[Tooling] Upload CDN builds as internal first, publish as external later

[iangmaia]

Related issues

• Fixes AINFRA-2102

Proposed Changes

• Upload all CDN build artifacts with visibility: internal (Automatticians-only) during finalize_release / distribute_release_build, instead of external
• Embed CDN post IDs as an HTML comment in the draft GitHub release body so they can be retrieved later
• In publish_release, read the draft release body, extract post IDs, and call update_apps_cdn_build_metadata for each build to flip visibility to external before publishing the GitHub release
• This gives the team a window for internal testing between finalize and publish

Depends on: wordpress-mobile/release-toolkit PR for the new update_apps_cdn_build_metadata action.

Testing Instructions

• The update_apps_cdn_build_metadata action needs to be manually verified against the WPCOM API first (see release-toolkit PR)
• Once confirmed, test by running a release through the full flow:
  1. finalize_release → verify builds appear on CDN with Internal visibility
  2. publish_release → verify builds are updated to External visibility and GitHub release is published

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR changes the release tooling flow so release build artifacts are uploaded to the Apps CDN as Internal first, then flipped to External during publish_release, enabling an internal testing window between finalize and publish.

Changes:

• Uploads Apps CDN artifacts with visibility: internal during distribute_builds.
• Stores CDN post IDs in the draft GitHub release body as an HTML comment for later retrieval.
• Adds a publish_release step to read those IDs and update CDN visibility to External before publishing the GitHub release.

Comments suppressed due to low confidence (1)

fastlane/Fastfile:665

• In dry-run mode this returns post_id: 0, which is truthy and could be mistaken for a real post ID if reused elsewhere. Returning nil (or omitting post_id) would better reflect “unknown / not created”.

    return {
      media_url: media_url,
      post_id: 0
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[iangmaia]

PR superseded by #2695