ci: create source-only draft release upstream while keeping builds gated (#3899)

With PUBLISH_RELEASE unset (upstream AionUi), stable tag pushes now still
create a draft GitHub Release (auto release notes, no installer assets)
after code quality passes, while build-pipeline and pack-web-cli stay
skipped. With PUBLISH_RELEASE=true (downstream signed build) behavior is
unchanged: builds must succeed and installers are attached. Artifact
download/prepare steps are gated so the assetless path cannot fail.

Co-authored-by: zk <zk@users.noreply.local>

Author: kaizhou-lab

.github/workflows/build-and-release.yml

@@ -251,12 +251,14 @@ jobs:
           GH_TOKEN: ${{ secrets.GH_TOKEN }}
 
   # 发布到 GitHub Releases
+  # PUBLISH_RELEASE 未设置（上游 AionUi）：跳过构建，但正式 tag 仍创建纯源码 draft Release；
+  # PUBLISH_RELEASE=true（下游签名构建）：与之前一致，要求构建成功并附带安装包。
   release:
     name: Create Release
     runs-on: ubuntu-latest
-    needs: [build-pipeline, create-tag, pack-web-cli]
+    needs: [code-quality, build-pipeline, create-tag, pack-web-cli]
     # Tag 推送时 create-tag 会被跳过，所以需要检查两种情况（排除 -dev- tag 避免重复）
-    if: always() && vars.PUBLISH_RELEASE == 'true' && needs.build-pipeline.result == 'success' && needs.pack-web-cli.result == 'success' && (needs.create-tag.result == 'success' || (startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-dev-')))
+    if: always() && needs.code-quality.result == 'success' && (needs.create-tag.result == 'success' || (startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-dev-'))) && (vars.PUBLISH_RELEASE != 'true' || (needs.build-pipeline.result == 'success' && needs.pack-web-cli.result == 'success'))
     # dev 分支使用 dev-release 环境，正式 tag 使用 release 环境
     environment: ${{ needs.create-tag.outputs.is_dev == 'true' && 'dev-release' || 'release' }}
 
@@ -283,12 +285,15 @@ jobs:
           echo "tag_name=$TAG_NAME" >> $GITHUB_OUTPUT
           echo "is_dev=$IS_DEV" >> $GITHUB_OUTPUT
 
+      # 仅下游签名构建有安装包产物；上游 AionUi 发布纯源码 Release，无产物可下载
       - name: Download all build artifacts
+        if: vars.PUBLISH_RELEASE == 'true'
         uses: actions/download-artifact@v7
         with:
           path: build-artifacts
 
       - name: Prepare release assets (normalize updater metadata)
+        if: vars.PUBLISH_RELEASE == 'true'
         shell: bash
         run: bash scripts/prepare-release-assets.sh build-artifacts release-assets