[lippdev]

What

The owner wants 1.7.0 out first as a test release nobody receives, with a Legacy download (1.6.2's interfaces, #200) in the same release.

• draft input. With publish, the release is created as a draft (softprops/action-gh-release draft: true). Drafts are visible only to people with write access: the unauthenticated releases API the app's update check reads doesn't list them, the winget job is skipped, and GitHub creates the tag only when the draft is published (on target_commitish, the commit that was built). A pushed tag never makes a draft.
• legacy input. A branch name. A legacy job checks it out, runs its tests and its Publish-ConsoleMode.ps1 with this release's version, renames the two files to ConsoleMode-Legacy-Setup-x64.exe / ConsoleMode-Legacy-Portable-x64.exe and uploads them as an artifact; the build job fetches them (gh run download of the same run, hence actions: read) and attaches them to the release in the same step as the normal files, with a "Legacy" section in the notes. UpdateService matches ConsoleMode-Setup* / ConsoleMode-Portable* and winget ConsoleMode-Setup-x64\.exe$, so neither picks a Legacy file.
• Skipped-job plumbing. build now needs: legacy; both it and winget use !cancelled() conditions so a skipped Legacy job (the normal case, and every pushed tag) doesn't skip them.
• winget.yml. A draft published by a person fires release: published, which sends a stable release to winget; it can also be run by hand for a tag. Releases the Release workflow publishes right away don't fire that event (workflow token), so they keep going through the winget job and nothing is submitted twice.
• docs/GUIDE.md / docs/GUIDE.pt-BR.md: the release paragraph mentions both inputs.

Testing

Both files parse as YAML. The workflow itself can only be proven by running it: after merge, a run with publish unticked and legacy=release/1.7-legacy (build only, nothing published) comes first, then the draft.

🤖 Generated with Claude Code

[pullfrog]

Important

The Legacy job runs code from an input-selected ref with the release workflow's write-capable token.

Reviewed changes

• Draft releases: Adds a dispatch input to create releases as drafts and avoids sending drafts to winget.
• Legacy assets: Builds a selected branch and includes its renamed installer and portable executable in the release.
• Winget delivery: Adds a workflow to submit stable releases published manually from a draft.
• Guide updates: Documents the release inputs in English and Portuguese.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6-luna ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes The incremental review covers the Legacy job's credential restrictions added since the prior Pullfrog review.

• Restricted Legacy credentials: Limited the job token to contents: read and disabled persisted checkout credentials while running the selected branch's code.

  ^{｜ View workflow run ｜ Using gpt-6-luna ｜ 𝕏}