned. The signing pipeline's
mark_release_latest job then re-asserted a flag that was already set,
so the gate it was meant to provide did not exist.

With make_latest: false in every config, a release stays published but
not latest until sign-pipelines finishes signing and marks it latest --
making "marked latest" an accurate signal that the whole chain completed.

Also set prerelease: auto so rc tags are labelled as prereleases on
GitHub; previously they were published as full releases (for example
v0.75.0-rc.6) and could take the "Latest release" slot themselves.
---
 .goreleaser.yaml           | 7 +++++++
 .goreleaser_ui.yaml        | 8 ++++++++
 .goreleaser_ui_darwin.yaml | 8 ++++++++
 .goreleaser_ui_gtk3.yaml   | 8 ++++++++
 4 files changed, 31 insertions(+)

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 8dd05a192..c5d260376 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -468,6 +468,13 @@ checksum:
     - glob: ./infrastructure_files/migrate-to-enterprise.sh
 
 release:
+  # The signing pipeline (netbirdio/sign-pipelines, dispatched by
+  # trigger_signer) marks the release latest once the Windows and macOS
+  # artifacts are signed. Without this override goreleaser marks it latest
+  # at publish time, while those artifacts are still unsigned.
+  make_latest: false
+  # Mark x.y.z-rc.* and other prerelease tags as prereleases on GitHub.
+  prerelease: auto
   extra_files:
     - glob: ./infrastructure_files/getting-started-with-zitadel.sh
     - glob: ./release_files/install.sh
diff --git a/.goreleaser_ui.yaml b/.goreleaser_ui.yaml
index c61b8c474..1c5bc41ac 100644
--- a/.goreleaser_ui.yaml
+++ b/.goreleaser_ui.yaml
@@ -144,3 +144,11 @@ uploads:
     target: https://pkgs.wiretrustee.com/yum/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
     username: dev@wiretrustee.com
     method: PUT
+
+release:
+  # Uploads into the release created by the main .goreleaser.yaml run.
+  # make_latest stays false everywhere: the signing pipeline
+  # (netbirdio/sign-pipelines) marks the release latest after the Windows
+  # and macOS artifacts are signed.
+  make_latest: false
+  prerelease: auto
diff --git a/.goreleaser_ui_darwin.yaml b/.goreleaser_ui_darwin.yaml
index 47b991344..8ca0e8da6 100644
--- a/.goreleaser_ui_darwin.yaml
+++ b/.goreleaser_ui_darwin.yaml
@@ -43,3 +43,11 @@ checksum:
   name_template: "{{ .ProjectName }}_darwin_checksums.txt"
 changelog:
   disable: true
+
+release:
+  # Uploads into the release created by the main .goreleaser.yaml run.
+  # make_latest stays false everywhere: the signing pipeline
+  # (netbirdio/sign-pipelines) marks the release latest after the Windows
+  # and macOS artifacts are signed.
+  make_latest: false
+  prerelease: auto
diff --git a/.goreleaser_ui_gtk3.yaml b/.goreleaser_ui_gtk3.yaml
index 5770ef348..1000f9d71 100644
--- a/.goreleaser_ui_gtk3.yaml
+++ b/.goreleaser_ui_gtk3.yaml
@@ -140,3 +140,11 @@ uploads:
     username: dev@wiretrustee.com
     password: "{{ .Env.UPLOAD_YUM_SECRET }}"
     method: PUT
+
+release:
+  # Uploads into the release created by the main .goreleaser.yaml run.
+  # make_latest stays false everywhere: the signing pipeline
+  # (netbirdio/sign-pipelines) marks the release latest after the Windows
+  # and macOS artifacts are signed.
+  make_latest: false
+  prerelease: auto