From e3c635dbbff64d166d0abed98e02ff1671ad0385 Mon Sep 17 00:00:00 2001
From: Cory Johns <cory@stacklet.io>
Date: Mon, 19 Oct 2026 17:28:00 +0000
Subject: [PATCH] chore: cut releases through the shared workflow (ENG-9233)

[ENG-9233](https://stacklet.atlassian.net/browse/ENG-9233)

What
----

- Adds `.github/workflows/release.yml`, a dispatch caller for `cut-release.yml`
  in `stacklet/github-tooling`, pinned to a commit on
  that repository's main.
- Points the README example at the Terraform Registry address rather than the
  GitHub URL, and adds a Versioning section.
- The `bump` dropdown opens on `(choose one)` rather than defaulting to
  `patch`, matching stacklet/github-tooling#5. A dispatch has to say which
  bump it wants.

Why
----

- This repository has no release workflow and no tags, so there is no version a
  caller can pin to.
- Five module repositories need the same workflow, and the sixth already had
  it. Calling one copy beats keeping six in step. The guards are the part worth
  sharing, because a published release is immutable and a slip cannot be taken
  back.

Testing
----

- [x] `just lint` passes.
- [x] `uvx zizmor@1.23.1 -v --gh-token=... .github/workflows/` reports no
      findings, with the five online audits scheduled rather than skipped.
- [x] The pin resolves to a commit via
      `gh api repos/stacklet/github-tooling/commits/<sha>`.
- [ ] After merge, dispatch Release on `main` with dry run checked and confirm
      the summary reports `v0.0.0` as previous and `v0.1.0` as new.
- [ ] Dispatch Release with a `minor` bump and confirm `v0.1.0` publishes.
      This is the first run anywhere to open a repository on a minor, so it is
      where the dropdown change gets exercised for real.
- [ ] Publish the module to the registry, since the README now sends readers to
      an address that holds nothing yet.

Docs
----

The README gains a Versioning section naming the registry address this module
publishes to, with the patch-level constraint a 0.x line calls for. The
example now pins `0.1.0`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 42 +++++++++++++++++++++++++++++++++++
 README.md                     | 16 +++++++++++--
 2 files changed, 56 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..5d943eb
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,42 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: Which part of the version to raise.
+        required: true
+        type: choice
+        options:
+          - (choose one)
+          - patch
+          - minor
+          - major
+      dry_run:
+        description: Work out the next version and stop without publishing
+        required: false
+        type: boolean
+        default: false
+
+# Two runs would otherwise claim the same version. The second fails safely at
+# the release step, but serialising stops it happening at all.
+#
+# This belongs to the dispatched workflow rather than the called one, so every
+# caller carries it. Copy this file rather than writing one.
+concurrency: release
+
+permissions: {}
+
+jobs:
+  release:
+    uses: stacklet/github-tooling/.github/workflows/cut-release.yml@d5b3816baeac0706507e2119240fe0b793e1a1d3 # main
+    # The ceiling for the called workflow, not what each job gets. It narrows
+    # this to read for the job running the third-party action, and only its
+    # publish job keeps write.
+    permissions:
+      contents: write
+    secrets:
+      STEP_SECURITY_API_KEY: ${{ secrets.STEP_SECURITY_API_KEY }}
+    with:
+      bump: ${{ inputs.bump }}
+      dry_run: ${{ inputs.dry_run }}
diff --git a/README.md b/README.md
index 4569eb2..a4c7748 100644
--- a/README.md
+++ b/README.md
@@ -67,8 +67,20 @@ No modules.
 
 ```hcl
 module "cur-setup" {
-  source = "github.com/stacklet/terraform-aws-stacklet-cur-setup"
-  customer_prefix = ""
+  source  = "stacklet/stacklet-cur-setup/aws"
+  version = "0.1.0"
+
+  customer_prefix          = ""
   stacklet_saas_account_id = ""
 }
 ```
+
+## Versioning
+
+This module is published to the [Terraform Registry](https://registry.terraform.io/modules/stacklet/stacklet-cur-setup/aws).
+Set `source` to the registry address and pin `version` to a release.
+
+`version` takes the usual constraint syntax. This module is pre-1.0, and on a
+0.x line a minor release is where it ships breaking changes, so pin at the
+patch level: `~> 0.1.0` accepts `0.1.1` and later patches and holds at `0.2.0`.
+Read the release notes before moving to a new minor.