fix(ci): Create release drafts before building (#7998)

This appears to be a regression introduced in 3dede3d8db.

See https://github.com/firezone/firezone/actions/runs/13102501871

.github/workflows/_kotlin.yml

@@ -21,11 +21,31 @@ jobs:
       - name: Run linter
         run: ./gradlew spotlessCheck
 
+  update-release-draft:
+    name: update-release-draft
+    runs-on: ubuntu-22.04
+    env:
+      # mark:next-android-version
+      RELEASE_NAME: android-client-1.4.2
+    steps:
+      - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
+        if: "${{ github.event_name == 'workflow_dispatch' && github.ref_name == 'main' }}"
+        id: update-release-draft
+        with:
+          config-name: release-drafter-android-client.yml
+          tag: ${{ env.RELEASE_NAME }}
+          version: ${{ env.RELEASE_NAME }}
+          name: ${{ env.RELEASE_NAME }}
+          commitish: ${{ github.sha }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   build_release:
     permissions:
       contents: write # for uploading artifacts to the release
       id-token: write
     name: build-release-${{ matrix.package-type }}
+    needs: update-release-draft
     # Android SDK tools hardware accel is available only on Linux runners
     runs-on: ubuntu-22.04
     strategy:
@@ -82,26 +102,6 @@ jobs:
           echo -n "$FIREBASE_APP_DISTRIBUTION_CREDENTIALS" > $FIREBASE_CREDENTIALS_PATH
           ./gradlew appDistributionUploadRelease uploadCrashlyticsSymbolFileRelease
 
-  update-release-draft:
-    name: update-release-draft
-    needs: build_release
-    runs-on: ubuntu-22.04
-    env:
-      # mark:next-android-version
-      RELEASE_NAME: android-client-1.4.2
-    steps:
-      - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
-        if: "${{ github.event_name == 'workflow_dispatch' && github.ref_name == 'main' }}"
-        id: update-release-draft
-        with:
-          config-name: release-drafter-android-client.yml
-          tag: ${{ env.RELEASE_NAME }}
-          version: ${{ env.RELEASE_NAME }}
-          name: ${{ env.RELEASE_NAME }}
-          commitish: ${{ github.sha }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
   build_debug:
     # Android SDK tools hardware accel is available only on Linux runners
     runs-on: ubuntu-22.04

.github/workflows/_swift.yml

@@ -4,8 +4,28 @@ on:
   workflow_dispatch:
 
 jobs:
+  update-release-draft:
+    name: update-release-draft
+    runs-on: ubuntu-22.04
+    env:
+      # mark:next-apple-version
+      RELEASE_NAME: macos-client-1.4.2
+    steps:
+      - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
+        if: "${{ github.event_name == 'workflow_dispatch' && github.ref_name == 'main' }}"
+        id: update-release-draft
+        with:
+          config-name: release-drafter-macos-client.yml
+          tag: ${{ env.RELEASE_NAME}}
+          version: ${{ env.RELEASE_NAME}}
+          name: ${{ env.RELEASE_NAME}}
+          commitish: ${{ github.sha }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   build:
     name: ${{ matrix.job_name }}
+    needs: update-release-draft
     runs-on: macos-15
     permissions:
       contents: write # for attaching the build artifacts to the release
@@ -104,23 +124,3 @@ jobs:
           # Swift benefits heavily from build cache, so aggressively write a new one
           # on each build on `main` and attempt to restore it in PR builds with broader restore-key.
           key: ${{ steps.cache.outputs.cache-primary-key }}
-
-  update-release-draft:
-    name: update-release-draft
-    needs: build
-    runs-on: ubuntu-22.04
-    env:
-      # mark:next-apple-version
-      RELEASE_NAME: macos-client-1.4.2
-    steps:
-      - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
-        if: "${{ github.event_name == 'workflow_dispatch' && github.ref_name == 'main' }}"
-        id: update-release-draft
-        with:
-          config-name: release-drafter-macos-client.yml
-          tag: ${{ env.RELEASE_NAME}}
-          version: ${{ env.RELEASE_NAME}}
-          name: ${{ env.RELEASE_NAME}}
-          commitish: ${{ github.sha }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/_tauri.yml

@@ -13,8 +13,28 @@ env:
   RUSTDOCFLAGS: "-D warnings"
 
 jobs:
+  update-release-draft:
+    name: update-release-draft
+    runs-on: ubuntu-22.04
+    env:
+      # mark:next-gui-version
+      RELEASE_NAME: gui-client-1.4.3
+    steps:
+      - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
+        if: "${{ github.event_name == 'workflow_dispatch' && github.ref_name == 'main' }}"
+        id: update-release-draft
+        with:
+          config-name: release-drafter-gui-client.yml
+          tag: ${{ env.RELEASE_NAME }}
+          version: ${{ env.RELEASE_NAME }}
+          name: ${{ env.RELEASE_NAME }}
+          commitish: ${{ github.sha }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   build-gui:
     name: build-gui-${{ matrix.runs-on }}
+    needs: update-release-draft
     runs-on: ${{ matrix.runs-on }}
     permissions:
       contents: write # for attaching the build artifacts to the release
@@ -124,23 +144,3 @@ jobs:
           TAG_NAME: gui-client-${{ env.FIREZONE_GUI_VERSION }}
         shell: bash
         run: ${{ env.UPLOAD_SCRIPT }}
-
-  update-release-draft:
-    name: update-release-draft
-    needs: build-gui
-    runs-on: ubuntu-22.04
-    env:
-      # mark:next-gui-version
-      RELEASE_NAME: gui-client-1.4.3
-    steps:
-      - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
-        if: "${{ github.event_name == 'workflow_dispatch' && github.ref_name == 'main' }}"
-        id: update-release-draft
-        with:
-          config-name: release-drafter-gui-client.yml
-          tag: ${{ env.RELEASE_NAME }}
-          version: ${{ env.RELEASE_NAME }}
-          name: ${{ env.RELEASE_NAME }}
-          commitish: ${{ github.sha }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}