From 4567c81713d020ffe67e57f3da79ff035d146249 Mon Sep 17 00:00:00 2001
From: GoncaloGarcia <ggarcia@cloudflare.com>
Date: Wed, 23 Apr 2025 15:23:15 +0100
Subject: [PATCH] Test draft

---
 .gitlab-ci.yml    | 21 +++++++++++++++++----
 github_release.py | 15 +++++++++++----
 2 files changed, 28 insertions(+), 8 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 44fe351f..2c9d2b12 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,5 +1,10 @@
 stages: [check, build, release]
 
+default:
+  id_tokens:
+    VAULT_ID_TOKEN:
+      aud: https://vault.cfdata.org
+
 # -----------------------------------------------
 # Stage 1: Check for a Git tag on the current commit
 # -----------------------------------------------
@@ -19,9 +24,6 @@ check_tag:
 
 build_cloudflared_macos: &build
   stage: build
-  id_tokens:
-    VAULT_ID_TOKEN:
-      aud: https://vault.cfdata.org
   secrets:
     APPLE_DEV_CA_CERT:
       vault: gitlab/cloudflare/tun/cloudflared/_dev/apple_dev_ca_cert/data@kv
@@ -69,7 +71,18 @@ build_cloudflared_macos_tagged_release:
   stage: release
   dependencies:
     - build_cloudflared_macos
+  variables:
+    KV_NAMESPACE: 380e19aa04314648949b6ad841417ebe
+    KV_ACCOUNT: 5ab4e9dfbd435d24068829fda0077963
+  secrets:
+    KV_API_TOKEN:
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/cfd_kv_api_token/data@kv
+      file: false
+    API_KEY:
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/cfd_github_api_key/data@kv
+      file: false
   script:
-    - echo "Running build because tag exists."
+    - echo "Running release because tag exists."
     - ls -lrth artifacts/
+    - python3 github_release.py --path $(PWD)/artifacts --release-version $(VERSION) --draft
 
diff --git a/github_release.py b/github_release.py
index 4620a139..c3a71739 100755
--- a/github_release.py
+++ b/github_release.py
@@ -61,7 +61,7 @@ def assert_tag_exists(repo, version):
         raise Exception("Tag {} not found".format(version))
 
 
-def get_or_create_release(repo, version, dry_run=False):
+def get_or_create_release(repo, version, dry_run=False, is_draft=False):
     """
     Get a Github Release matching the version tag or create a new one.
     If a conflict occurs on creation, attempt to fetch the Release on last time
@@ -81,8 +81,11 @@ def get_or_create_release(repo, version, dry_run=False):
         return
 
     try:
-        logging.info("Creating release %s", version)
-        return repo.create_git_release(version, version, "")
+        if is_draft:
+            logging.info("Drafting release %s", version)
+        else:
+            logging.info("Creating release %s", version)
+        return repo.create_git_release(version, version, "", is_draft)
     except GithubException as e:
         errors = e.data.get("errors", [])
         if e.status == 422 and any(
@@ -129,6 +132,10 @@ def parse_args():
         "--dry-run", action="store_true", help="Do not create release or upload asset"
     )
 
+    parser.add_argument(
+        "--draft", action="store_true", help="Create a draft release"
+    )
+
     args = parser.parse_args()
     is_valid = True
     if not args.release_version:
@@ -292,7 +299,7 @@ def main():
                 for filename in onlyfiles:
                     binary_path = os.path.join(args.path, filename)
                     assert_asset_version(binary_path, args.release_version)
-                release = get_or_create_release(repo, args.release_version, args.dry_run)
+                release = get_or_create_release(repo, args.release_version, args.dry_run, args.draft)
                 for filename in onlyfiles:
                     binary_path = os.path.join(args.path, filename)
                     upload_asset(release, binary_path, filename, args.release_version, args.kv_account_id, args.namespace_id,