refactor: extract record-registry-api as separate job

Move registry API recording out of record-connector-registry into its
own job that depends on both legacy recording paths (dist + lambda).
This ensures the registry API recording has the full picture: assets,
images, config_schema, capabilities, documentation, and changelog.

The three recording jobs now have clear separation:
- record-connector-registry: legacy dist manifest + S3 upload
- record-lambda-registry: legacy per-connector Lambda invocation
- record-registry-api: new path, runs after both legacy jobs complete

Removed continue-on-error from the recording step — failures should
be visible since this is becoming the primary recording path.

Author: gontzess

.github/workflows/release.yaml

@@ -908,12 +908,12 @@ jobs:
           done < "$DIGEST_FILE"
 
   record-connector-registry:
-    # require binaries to succeed; windows, docker, and lambda recording may be skipped based on inputs
-    # each optional job must succeed if it ran — a failure means incomplete release artifacts
-    # waits for record-lambda-registry so the registry API recording has the full picture (config_schema, capabilities)
+    # Legacy dist recording: manifest + S3 upload.
+    # Require binaries to succeed; windows and docker may be skipped based on inputs.
+    # Each optional job must succeed if it ran — a failure means incomplete release artifacts.
     # see: https://docs.github.com/en/actions/using-jobs/using-conditions-to-control-job-execution
-    if: ${{ !cancelled() && needs.goreleaser-binaries.result == 'success' && (needs.goreleaser-windows.result == 'success' || needs.goreleaser-windows.result == 'skipped') && (needs.goreleaser-docker.result == 'success' || needs.goreleaser-docker.result == 'skipped') && (needs.record-lambda-registry.result == 'success' || needs.record-lambda-registry.result == 'skipped') }}
-    needs: [determine-workflows-ref, goreleaser-binaries, goreleaser-windows, goreleaser-docker, record-lambda-registry]
+    if: ${{ !cancelled() && needs.goreleaser-binaries.result == 'success' && (needs.goreleaser-windows.result == 'success' || needs.goreleaser-windows.result == 'skipped') && (needs.goreleaser-docker.result == 'success' || needs.goreleaser-docker.result == 'skipped') }}
+    needs: [determine-workflows-ref, goreleaser-binaries, goreleaser-windows, goreleaser-docker]
     permissions:
       id-token: write
       contents: read
@@ -1179,14 +1179,104 @@ jobs:
 
           rm -f "$TMPFILE"
 
-      # ================================================================
-      # Registry API: record release with GitHub OIDC auth
-      # During migration, this runs alongside Lambda invocation (dual-write).
-      # The Lambda path remains the source of truth until cutover.
-      # Rollout controlled by which release workflow version each connector uses.
-      # ================================================================
+  record-lambda-registry:
+    if: inputs.lambda == true
+    # Legacy per-connector Lambda invocation — records to connectorreleases DynamoDB.
+    # Only needs binaries + docker (container images). Does not gate on windows/msi since
+    # the Lambda pipeline only cares about container images. Will be removed after cutover
+    # to the registry API (record-connector-registry replaces this path).
+    needs: [goreleaser-binaries, goreleaser-docker]
+    permissions:
+      id-token: write
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Configure AWS credentials via OIDC
+        uses: aws-actions/configure-aws-credentials@v5
+        with:
+          role-to-assume: "arn:aws:iam::168442440833:role/GitHubActionsECRPushRole-${{ github.event.repository.name }}"
+          aws-region: us-west-2
+
+      - name: Invoke Lambda with retries
+        run: |
+          set +e    # Disable default fail-fast to support retries
+          if [[ "$ACTIONS_STEP_DEBUG" == "true" ]]; then
+            set -x  # Debug logging
+          fi
 
-      - name: Checkout connector repo (for docs)
+          TMPFILE=$(mktemp)
+          MAX_RETRIES=5
+          RETRY_DELAY=10  # seconds
+
+          for ((i=1; i<=MAX_RETRIES; i++)); do
+            echo "Attempt $i to invoke Lambda..."
+
+            RESPONSE=$(aws lambda invoke \
+              --function-name "${{ github.event.repository.name }}-releases" \
+              --payload "{\"tag\":\"${{ inputs.tag }}\"}" \
+              --cli-binary-format raw-in-base64-out \
+              "$TMPFILE" 2>&1)
+            EXIT_CODE=$?
+
+            echo "AWS CLI exited with code: $EXIT_CODE"
+            cat "$TMPFILE"
+
+            STATUS_CODE=$(jq -r '.statusCode' < "$TMPFILE" 2>/dev/null)
+
+            if [[ $EXIT_CODE -eq 0 && "$STATUS_CODE" == "200" ]]; then
+              echo "Lambda invoked successfully."
+              break
+
+            elif [[ "$RESPONSE" == *"CodeArtifactUserPendingException"* ]]; then
+              echo "Lambda not ready (CodeArtifactUserPendingException)."
+
+              if [[ $i -lt $MAX_RETRIES ]]; then
+                WAIT_TIME=$((i * RETRY_DELAY))
+                echo "Retrying in $WAIT_TIME seconds..."
+                sleep "$WAIT_TIME"
+              else
+                echo "Lambda still not ready after $MAX_RETRIES attempts."
+                rm -f "$TMPFILE"
+                exit 1
+              fi
+
+            else
+              echo "Lambda invoke failed with unexpected error: $RESPONSE"
+              rm -f "$TMPFILE"
+              exit 1
+            fi
+          done
+
+          rm -f "$TMPFILE"
+
+  # ================================================================
+  # Registry API: record release after all legacy recording completes.
+  # Depends on both dist (record-connector-registry) and lambda (record-lambda-registry)
+  # so the recording has the full picture: assets, images, config_schema, capabilities.
+  # continue-on-error on the recording step so failures don't block the release.
+  # Will become the sole recording path after cutover.
+  # ================================================================
+  record-registry-api:
+    if: ${{ !cancelled() && needs.record-connector-registry.result == 'success' && (needs.record-lambda-registry.result == 'success' || needs.record-lambda-registry.result == 'skipped') }}
+    needs: [determine-workflows-ref, goreleaser-binaries, goreleaser-windows, goreleaser-docker, record-connector-registry, record-lambda-registry]
+    permissions:
+      id-token: write
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout connector workflows
+        uses: actions/checkout@v5
+        with:
+          path: _workflows
+          repository: ConductorOne/github-workflows
+          ref: ${{ needs.determine-workflows-ref.outputs.ref }}
+
+      - name: Set up Go for workflows
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: "_workflows/go.mod"
+
+      - name: Checkout connector repo
         uses: actions/checkout@v5
         with:
           path: _connector
@@ -1219,9 +1309,22 @@ jobs:
         run: |
           gh api "repos/${{ github.repository }}/releases/tags/${{ inputs.tag }}" --jq .body > /tmp/changelog.md || true
 
