fix(skills/drafting-a-release): correct --target SHA form and the publish confirmation flow

[sourcehawk]

Description

Two defects in drafting-a-release that surface at the publish step, both hit in a real release run.

First, gh release create --target <short-sha> fails: GitHub's release API rejects an abbreviated target_commitish and reports it as tag_name is not a valid tag / Release.target_commitish is invalid — a tag-shaped error that is really the short SHA. The skill echoed the short SHA for human confirmation and left the --target form unspecified, so an agent could pass that short SHA straight to the flag and hit the rejection. Second, the skill asked for a redundant final confirmation even after the user had already chosen published-vs-draft against an already-shown body, because step 6 (draft or published?) and step 7 (confirmation gate) were written as two separate prompts.

Changes

• State that --target takes a branch name or the full 40-char SHA (git rev-parse), never the abbreviated form — at the point of use, and in the anti-pattern and red-flag lists.
• Merge the draft-vs-published question and the confirmation gate into a single publish gate: the publish-mode choice, made against the body shown in step 5, IS the explicit consent to create. No second "Confirm?" prompt on top of it.
• Keep the guard against inferred/stale consent intact — a start-of-task "cut a release" still isn't approval, and the body must have been shown in full first.

Testing

Developed through superpowers:writing-skills (RED → GREEN → REFACTOR). RED: isolated subagents given only the current skill text reproduced both defects — one literally concluded it must post a second confirmation after the user selected "Published", and the short-SHA target was confirmed underspecified against the real failing run. GREEN: the same scenarios against the edited skill flip — full SHA emitted for --target, and the agent runs gh release create immediately on the publish-mode selection. REFACTOR: a loophole probe (user says "publish it live, go" before any body exists) confirmed the agent still refuses and drafts/shows the body first. The two .claude-plugin JSON files still parse; no project-specific identifiers introduced.

[Copilot]

Pull request overview

This PR updates the drafting-a-release skill to prevent two real-world failures at publish time: (1) using an abbreviated commit SHA with gh release create --target (rejected by GitHub’s API), and (2) prompting for redundant “final confirmation” after the user already selected draft vs published.

Changes:

• Clarifies that --target must be a branch name or a full 40-character commit SHA (via git rev-parse), never an abbreviated SHA.
• Merges the draft-vs-published choice and the final confirmation into a single publish gate where the mode choice is the explicit consent to create.
• Reinforces the “no inferred consent” rule, while ensuring the body is shown in full before the publish gate.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.