From 5b71b5eee892e889cbde56d9062cba17d0e37573 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Fri, 17 Jul 2026 10:36:33 +0000
Subject: [PATCH 1/3] CI: Replace softprops/action-gh-release with `gh release
 create`

gh cli is already on the runner. This also solves an issue surfaced by a new version of zizmor, noting that using actions like these when another tool already doing the same functionality is increasing the attack surface uselessly.
---
 .github/workflows/create_release_draft.yml | 38 ++++++++++++----------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/create_release_draft.yml b/.github/workflows/create_release_draft.yml
index 3800bdda520..a77df4c83f1 100644
--- a/.github/workflows/create_release_draft.yml
+++ b/.github/workflows/create_release_draft.yml
@@ -75,21 +75,23 @@ jobs:
           sha256sum "${GRASS}.tar.xz" > "${GRASS}.tar.xz.sha256"
       - name: Publish draft distribution to GitHub (for tags only)
         if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
-        with:
-          name: GRASS ${{ github.ref_name }}
-          body: |
-            Overview of changes
-            - First change
-            - Second change
-          draft: true
-          prerelease: ${{ contains(github.ref, 'RC') }}
-          files: |
-              ${{ env.OUT_DIR }}/${{ env.GRASS }}.tar.gz
-              ${{ env.OUT_DIR }}/${{ env.GRASS }}.tar.gz.md5
-              ${{ env.OUT_DIR }}/${{ env.GRASS }}.tar.gz.sha256
-              ${{ env.OUT_DIR }}/${{ env.GRASS }}.tar.xz
-              ${{ env.OUT_DIR }}/${{ env.GRASS }}.tar.xz.md5
-              ${{ env.OUT_DIR }}/${{ env.GRASS }}.tar.xz.sha256
-              ${{ env.OUT_DIR }}/ChangeLog.gz
-              ${{ env.OUT_DIR }}/core_modules_with_last_commit.patch
+        run: |-
+          gh release create ${GITHUB_REF_NAME} \
+            --draft \
+            --verify-tag \
+            --fail-on-no-commits \
+            --generate-notes \
+            --title "${TITLE}" \
+            ${PRERELEASE_FLAG} \
+            ${OUT_DIR}/${GRASS}.tar.gz \
+            ${OUT_DIR}/${GRASS}.tar.gz.md5 \
+            ${OUT_DIR}/${GRASS}.tar.gz.sha256 \
+            ${OUT_DIR}/${GRASS}.tar.xz \
+            ${OUT_DIR}/${GRASS}.tar.xz.md5 \
+            ${OUT_DIR}/${GRASS}.tar.xz.sha256 \
+            ${OUT_DIR}/ChangeLog.gz \
+            ${OUT_DIR}/core_modules_with_last_commit.patch
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TITLE: GRASS ${{ github.ref_name }}
+          PRERELEASE_FLAG: ${{ contains(github.ref, 'RC') && '--prerelease' || '' }}

From 035955f7ec6208b6f50411cae12f5d901338e3e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Fri, 17 Jul 2026 14:18:29 +0000
Subject: [PATCH 2/3] style: Quote shell variables

---
 .github/workflows/create_release_draft.yml | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/create_release_draft.yml b/.github/workflows/create_release_draft.yml
index a77df4c83f1..cd33536dbcc 100644
--- a/.github/workflows/create_release_draft.yml
+++ b/.github/workflows/create_release_draft.yml
@@ -76,21 +76,21 @@ jobs:
       - name: Publish draft distribution to GitHub (for tags only)
         if: startsWith(github.ref, 'refs/tags/')
         run: |-
-          gh release create ${GITHUB_REF_NAME} \
+          gh release create "${GITHUB_REF_NAME}" \
             --draft \
             --verify-tag \
             --fail-on-no-commits \
             --generate-notes \
             --title "${TITLE}" \
-            ${PRERELEASE_FLAG} \
-            ${OUT_DIR}/${GRASS}.tar.gz \
-            ${OUT_DIR}/${GRASS}.tar.gz.md5 \
-            ${OUT_DIR}/${GRASS}.tar.gz.sha256 \
-            ${OUT_DIR}/${GRASS}.tar.xz \
-            ${OUT_DIR}/${GRASS}.tar.xz.md5 \
-            ${OUT_DIR}/${GRASS}.tar.xz.sha256 \
-            ${OUT_DIR}/ChangeLog.gz \
-            ${OUT_DIR}/core_modules_with_last_commit.patch
+            "${PRERELEASE_FLAG}" \
+            "${OUT_DIR}/${GRASS}.tar.gz" \
+            "${OUT_DIR}/${GRASS}.tar.gz.md5" \
+            "${OUT_DIR}/${GRASS}.tar.gz.sha256" \
+            "${OUT_DIR}/${GRASS}.tar.xz" \
+            "${OUT_DIR}/${GRASS}.tar.xz.md5" \
+            "${OUT_DIR}/${GRASS}.tar.xz.sha256" \
+            "${OUT_DIR}/ChangeLog.gz" \
+            "${OUT_DIR}/core_modules_with_last_commit.patch"
         env:
           GH_TOKEN: ${{ github.token }}
           TITLE: GRASS ${{ github.ref_name }}

From f6653f4a0ebbd8d74bd674eb4c1622355a179df2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Fri, 17 Jul 2026 14:52:11 +0000
Subject: [PATCH 3/3] CI: `gh release create` allows using `--prerelease=true`
 and `--prerelease=false` as tested locally

---
 .github/workflows/create_release_draft.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/create_release_draft.yml b/.github/workflows/create_release_draft.yml
index cd33536dbcc..78c3bf15a6e 100644
--- a/.github/workflows/create_release_draft.yml
+++ b/.github/workflows/create_release_draft.yml
@@ -82,7 +82,7 @@ jobs:
             --fail-on-no-commits \
             --generate-notes \
             --title "${TITLE}" \
-            "${PRERELEASE_FLAG}" \
+            --prerelease="${PRERELEASE_FLAG}" \
             "${OUT_DIR}/${GRASS}.tar.gz" \
             "${OUT_DIR}/${GRASS}.tar.gz.md5" \
             "${OUT_DIR}/${GRASS}.tar.gz.sha256" \
@@ -94,4 +94,4 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           TITLE: GRASS ${{ github.ref_name }}
-          PRERELEASE_FLAG: ${{ contains(github.ref, 'RC') && '--prerelease' || '' }}
+          PRERELEASE_FLAG: ${{ contains(github.ref, 'RC') }}