fix(release): pass the draft-verify tag on Windows pwsh (#21851)

The Windows matrix defaults to pwsh, so assert-github-release-is-draft.mjs
received an empty argv and failed with "tag is required" after the signed
installer was already uploaded. Force bash, interpolate the tag in YAML,
and fall back to env TAG.

.github/workflows/release-cut.yml

@@ -2223,10 +2223,13 @@ jobs:
         # Why: electron-builder `--publish always` can create a public release
         # as soon as this platform uploads. Re-draft immediately, then fail, so
         # /releases/latest never keeps serving a missing Windows exe.
+        # Why bash: the Windows matrix defaults to pwsh, which does not expand
+        # "$TAG" into argv.
+        shell: bash
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ needs.cut.outputs.tag }}
-        run: node config/scripts/assert-github-release-is-draft.mjs "$TAG"
+        run: node config/scripts/assert-github-release-is-draft.mjs "${{ needs.cut.outputs.tag }}"
 
       # Why post-pack for Linux: electron-builder packs and uploads in one
       # `--publish always` invocation. The previous step re-drafts if that

.github/workflows/release-mac-build.yml

@@ -184,10 +184,11 @@ jobs:
         # Why: re-draft immediately if electron-builder flipped the GitHub
         # release public, then fail. Checking without restoring leaves
         # /releases/latest serving a missing Windows exe.
+        shell: bash
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ inputs.tag }}
-        run: node config/scripts/assert-github-release-is-draft.mjs "$TAG"
+        run: node config/scripts/assert-github-release-is-draft.mjs "${{ inputs.tag }}"
 
       # Why post-publish for macOS: electron-builder packs and uploads in a
       # single `--publish always` invocation, so there is no cheap insertion

config/scripts/assert-github-release-is-draft.mjs

@@ -91,7 +91,9 @@ export async function restorePublishedDesktopReleasesToDraft({
 }
 
 async function main() {
-  const tag = process.argv[2]
+  // Why env TAG: the Windows release-cut matrix uses pwsh, which does not
+  // expand bash-style "$TAG" in argv. The step still exports TAG.
+  const tag = process.argv[2] || process.env.TAG
   const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN
   const repo = process.env.GITHUB_REPOSITORY || 'stablyai/orca'
   const restored = await restorePublishedDesktopReleasesToDraft({

config/scripts/assert-github-release-is-draft.test.mjs

@@ -128,13 +128,17 @@ describe('release draft workflow contract', () => {
 
     expect(electronBuilderConfig.publish.releaseType).toBe('draft')
     expect(cutCheckout.with['fetch-tags']).toBe(true)
+    expect(linuxDraftStep.shell).toBe('bash')
     expect(linuxDraftStep.run).toContain('assert-github-release-is-draft.mjs')
+    expect(linuxDraftStep.run).toContain('needs.cut.outputs.tag')
     expect(publishRelease.run).toContain('gh release edit')
     expect(publishRelease.run).toContain('--draft=false')
     expect(macSteps.indexOf(abortParentStep)).toBeLessThan(macSteps.indexOf(macPublishStep))
     expect(abortParentStep.env.PARENT_RUN).toBe('${{ inputs.release_run_id }}')
     expect(abortParentStep.run).toContain('refusing to publish mac artifacts')
+    expect(macDraftStep.shell).toBe('bash')
     expect(macDraftStep.run).toContain('assert-github-release-is-draft.mjs')
+    expect(macDraftStep.run).toContain('inputs.tag')
     expect(macPublishStep.with.command).toContain('-c.publish.releaseType=draft')
 
     const linuxCommands = releaseWorkflow.jobs.build.strategy.matrix.include