fix(tempoup): exclude draft releases from latest lookup

[decofe]

Excludes draft and prerelease entries from automatic version selection, then preflights the selected release and required platform assets before downloading. Adds regression coverage for draft, incomplete, and published releases.

Tested with bash -n tempoup/tempoup tempoup/test-tempoup.sh and tempoup/test-tempoup.sh; a live install selected published v1.13.1 while v1.13.2 remained draft.

cc @grandizzy

Prompted by: @brendanjryan

[grandizzy]

looks good, ty! the unauthenticated gh path could have the same issue but that requires additional changes, we are looking into porting tempoup to rust and have all these edge cases addressed as in https://github.com/foundry-rs/foundryup

[grandizzy]

cyclops audit fast

[tempoxyz-bot]

👁️ Cyclops Review

Summary

This change prevents authenticated gh users from automatically selecting draft or prerelease builds and adds an asset preflight with focused regression coverage. The hardening is useful, but the default unauthenticated path still has a verified high-severity release-integrity gap: it can select a newly created lower-version release and then skip independent signature verification based on that release-controlled version tag.

Findings

🚨 [SECURITY] Default install can execute an unsigned release through a lower-version tag

Severity: High
File: tempoup/tempoup:447-449,555-589
Summary: The unauthenticated release lookup accepts the first strict-looking tag returned by GitHub rather than the greatest semantic version. An attacker who can publish release assets can place a newly created lower-version tag such as v0.999.999 first, provide a malicious archive and matching checksum, and make version_gt "$VERSION_TAG" "1.1.2" enter the legacy branch that skips GPG verification. The installer subsequently executes the installed binary with --version, resulting in code execution without the Tempo signing key or an explicit --unsafe-skip-verify opt-out.
Recommended Fix: Require independent integrity verification for every automatically selected release. Remove the tag-based legacy bypass; if old unsigned artifacts must remain installable, require an explicit version together with --unsafe-skip-verify or verify immutable pinned hashes. Also parse strict SemVer, select the greatest version, and reject automatic downgrades.

Reviewer Callouts

Reviewer Callouts

• ⚡ Authenticated GitHub fallback (tempoup/tempoup:465-472): A token that passes gh auth status but cannot read releases makes the new preflight abort with a misleading “not found” error, even though anonymous downloads may work. Distinguish a proven missing release from permission/API failures and fall back to the public path for the latter.
• ⚡ GitHub CLI compatibility (tempoup/tempoup:440-444): Older gh versions may reject --exclude-drafts or --exclude-pre-releases; stderr is suppressed and latest-version lookup then fails generically. The JSON filter already enforces both conditions, so remove the flags or fall back to the REST lookup when the command fails.