+      - name: Merge manifests for registry API
+        working-directory: _workflows
+        env:
+          BINARIES_MANIFEST: ${{ needs.goreleaser-binaries.outputs.binaries_manifest }}
+          WINDOWS_MANIFEST: ${{ needs.goreleaser-windows.outputs.windows_manifest }}
+          IMAGES_MANIFEST: ${{ needs.goreleaser-docker.outputs.images_manifest }}
+        run: |
+          mkdir -p _output
+          go run ./cmd/merge-manifests \
+            -binaries-manifest "${BINARIES_MANIFEST:-{}}" \
+            -windows-manifest "${WINDOWS_MANIFEST:-}" \
+            -images-manifest "${IMAGES_MANIFEST:-}" \
+            | tee _output/manifest.json
+
       - name: Record release via registry API
         if: steps.registry-oidc.outcome == 'success'
-        continue-on-error: true
         working-directory: _workflows
         env:
           REGISTRY_API_TOKEN: ${{ steps.registry-oidc.outputs.token }}
@@ -1260,76 +1363,6 @@ jobs:
             $CONFIG_SCHEMA_FLAG \
             $CAPABILITIES_FLAG
 
-  record-lambda-registry:
-    if: inputs.lambda == true
-    # Legacy per-connector Lambda invocation — records to connectorreleases DynamoDB.
-    # Only needs binaries + docker (container images). Does not gate on windows/msi since
-    # the Lambda pipeline only cares about container images. Will be removed after cutover
-    # to the registry API (record-connector-registry replaces this path).
-    needs: [goreleaser-binaries, goreleaser-docker]
-    permissions:
-      id-token: write
-      contents: read
-    runs-on: ubuntu-latest
-    steps:
-      - name: Configure AWS credentials via OIDC
-        uses: aws-actions/configure-aws-credentials@v5
-        with:
-          role-to-assume: "arn:aws:iam::168442440833:role/GitHubActionsECRPushRole-${{ github.event.repository.name }}"
-          aws-region: us-west-2
-
-      - name: Invoke Lambda with retries
-        run: |
-          set +e    # Disable default fail-fast to support retries
-          if [[ "$ACTIONS_STEP_DEBUG" == "true" ]]; then
-            set -x  # Debug logging
-          fi
-
-          TMPFILE=$(mktemp)
-          MAX_RETRIES=5
-          RETRY_DELAY=10  # seconds
-
-          for ((i=1; i<=MAX_RETRIES; i++)); do
-            echo "Attempt $i to invoke Lambda..."
-
-            RESPONSE=$(aws lambda invoke \
-              --function-name "${{ github.event.repository.name }}-releases" \
-              --payload "{\"tag\":\"${{ inputs.tag }}\"}" \
-              --cli-binary-format raw-in-base64-out \
-              "$TMPFILE" 2>&1)
-            EXIT_CODE=$?
-
-            echo "AWS CLI exited with code: $EXIT_CODE"
-            cat "$TMPFILE"
-
-            STATUS_CODE=$(jq -r '.statusCode' < "$TMPFILE" 2>/dev/null)
-
-            if [[ $EXIT_CODE -eq 0 && "$STATUS_CODE" == "200" ]]; then
-              echo "Lambda invoked successfully."
-              break
-
-            elif [[ "$RESPONSE" == *"CodeArtifactUserPendingException"* ]]; then
-              echo "Lambda not ready (CodeArtifactUserPendingException)."
-
-              if [[ $i -lt $MAX_RETRIES ]]; then
-                WAIT_TIME=$((i * RETRY_DELAY))
-                echo "Retrying in $WAIT_TIME seconds..."
-                sleep "$WAIT_TIME"
-              else
-                echo "Lambda still not ready after $MAX_RETRIES attempts."
-                rm -f "$TMPFILE"
-                exit 1
-              fi
-
-            else
-              echo "Lambda invoke failed with unexpected error: $RESPONSE"
-              rm -f "$TMPFILE"
-              exit 1
-            fi
-          done
-
-          rm -f "$TMPFILE"
-
   verify-release:
     # Verify release artifacts and attestations after publishing
     # This job is not blocking - failures trigger Datadog notification but don't fail the release
@@ -1376,6 +1409,7 @@ jobs:
         goreleaser-docker,
         record-connector-registry,
         record-lambda-registry,
+        record-registry-api,
         verify-release,
       ]
     if: failure()