[johnsca]

ENG-9233

what

• Replaces the release workflow with a dispatch caller for cut-release.yml in
  stacklet/github-tooling, pinned to a commit on
  that repository's main. The workflow there is this one, lifted.
• Points both README examples at the Terraform Registry address rather than a
  GitHub URL with a tag ref, rewrites the Versioning section around version
  constraints, and updates the migration note to match.
• The bump dropdown opens on (choose one) rather than defaulting to
  patch, matching fix: make the release dispatch ask which bump it wants (ENG-9233) github-tooling#5. A dispatch has to say which
  bump it wants.

why

• This repository held the only copy of the workflow. The other five module
  repositories need it, and copying it five more times leaves six sets of the
  same guards to keep in step.
• The guards are the part worth sharing, because a published release is
  immutable and a slip cannot be taken back.
• The lifted copy is not identical. It takes bump as a string and rejects
  anything but patch, minor, or major, compares against the caller's default
  branch rather than the literal main, hardens the runner on the job that
  runs a third-party action, and claims the tag before publishing the release
  rather than letting gh release create make it. The PR on github-tooling
  covers each.

testing

• just lint passes.
• uvx zizmor@1.23.1 -v --gh-token=... .github/workflows/ reports no
  findings, with the five online audits scheduled rather than skipped.
• The pin resolves to a commit via
  gh api repos/stacklet/github-tooling/commits/<sha>.
• After merge, dispatch Release on main with dry run checked and confirm
  the summary reports v1.0.0 as previous and v1.0.1 as new. That shows
  the shared workflow reads this repository's tag history the way the copy
  it replaces did.
• Publish the module to the registry, since the README now sends readers to
  an address that holds nothing yet.

docs

The README Versioning section drops the note about immutable tags and explains
version constraints instead, because the registry address is what callers now
set. The migration note no longer tells the reader to update a tag ref.

[cubic-dev-ai]

All reported issues were addressed across 2 files

Architecture diagram

sequenceDiagram
    participant User as Release Engineer
    participant GHA as GitHub Actions
    participant Dispatch as Dispatch Caller Workflow (release.yml)
    participant SharedWF as Shared cut-release.yml (stacklet/github-tooling)
    participant GHAPI as GitHub API
    participant StepSecurity as Step Security API

    Note over User,SharedWF: NEW: Release flow now delegates to shared workflow
    
    User->>GHA: Dispatch release workflow with inputs (bump, dry_run)
    GHA->>Dispatch: Trigger workflow_dispatch
    Dispatch->>Dispatch: Enforce concurrency (one release at a time)
    Dispatch->>SharedWF: Call reusable workflow (pinned to commit 6fa4d7c)
    Dispatch-->>SharedWF: Pass inputs (bump, dry_run)
    Dispatch-->>SharedWF: Pass STEP_SECURITY_API_KEY secret

    alt Shared workflow version job
        SharedWF->>SharedWF: Read-only job (contents: read)
        SharedWF->>SharedWF: Validate bump input (patch|minor|major)
        SharedWF->>GHAPI: Checkout repo (fetch-depth: 0)
        GHAPI-->>SharedWF: Tag history
        SharedWF->>SharedWF: Derive next version from tags
        SharedWF->>SharedWF: Calculate new tag & changelog
        SharedWF-->>GHA: Output new_tag + changelog
    end

    Note over SharedWF,StepSecurity: Publish job (contents: write)
    alt Not dry run AND previous job succeeded
        SharedWF->>SharedWF: Verify first release is major (if no tags)
        SharedWF->>SharedWF: Enforce main branch (caller's default branch)
        SharedWF->>SharedWF: Refuse re-runs (run_attempt check)
        SharedWF->>StepSecurity: Run third-party release helper
        Note over SharedWF,StepSecurity: API key passed from caller
        
        alt Dry run enabled
            SharedWF-->>GHA: Report dry-run summary only
        else Publishing release
            SharedWF->>SharedWF: Claim tag before release
            SharedWF->>GHAPI: Check tag doesn't exist (matching-refs)
            alt Tag already exists
                SharedWF-->>GHA: Fail closed - refuse to overwrite
            else Tag available
                SharedWF->>SharedWF: Create release via gh CLI
                SharedWF-->>GHA: Release published with new tag
            end
        end
    else Dry run
        SharedWF-->>GHA: Skip publish job entirely
    end

    GHA-->>User: Report workflow completion status

Loading

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[jtroup]

Thanks @johnsca