Allow publishing a release without creating it on GitHub

.github/workflows/release.yaml

@@ -62,6 +62,14 @@ on:
         required: false
         default: false
         type: boolean
+      create-github-release:
+        description: >-
+          Create the GitHub release. Set to false to commit, tag and push only,
+          leaving the release to be created separately - for example in another
+          repository, or only once downstream builds have proven the tag good.
+        required: false
+        default: true
+        type: boolean
       publish-no-latest-on-non-main:
         description: "Pass --no-latest on non-main branch releases"
         required: false
@@ -387,6 +395,9 @@ jobs:
           if [ "$IS_LATEST" != "true" ] && { [ "$BRANCH" = "main" ] || [ "$NO_LATEST_NON_MAIN" = "true" ]; }; then
             PUBLISH_ARGS+=(--no-latest)
           fi
+          if [ "$CREATE_GITHUB_RELEASE" != "true" ]; then
+            PUBLISH_ARGS+=(--no-github-release)
+          fi
           tenzir-ship --root "$CHANGELOG_ROOT" release publish "$RELEASE_VERSION" "${PUBLISH_ARGS[@]}"
         env:
           BRANCH: ${{ steps.release-type.outputs.branch }}
@@ -395,6 +406,7 @@ jobs:
           RELEASE_VERSION: ${{ steps.create-release.outputs.version }}
           IS_LATEST: ${{ steps.determine-latest.outputs.is_latest }}
           NO_LATEST_NON_MAIN: ${{ inputs.publish-no-latest-on-non-main }}
+          CREATE_GITHUB_RELEASE: ${{ inputs.create-github-release }}
           GH_TOKEN: ${{ steps.auth-token.outputs.token }}
 
       - name: Copy release to main branch (non-main release)

changelog/unreleased/confirm-release-publishing-before-mutating-anything.md

@@ -0,0 +1,11 @@
+---
+title: Confirm release publishing before mutating anything
+type: bugfix
+authors:
+  - claude
+prs:
+  - 41
+created: 2026-08-04T08:47:24.381906Z
+---
+
+`release publish` asked for confirmation only after the commit, tag, and both pushes had already reached the remote, so declining could not undo them. The prompt now appears before the first mutation and lists every step it is about to run.

changelog/unreleased/publish-a-release-without-creating-it-on-github.md

@@ -0,0 +1,18 @@
+---
+title: Publish a release without creating it on GitHub
+type: feature
+authors:
+  - claude
+  - codex
+prs:
+  - 41
+created: 2026-08-04T08:30:19.785303Z
+---
+
+The new `--no-github-release` flag on `release publish` pushes the release tag without creating a GitHub release:
+
+```sh
+tenzir-ship release publish --commit --tag --no-github-release --yes
+```
+
+The flag requires `--tag`, so the command cannot report success without publishing either a tag or a GitHub release. The reusable workflow exposes the same choice as `create-github-release: false`. Use it when the release belongs in a different repository than the push target, or when it should appear only after downstream builds have proven the tag releasable. The `gh` CLI is not required when release creation is skipped.

skills/tenzir-ship/references/create-local-release.md

@@ -142,6 +142,8 @@ Publishing a release via `tenzir-ship` performs the following steps:
 3. Push to git remote
 4. Create a release via the GitHub API
 
+Step 4 is optional; see the note on `--no-github-release` below.
+
 ### Procedure
 
 Inspect the current git changes and stage the exact set you want in the release
@@ -167,3 +169,13 @@ Notes:
   version as prerelease.
 - Add `--no-latest` if the user requested that a stable release must not be
   marked as latest.
+- Add `--no-github-release` together with `--tag` to stop after step 3, leaving
+  the GitHub release to be created separately. The command rejects
+  `--no-github-release` without `--tag` because no publish step would remain.
+  Use it only when the user asks for it, or when the project's release procedure
+  defers release creation - for example when the
+  release belongs in a different repository than the one being pushed to, or
+  when it must appear only after downstream builds have proven the tag
+  releasable. Never add it on your own initiative: a release the user expected
+  is then missing. Conversely, do not omit it when the procedure calls for it,
+  or you publish a release the user intended to defer.

skills/tenzir-ship/references/create-remote-release.md

@@ -103,4 +103,8 @@ Wait briefly for the run to register, find its ID, then watch it.
 Verify:
 
 - If the run succeeds, report the GitHub release URL.
+- A project whose workflow passes `create-github-release: false` to the
+  reusable workflow stops after pushing the tag, so no release exists to link.
+  Report the tag and the run URL instead of treating the missing release as a
+  failure.
 - If it fails, report the run URL so the user can inspect the logs.

src/tenzir_ship/api.py

@@ -176,10 +176,13 @@ def release_publish(
         commit_message: str | None = None,
         assume_yes: bool = False,
         title: str | None = None,
+        create_github_release: bool = True,
     ) -> None:
-        """Publish a release to GitHub using the same workflow as the CLI.
+        """Publish a release using the same workflow as the CLI.
 
-        If no version is provided, defaults to the latest release.
+        If no version is provided, defaults to the latest release. Set
+        ``create_github_release=False`` together with ``create_tag=True`` to
+        push the release tag without creating a GitHub release.
         """
 
         resolved_version = version
@@ -200,6 +203,7 @@ def release_publish(
             commit_message=commit_message,
             assume_yes=assume_yes,
             github_title_format=title,
+            create_github_release=create_github_release,
         )
 
     def validate(self, *, lenient: bool = False) -> None: