build: attach release assets before publishing the release

[feanil]

What happened

The v3.7.1 release run failed at Publish | Upload to GitHub Release Assets:

HTTPError: 422 Client Error: Unprocessable Entity for url:
https://uploads.github.com/repos/openedx/sample-plugin/releases/376463625/assets?name=openedx_plugin_sample-3.7.1.tar.gz
Failed to upload asset 'dist/openedx_plugin_sample-3.7.1.tar.gz' to release (HTTP 422)

Root cause

The openedx org now has immutable releases enabled, which freezes a release's assets the moment the release is published. Our flow published the release first and uploaded the distributions in a separate step afterwards, which GitHub now rejects with Cannot upload assets to an immutable release.

The immutable flag on our releases lines up exactly with when assets stopped appearing:

tag	immutable	assets
v3.7.1	true	0
v3.7.0	true	0
v3.6.1	true	0
v3.6.0	false	2

So this has been broken since v3.6.1 (2026-07-15), but the job stayed green because python-semantic-release swallowed asset upload errors until v10.6.0 fixed that. Bumping to v10.6.1 in #56 didn't break anything — it surfaced a pre-existing failure. The patch_tags = [..., "build"] addition in that same PR is why the path got exercised immediately, which is exactly what it was added for.

The fix

gh release create creates the release as a draft, uploads the assets, and only then publishes it — the sequence immutable releases require. So:

• vcs_release: "false" on the python-semantic-release step, so it still tags, pushes and builds, but doesn't create the release
• publish-action is replaced by a gh release create step that passes the dists as arguments
• PSR's generated notes are reused via the release_notes output, so the release body is unchanged

Second commit drops OPENEDX_SEMANTIC_RELEASE_GITHUB_TOKEN in favour of the default GITHUB_TOKEN. That PAT was added in bed319c so PSR could push the changelog commit past branch protection on main; 53c8f3f then turned the changelog off, so PSR only pushes a tag now (No local changes to add to any commit) and never writes to the protected branch. Tag and release creation are both covered by the contents: write permission the job already grants, and the repo has no tag protection rules or rulesets to bypass.

Verified

• Draft-first has been gh release create's behaviour since at least v2.20.0, so this doesn't depend on a recent gh on the runner
• released and release_notes are both set before the make_vcs_release branch in PSR's version.py, so they survive vcs_release: "false"
• Release notes containing backticks, $(...) or quotes pass through unexpanded (env var + printf '%s' + --notes-file)

The end-to-end behaviour can only be tested by publishing a real release. Since this is a build: commit, merging it releases 3.7.2 and validates itself.

Follow-ups, not in this PR

• 3.7.1 never reached PyPI or npm. The failing step aborted the rest of the job, so the artifact upload and all three publish jobs were skipped. Re-running won't help — the tag exists, so PSR would report released=false. Letting 3.7.2 carry it is the plan; PyPI would skip 3.7.1.
• v3.6.1, v3.7.0 and v3.7.1 are permanently asset-less. They're immutable, so they can't be backfilled.
• An upstream issue for python-semantic-release is drafted; there's no existing report for this.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.04%. Comparing base (43d749c) to head (2bb4364).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #57   +/-   ##
=======================================
  Coverage   93.04%   93.04%           
=======================================
  Files          16       16           
  Lines         503      503           
  Branches       18       18           
=======================================
  Hits          468      468           
  Misses         24       24           
  Partials       11       11           

Flag	Coverage Δ
unittests	93.04% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.