Pin GoReleaser to requested release tag (#112)

## Problem
When a prerelease and final tag point at one commit, GoReleaser
auto-detects the prerelease tag. Production workflow runs then build
prerelease-named assets and fail before distribution publication.

## Change
Set GORELEASER_CURRENT_TAG from the reusable workflow tag input in
binary, Windows, Public ECR, and Lambda GoReleaser invocations. Add a
workflow test that guards every invocation.

## Security impact
Artifact names, release metadata, and image digest files now derive from
the verified workflow tag even when several tags identify the same
source commit.

## Verification
- make test workflow-validate

## Release recovery
The failed v0.0.42 and v0.5.1 attempts remain unused in dist.
Replacement releases use new patch versions after this shared workflow
patch is published.

Co-authored-by: Paul Querna <paul.querna@conductorone.com>
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>

Author: c1-squire-dev[bot]

.github/workflows/release.yaml

@@ -425,6 +425,7 @@ jobs:
           args: release --clean --config ../_workflows/_generated/.goreleaser.binaries.yaml
         env:
           GITHUB_TOKEN: ${{ secrets.RELENG_GITHUB_TOKEN }}
+          GORELEASER_CURRENT_TAG: ${{ inputs.tag }}
           AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
           AC_PROVIDER: ${{ secrets.AC_PROVIDER }}
 
@@ -751,6 +752,7 @@ jobs:
           args: release --clean --skip=publish --config ../_workflows/_generated/.goreleaser.windows.yaml
         env:
           GITHUB_TOKEN: ${{ secrets.RELENG_GITHUB_TOKEN }}
+          GORELEASER_CURRENT_TAG: ${{ inputs.tag }}
           GORELEASER_KEY: ${{ secrets.GORELEASER_PRO_KEY }}
 
       - name: Flatten MSI directory structure
@@ -1077,6 +1079,7 @@ jobs:
           args: release --clean --config ../_workflows/_generated/.goreleaser.docker.yaml
         env:
           GITHUB_TOKEN: ${{ secrets.RELENG_GITHUB_TOKEN }}
+          GORELEASER_CURRENT_TAG: ${{ inputs.tag }}
           COSIGN_EXPERIMENTAL: "1"
 
       - name: Set up Go for Public ECR helper
@@ -1130,6 +1133,7 @@ jobs:
           args: release --clean --config ../_workflows/_generated/.goreleaser.lambda.yaml
         env:
           GITHUB_TOKEN: ${{ secrets.RELENG_GITHUB_TOKEN }}
+          GORELEASER_CURRENT_TAG: ${{ inputs.tag }}
 
       - name: Set up Go for workflows
         if: inputs.docker == true || inputs.lambda == true

Makefile

@@ -21,6 +21,7 @@ test-scripts:
 	bash scripts/test-derive-iam-role-name.sh
 	bash scripts/test-normalize-release-options.sh
 	python3 scripts/test-release-config-templates.py
+	bash scripts/test-release-workflow-tag-pin.sh
 	bash scripts/test-s3-release-uploads.sh
 	if command -v pwsh >/dev/null 2>&1; then pwsh -NoProfile -File scripts/test-s3-release-uploads.ps1; else echo "pwsh not found; skipping PowerShell S3 release upload tests"; fi
 

docs/release-workflow.md

@@ -136,6 +136,8 @@ checked-out commit matches the tag target before building artifacts or recording
 registry metadata. This prevents a release run from publishing artifacts for one
 commit while labeling them as a different tag.
 
+Every GoReleaser invocation receives `GORELEASER_CURRENT_TAG` from the workflow input. This pins archive names, release metadata, and image digest files to the requested tag when multiple tags identify the same commit.
+
 ### Keyless Signing
 
 All signatures use Sigstore's keyless signing:

scripts/test-release-workflow-tag-pin.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+workflow="${script_dir}/../.github/workflows/release.yaml"
+expected='${{ inputs.tag }}'
+
+assert_tag_pin() {
+  local job="$1"
+  local step="$2"
+  local got
+  got="$(yq -r ".jobs.\"${job}\".steps[] | select(.name == \"${step}\").env.GORELEASER_CURRENT_TAG" "$workflow")"
+  if [ "$got" != "$expected" ]; then
+    echo "${job}/${step}: GORELEASER_CURRENT_TAG = ${got@Q}, want ${expected@Q}" >&2
+    exit 1
+  fi
+}
+
+assert_tag_pin goreleaser-binaries "Run GoReleaser"
+assert_tag_pin goreleaser-windows "Run GoReleaser for Windows"
+assert_tag_pin goreleaser-docker "Run GoReleaser for Docker OCI"
+assert_tag_pin goreleaser-docker "Run GoReleaser for Lambda"