[johnsca]

ENG-9233

what

• Adds .github/workflows/release.yml, a dispatch caller for cut-release.yml
  in stacklet/github-tooling, pinned to a commit on
  that repository's main.
• Points both README examples at the Terraform Registry address rather than a
  GitHub URL with a commit ref, and adds a Versioning section. The migration
  note now tells the reader to move source and set version rather than to
  update a SHA.
• The bump dropdown opens on (choose one) rather than defaulting to
  patch, matching fix: make the release dispatch ask which bump it wants (ENG-9233) github-tooling#5. A dispatch has to say which
  bump it wants.

why

• This repository has no release workflow and no tags, so callers pin a raw
  commit and there is no version to read notes against.
• Five module repositories need the same workflow, and the sixth already had
  it. Calling one copy beats keeping six in step. The guards are the part worth
  sharing, because a published release is immutable and a slip cannot be taken
  back.

testing

• just lint passes.
• uvx zizmor@1.23.1 -v --gh-token=... .github/workflows/ reports no
  findings, with the five online audits scheduled rather than skipped.
• The pin resolves to a commit via
  gh api repos/stacklet/github-tooling/commits/<sha>.
• After merge, dispatch Release on main with dry run checked and confirm
  the summary reports v0.0.0 as previous and v0.1.0 as new.
• Dispatch Release with a minor bump and confirm v0.1.0 publishes.
  This is the first run anywhere to open a repository on a minor, so it is
  where the dropdown change gets exercised for real.
• Publish the module to the registry, since the README now sends readers to
  an address that holds nothing yet.

docs

The README gains a Versioning section naming the registry address this module
publishes to, with the patch-level constraint a 0.x line calls for. The
example now pins 0.1.0.

[cubic-dev-ai]

All reported issues were addressed across 2 files

Architecture diagram

sequenceDiagram
    participant Dev as Release Engineer
    participant GH as GitHub Actions
    participant Caller as release.yml (Caller)
    participant Shared as cut-release.yml (Shared)
    participant SCS as Step Security Action
    participant Sec as Step Security API
    participant Reg as Terraform Registry
    participant Users as Module Consumers

    Note over Dev,Users: Release Orchestration via Shared Workflow

    Dev->>GH: Trigger workflow_dispatch (bump, dry_run)
    GH->>Caller: Start release job
    Caller->>Caller: Enforce concurrency (one release at a time)

    Caller->>Shared: Call reusable workflow (pinned commit)
    Shared->>Shared: Load STEP_SECURITY_API_KEY
    Shared->>SCS: Run step-security/harden-runner
    SCS->>Sec: Audit workflow actions
    Sec-->>SCS: Security audit result
    SCS-->>Shared: Audit outcome

    alt dry_run = true
        Shared->>Shared: Calculate next version (v0.0.0 -> v1.0.0)
        Shared-->>Caller: Report planned version, stop
        Caller-->>GH: Dry run summary
    else dry_run = false
        Shared->>Shared: Calculate next version (e.g., v1.0.0 -> v1.1.0)
        Shared->>Shared: Create git tag & release notes
        Shared->>Shared: Publish release (write permissions)
        Shared-->>Reg: Publish module artifact
        Reg-->>Shared: Publication confirmation
        Shared-->>Caller: Release complete
        Caller-->>GH: Workflow success
    end

    Note over Users,Reg: Consumer Adoption of Registry Versioning

    Users->>Reg: Fetch module with version constraint (e.g., ~> 1.0)
    Reg-->>Users: Module source code
    Users->>Users: Resolve compatible version

Loading

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[jtroup]

Thanks @johnsca