From c2fd8886f3075da10970c73dca34478c26fe1ae9 Mon Sep 17 00:00:00 2001
From: "John M. Kuchta" <git@chir.us>
Date: Wed, 10 Jun 2026 13:34:49 -0700
Subject: [PATCH] ci: sync create-release.yml to main (idempotency guard,
 app-token@v3)

httpx's copy lagged main: missing the 'release already exists'
short-circuit and pinned create-github-app-token@v2. Sync to main's
exact content so a workflow_dispatch against httpx runs identical
release logic. The httpx-prerelease guard and httpx trigger entry are
preserved (main carries them too). File-level sync only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/create-release.yml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 0b508b44..26c511b1 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -29,7 +29,7 @@ jobs:
 
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.RELEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
@@ -46,7 +46,21 @@ jobs:
             echo "prerelease=false" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Check if release already exists
+        id: check-release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          if gh release view "$VERSION" > /dev/null 2>&1; then
+            echo "Release $VERSION already exists, skipping."
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Validate version matches branch
+        if: steps.check-release.outputs.exists == 'false'
         run: |
           BRANCH="${{ inputs.branch || github.event.workflow_run.head_branch }}"
           VERSION="${{ steps.version.outputs.version }}"
@@ -74,6 +88,7 @@ jobs:
       # ruleset, so no git write happens in this workflow. --generate-notes
       # below produces the GitHub release body.
       - name: Create release
+        if: steps.check-release.outputs.exists == 'false'
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |