chore: release-please and shared release workflows

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ permissions: {}
 
 jobs:
   ci:
-    uses: compliance-framework/workflows/.github/workflows/ci-go-plugin.yml@7b55019ed36050a57eb8273f6a67fd4b2395adb0 # v1.5.1
+    uses: compliance-framework/workflows/.github/workflows/ci-go-plugin.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
     permissions:
       actions: read
       contents: read
@@ -21,14 +21,14 @@ jobs:
     secrets: inherit
 
   release-checks:
-    uses: compliance-framework/workflows/.github/workflows/release-checks.yml@7b55019ed36050a57eb8273f6a67fd4b2395adb0 # v1.5.1
+    uses: compliance-framework/workflows/.github/workflows/release-checks.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
     permissions:
       contents: read
 
   notify:
     needs: [ci, release-checks]
     if: always()
-    uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@7b55019ed36050a57eb8273f6a67fd4b2395adb0 # v1.5.1
+    uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
     with:
       needs: ${{ toJSON(needs) }}
     permissions:

.github/workflows/cut-prerelease.yml

@@ -0,0 +1,13 @@
+name: cut-prerelease
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  cut:
+    # Skipped while this is a template repo (plugin-template never releases); runs in repos created from it.
+    if: ${{ !github.event.repository.is_template }}
+    uses: compliance-framework/workflows/.github/workflows/cut-prerelease.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
+    permissions:
+      contents: read
+    secrets: inherit

.github/workflows/preview.yml

@@ -0,0 +1,26 @@
+# Publishes :pr-<number> previews for PRs labelled `preview` (no :main previews for plugins).
+name: preview
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+
+permissions:
+  contents: read
+
+concurrency:
+  # A merged PR's events carry the base branch as github.ref, so key PR runs by number.
+  group: preview-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  preview:
+    uses: compliance-framework/workflows/.github/workflows/preview.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
+    with:
+      kind: go-plugin
+      on-main: false
+    permissions:
+      contents: read
+      packages: write

.github/workflows/release-please.yml

@@ -0,0 +1,21 @@
+# Opens/updates the release PR and, once it merges, tags and publishes the release.
+name: release-please
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-please
+
+jobs:
+  release-please:
+    # Skipped while this is a template repo (plugin-template never releases); runs in repos created from it.
+    if: ${{ !github.event.repository.is_template }}
+    uses: compliance-framework/workflows/.github/workflows/release-please.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
+    permissions:
+      contents: read
+    secrets: inherit

.github/workflows/release.yml

@@ -1,13 +1,21 @@
-name: New Release
+# Publishes the plugin (goreleaser archives + gooci upload) when a release is published.
+name: release
 
 on:
-  push:
-    tags:
-      - '*'
+  release:
+    types: [published]
+
+permissions:
+  contents: read
 
 jobs:
   release:
+    # Skipped while this is a template repo (plugin-template never releases); runs in repos created from it.
+    if: ${{ !github.event.repository.is_template }}
+    uses: compliance-framework/workflows/.github/workflows/release-go-plugin.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
+    with:
+      protocol-version: "2"
     permissions:
+      contents: write # goreleaser attaches the archives to the release
       packages: write
-      contents: write
-    uses: ./.github/workflows/build-and-upload.yml
+    secrets: inherit

.goreleaser.yaml

@@ -34,6 +34,10 @@ archives:
       {{- else }}{{ .Arch }}{{ end }}
       {{- if .Arm }}v{{ .Arm }}{{ end }}
 
+release:
+  prerelease: auto
+  replace_existing_artifacts: true
+
 changelog:
   sort: asc
   filters:

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.0.0"
+}

README.md

@@ -16,6 +16,16 @@ Once you are ready to serve the plugin, you need to build the binaries which can
 goreleaser release --snapshot --clean
 ```
 
+## Releasing
+
+For a repo created from this template:
+
+* Releases come from release-please PRs: merging one tags `vX.Y.Z` and publishes the plugin.
+* Release candidates (`vX.Y.Z-rcN`) come from the `cut-prerelease` workflow.
+* If the repo already has releases, set `.release-please-manifest.json` to its current version first.
+
+The release workflows are skipped in this template repo itself.
+
 ## Usage
 
 You can use this plugin by passing it to the compliance agent or by specifying it in the agent config

release-please-config.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "bump-minor-pre-major": true,
+  "initial-version": "0.1.0",
+  "changelog-sections": [
+    { "type": "feat", "section": "Features" },
+    { "type": "fix", "section": "Bug Fixes" },
+    { "type": "perf", "section": "Performance Improvements" },
+    { "type": "revert", "section": "Reverts" },
+    { "type": "deps", "section": "Dependencies" },
+    { "type": "chore", "section": "Miscellaneous Chores", "hidden": true },
+    { "type": "ci", "section": "Continuous Integration", "hidden": true },
+    { "type": "docs", "section": "Documentation", "hidden": true },
+    { "type": "test", "section": "Tests", "hidden": true },
+    { "type": "refactor", "section": "Code Refactoring", "hidden": true },
+    { "type": "build", "section": "Build System", "hidden": true }
+  ],
+  "packages": {
+    ".": { "release-type": "go" }
+  }
+}