[ccf-lisa]

Why

The template never releases itself (release: false in the manifest), but every new plugin repo copies its workflow files. So it now carries the same release callers as a real plugin (as in plugin-github-repositories#26), with the release jobs skipped while the repo is a template.

Default branch: main. Every push: branches: trigger here uses [main].

What changes

• release-please-config.json: the shared defaults from workflows release-please/defaults.json at v1.5.2 (no drift), with packages: {".": {"release-type": "go"}}. Same as mock-plugin-1.
• .release-please-manifest.json: {".": "0.0.0"} and no bootstrap-sha. The template has no releases, and a SHA from its history would not exist in a repo created from it.
• New callers, all pinned to workflows v1.5.2 (6e7fc9c):
  • release-please.yml (push to main);
  • release.yml (release: published, protocol-version: "2");
  • preview.yml (kind: go-plugin, on-main: false, so only the preview label publishes :pr-<n>);
  • cut-prerelease.yml (workflow_dispatch, rc tags vX.Y.Z-rcN).
• Template guard. The jobs in release-please.yml, release.yml and cut-prerelease.yml have if: ${{ !github.event.repository.is_template }}, with a one-line comment above it saying why. They are skipped here and run in a repo created from the template (a new repo is not a template). preview.yml and ci.yml have no guard.
• ci.yml: pins moved from v1.5.1 to v1.5.2. It already calls release-checks.yml. Nothing else changed.
• .goreleaser.yaml: adds release: {prerelease: auto, replace_existing_artifacts: true}. The shared job refuses to run without prerelease: auto and warns without replace_existing_artifacts. Builds (binary: plugin, linux and darwin) and archives are unchanged.
• README.md: a short "Releasing" section for repos created from the template. It covers release-please PRs and the cut-prerelease workflow, and says to set .release-please-manifest.json to the current version if the repo already has releases.

Deleted

• .github/workflows/build-and-upload.yml: a reusable job that ran goreleaser and uploaded dist/ with gooci to :<tag> and :latest.
• .github/workflows/release.yml (old content, replaced by the new caller of the same name): on any tag push, it called build-and-upload.yml.

Published artifacts: old vs new (for repos created from the template)

The template itself has never published a release, so there is nothing of its own to compare. For a repo created from it:

	Old (tag push)	New (release: published)
Trigger	push of any tag (*)	GitHub release published by release-please or cut-prerelease (tags vX.Y.Z / vX.Y.Z-rcN)
GitHub release	created by goreleaser from the tag	created by release-please; goreleaser attaches the archives
Release assets	5 archives + checksums	same names and contents (builds and archives config unchanged; snapshot below)
OCI tags	:<tag> and :latest	:vX.Y.Z, plus :latest only for a final tag
rc handling	latest was gated on github.event.release.prerelease, which is empty on a tag push, so an rc also moved latest	an rc publishes only :vX.Y.Z-rcN; latest is untouched
latest digest	a second, separate upload	crane tag points latest at the vX.Y.Z manifest: one digest
Upload	gooci upload dist/ … --annotate="org.ccf.plugin.protocol.version=2"	same command and annotation
Tool versions	goreleaser ~> v2, gooci @latest	goreleaser v2.18.2, gooci v0.0.7, crane v0.20.7

These match the known batch-1 differences. The latest index's org.opencontainers.image.ref.name / version annotations will read vX.Y.Z, because latest is now the same manifest.

Verified locally

• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12: clean.
• go build ./... and go test ./...: pass.
• goreleaser check and goreleaser release --snapshot --clean (v2.16.0): dist/ has plugin-template_{Darwin_arm64,Darwin_x86_64,Linux_arm64,Linux_i386,Linux_x86_64}.tar.gz (each with LICENSE, README.md, plugin) and a checksums file. The go mod tidy hook left the tree clean.
• release-please-config.json compared with workflows release-please/defaults.json at v1.5.2: no differing keys.

Open questions for reviewers

• The guard depends on github.event.repository.is_template being in the push, release and workflow_dispatch payloads (it is part of the repository object). If it were missing, !null is true and the job would run here and fail on the missing release environment secrets. It can only be checked after merge: the first release-please run on main here should show its job as skipped.

This PR stays open until the batch's repo settings are applied, per the batch order.

Task: W3-S2-T01 (local-dev/docs/release-automation/workstream-3-plugins-in-train.md)

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 0ef60210-a5e7-4187-a165-9a6f70054fb0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gusfcarvalho]

Checked: release-please seed, shared release callers pinned to workflows v1.5.2, ci / required green. Batch 1 repo settings are applied.