Require explicit published release status before publication writes

Reject missing or malformed draft metadata and retain valid published controls. The branch-specific Release WhatIf fixture handback adds only two boolean fields and changes no assertions.

Author: MariusStorhaug

.github/actions/Publish-PSModule/README.md

@@ -12,6 +12,8 @@ Provenance must contain one original JSON object with scalar proof fields; array
 
 GitHub resource responses must have valid object/scalar shapes, while verified empty tag collections remain valid absence. An existing PR-produced stable or prerelease release requires its producing-context footer; unreadable terminal markers are errors even when indented or inline. Unknown legacy PR release context is not inferred from a matching tag.
 
+Existing releases must explicitly return scalar boolean `draft: false`. Missing, null, string, or array status is unknown published-release proof and stops before Gallery publication or a resumed asset upload.
+
 ## Inputs
 
 | Name | Description | Required | Default |

.github/actions/Publish-PSModule/src/Publish-PSModule.Helpers.psm1

@@ -506,8 +506,8 @@ function Get-PSModulePublicationState {
         }
     }
     if ($null -ne $release) {
-        if ($release.draft -eq $true) {
-            throw 'The existing release is a draft. Refusing Gallery publication or a success-shaped incomplete release.'
+        if ($release.draft -isnot [bool] -or $release.draft -ne $false) {
+            throw 'The existing release has no verified boolean draft:false status. Refusing publication or an incomplete release.'
         }
         if ($release.tag_name -cne $expected.ReleaseTag -or
             [string]::IsNullOrWhiteSpace($release.html_url) -or

.github/actions/Publish-PSModule/tests/Publish-PSModule.Preflight.Tests.ps1

@@ -155,6 +155,7 @@ Describe 'Publish-PSModule source-bound preflight' {
             tag_name   = 'v1.2.4'
             html_url   = 'https://github.com/PSModule/TestModule/releases/tag/v1.2.4'
             prerelease = $false
+            draft      = $false
             assets     = @($asset)
         }
 
@@ -511,6 +512,7 @@ Describe 'Publish-PSModule source-bound preflight' {
             tag_name   = 'v1.2.4'
             html_url   = 'https://github.com/PSModule/TestModule/releases/tag/v1.2.4'
             prerelease = $false
+            draft      = $false
             body       = "Notes.`n<!-- PSModule.PrereleaseOwner:v1:$encoded -->"
             assets     = @()
         }

.github/actions/Release-PSModule/tests/Release-PSModule.WhatIf.Tests.ps1

@@ -132,6 +132,7 @@ Describe 'Release-PSModule WhatIf' {
             tag_name   = 'v1.2.3-preview.1'
             html_url   = 'https://github.com/PSModule/TestModule/releases/tag/v1.2.3-preview.1'
             prerelease = $true
+            draft      = $false
             body       = "Original notes.`n<!-- PSModule.PrereleaseOwner:v1:$encoded -->"
             assets     = @()
         }
@@ -213,6 +214,7 @@ Describe 'Release-PSModule WhatIf' {
             tag_name   = 'v1.2.3-preview.1'
             html_url   = 'https://github.com/PSModule/TestModule/releases/tag/v1.2.3-preview.1'
             prerelease = $true
+            draft      = $false
             body       = "Foreign PR notes.`n<!-- PSModule.PrereleaseOwner:v1:$encoded -->"
             assets     = @()
         }