release-plugin.yml

name: "Release: Plugin"

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (e.g. v0.1.0)'
        required: true
      dry_run:
        description: 'Push to staging only, skip promotion and release'
        type: boolean
        default: false

jobs:
  validate:
    name: Validate
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.validate.outputs.version }}
      short_sha: ${{ steps.validate.outputs.short_sha }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-tags: true

      - name: Validate inputs
        id: validate
        run: |
          VERSION="${{ inputs.version }}"

          if ! echo "$VERSION" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'; then
            echo "::error::Invalid version format: $VERSION (expected vX.Y.Z or vX.Y.Z-prerelease)"
            exit 1
          fi

          TAG="plugin/$VERSION"
          if git rev-parse "refs/tags/$TAG" >/dev/null 2>&1; then
            echo "::error::Tag $TAG already exists"
            exit 1
          fi

          if [ "${{ inputs.dry_run }}" != "true" ]; then
            BRANCH=$(git rev-parse --abbrev-ref HEAD)
            if [ "$BRANCH" != "main" ]; then
              echo "::error::Release must be from main branch (currently on $BRANCH). Use dry_run for testing from other branches."
              exit 1
            fi
          fi

          SHORT_SHA=$(git rev-parse --short HEAD)

          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "short_sha=$SHORT_SHA" >> "$GITHUB_OUTPUT"

          echo "## Plugin release validation passed" >> "$GITHUB_STEP_SUMMARY"
          echo "- Version: $VERSION" >> "$GITHUB_STEP_SUMMARY"
          echo "- Tag: $TAG" >> "$GITHUB_STEP_SUMMARY"
          echo "- SHA: $SHORT_SHA" >> "$GITHUB_STEP_SUMMARY"
          echo "- Dry run: ${{ inputs.dry_run }}" >> "$GITHUB_STEP_SUMMARY"

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - uses: golangci/golangci-lint-action@v7
        with:
          version: v2.4.0

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - run: make test

  stage-image:
    name: Stage image
    needs: [validate, lint, test]
    uses: ./.github/workflows/release-stage-plugin-image.yml
    with:
      version: ${{ inputs.version }}
      short_sha: ${{ needs.validate.outputs.short_sha }}
    permissions:
      contents: read
      packages: write

  promote-image:
    name: Promote image
    needs: [stage-image]
    if: inputs.dry_run == false
    uses: ./.github/workflows/release-promote-plugin-image.yml
    with:
      version: ${{ inputs.version }}
      short_sha: ${{ needs.stage-image.outputs.short_sha }}
    permissions:
      contents: read
      packages: write

  release:
    name: Create release
    needs: [promote-image]
    if: inputs.dry_run == false
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Create tag
        run: |
          git tag plugin/${{ inputs.version }}
          git push origin plugin/${{ inputs.version }}

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: plugin/${{ inputs.version }}
          name: "aws-plugin ${{ inputs.version }}"
          generate_release_notes: true