workflows: replace softprops/action-gh-release with gh CLI (v24.13.0)

[harshita-gupta]

DO NOT MERGE until canary PR #20 (main) is validated

This is part of the rollout of the softprops → gh-CLI migration across all Asana/node branches. The canary PR on main (#20) must be merged and end-to-end validated first. Merging this PR before then risks landing a regression on a production release branch with no safety net.

Validation checklist to complete on main (#20) before touching this PR

• PR workflows: replace softprops/action-gh-release with gh CLI (main) #20 is merged into main.
• Manually trigger Build Node on main via workflow_dispatch. Both matrix arms (linux-x64, linux-arm64) succeed without a race failure on gh release create.
• The resulting release node-vX.Y.Z-release exists with title node-vX.Y.Z-LATEST, and both architecture archives appear as assets.
• Manually trigger Build Node-Packages on main. Assets appear; release title still correct.
• Manually trigger Build node-fibers with prebuilt Node on main. Assets appear; release title still correct.
• Manually trigger Build Node with options around OpenSSL dynamic linking and FIPS on main with appropriate BUILD_REF. Assets appear in the separate -fips-static-release release with the expected title. (Note: this branch has no FIPS workflow, but the FIPS migration on main exercises the same replacement-block shape.)
• Byte-identity spot-check: compare sha256sum of an asset uploaded post-migration on main against one uploaded pre-migration — should match.
• No release-body or commitish drift observed in any of the above.

Only after all of those pass — mark this PR ready for review and merge.

Summary

Supply-chain hardening: softprops/action-gh-release is a single-maintainer third-party action pinned to the mutable @v1 tag. Replacing it with the first-party gh CLI (pre-installed on GitHub-hosted runners, maintained by GitHub) removes that dependency from the release-upload path.

Migrates all three release-upload call-sites on v24.13.0:

• .github/workflows/build-node.yml
• .github/workflows/build-node-fibers.yml
• .github/workflows/build-node-packages.yml

(v24.13.0 has no build-node-openssl-fips.yml.)

After this PR: zero references to softprops/action-gh-release on v24.13.0.

Replacement shape

Each softprops step becomes:

- name: Upload <...> archive to release
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  run: |
    set -euo pipefail
    TAG="node-${NODE_VERSION}-release"
    RELEASE_NAME="node-${NODE_VERSION}-LATEST"
    FILE="<path-or-shell-expr>"
    if ! gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then
      gh release create "$TAG" --title "$RELEASE_NAME" --notes "" --repo "$REPO" \
        || gh release view "$TAG" --repo "$REPO" >/dev/null
    fi
    gh release upload "$TAG" "$FILE" --clobber --repo "$REPO"
    gh release edit "$TAG" --title "$RELEASE_NAME" --repo "$REPO"

Each job gains REPO: ${{ github.repository }} in its job-level env:.

Note on triggers

On v24.13.0, both build-node-fibers.yml and build-node-packages.yml fire on push to v24.13.0 (in addition to workflow_dispatch) — they are NOT chained off Build Node via workflow_run. That means each can land in this code path BEFORE build-node.yml has run for a given NODE_VERSION, so the view-or-create guard is genuinely necessary on every file (not just on build-node.yml). The comments in each file reflect that.

Divergence from main's post-migration shape

On main, build-node-packages.yml uses a simpler upload pattern (plain gh release upload --clobber, no view-or-create guard, no gh release edit --title), under the assumption it always runs downstream of build-node.yml (via workflow_run). On v24.13.0 that assumption doesn't hold (push trigger, not workflow_run), so the full pattern is the correct choice here — a simpler version would break standalone runs.

Behavior deltas vs. softprops/action-gh-release@v1

See PR #20 for the full delta table. Summary: 7 no-op deltas, 3 covered by the replacement block (view-or-create, clobber, edit-title), 1 stricter-beneficial (missing-file fails loudly), 1 supply-chain benefit (the point of this work).

Post-merge test plan for this branch

• Push to v24.13.0 (or workflow_dispatch) triggers all three workflows. Each succeeds.
• Assets appear in node-v24.13.0-release with title node-v24.13.0-LATEST.
• Spot-check asset sha256sum matches pre-migration.