From a306d2533dcd4c8283c58dae6596b521eb0ea99f Mon Sep 17 00:00:00 2001
From: Paul Querna <paul.querna@conductorone.com>
Date: Tue, 25 Aug 2026 22:41:58 +0000
Subject: [PATCH] Pin GoReleaser to requested release tag

Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
---
 .github/workflows/release.yaml           |  4 ++++
 Makefile                                 |  1 +
 docs/release-workflow.md                 |  2 ++
 scripts/test-release-workflow-tag-pin.sh | 22 ++++++++++++++++++++++
 4 files changed, 29 insertions(+)
 create mode 100755 scripts/test-release-workflow-tag-pin.sh

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 299331d..73b53d9 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -425,6 +425,7 @@ jobs:
           args: release --clean --config ../_workflows/_generated/.goreleaser.binaries.yaml
         env:
           GITHUB_TOKEN: ${{ secrets.RELENG_GITHUB_TOKEN }}
+          GORELEASER_CURRENT_TAG: ${{ inputs.tag }}
           AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
           AC_PROVIDER: ${{ secrets.AC_PROVIDER }}
 
@@ -751,6 +752,7 @@ jobs:
           args: release --clean --skip=publish --config ../_workflows/_generated/.goreleaser.windows.yaml
         env:
           GITHUB_TOKEN: ${{ secrets.RELENG_GITHUB_TOKEN }}
+          GORELEASER_CURRENT_TAG: ${{ inputs.tag }}
           GORELEASER_KEY: ${{ secrets.GORELEASER_PRO_KEY }}
 
       - name: Flatten MSI directory structure
@@ -1077,6 +1079,7 @@ jobs:
           args: release --clean --config ../_workflows/_generated/.goreleaser.docker.yaml
         env:
           GITHUB_TOKEN: ${{ secrets.RELENG_GITHUB_TOKEN }}
+          GORELEASER_CURRENT_TAG: ${{ inputs.tag }}
           COSIGN_EXPERIMENTAL: "1"
 
       - name: Set up Go for Public ECR helper
@@ -1130,6 +1133,7 @@ jobs:
           args: release --clean --config ../_workflows/_generated/.goreleaser.lambda.yaml
         env:
           GITHUB_TOKEN: ${{ secrets.RELENG_GITHUB_TOKEN }}
+          GORELEASER_CURRENT_TAG: ${{ inputs.tag }}
 
       - name: Set up Go for workflows
         if: inputs.docker == true || inputs.lambda == true
diff --git a/Makefile b/Makefile
index b6d5feb..6bc157c 100644
--- a/Makefile
+++ b/Makefile
@@ -21,6 +21,7 @@ test-scripts:
 	bash scripts/test-derive-iam-role-name.sh
 	bash scripts/test-normalize-release-options.sh
 	python3 scripts/test-release-config-templates.py
+	bash scripts/test-release-workflow-tag-pin.sh
 	bash scripts/test-s3-release-uploads.sh
 	if command -v pwsh >/dev/null 2>&1; then pwsh -NoProfile -File scripts/test-s3-release-uploads.ps1; else echo "pwsh not found; skipping PowerShell S3 release upload tests"; fi
 
diff --git a/docs/release-workflow.md b/docs/release-workflow.md
index 89d4ac8..3c3f969 100644
--- a/docs/release-workflow.md
+++ b/docs/release-workflow.md
@@ -136,6 +136,8 @@ checked-out commit matches the tag target before building artifacts or recording
 registry metadata. This prevents a release run from publishing artifacts for one
 commit while labeling them as a different tag.
 
+Every GoReleaser invocation receives `GORELEASER_CURRENT_TAG` from the workflow input. This pins archive names, release metadata, and image digest files to the requested tag when multiple tags identify the same commit.
+
 ### Keyless Signing
 
 All signatures use Sigstore's keyless signing:
diff --git a/scripts/test-release-workflow-tag-pin.sh b/scripts/test-release-workflow-tag-pin.sh
new file mode 100755
index 0000000..8b7604e
--- /dev/null
+++ b/scripts/test-release-workflow-tag-pin.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+workflow="${script_dir}/../.github/workflows/release.yaml"
+expected='${{ inputs.tag }}'
+
+assert_tag_pin() {
+  local job="$1"
+  local step="$2"
+  local got
+  got="$(yq -r ".jobs.\"${job}\".steps[] | select(.name == \"${step}\").env.GORELEASER_CURRENT_TAG" "$workflow")"
+  if [ "$got" != "$expected" ]; then
+    echo "${job}/${step}: GORELEASER_CURRENT_TAG = ${got@Q}, want ${expected@Q}" >&2
+    exit 1
+  fi
+}
+
+assert_tag_pin goreleaser-binaries "Run GoReleaser"
+assert_tag_pin goreleaser-windows "Run GoReleaser for Windows"
+assert_tag_pin goreleaser-docker "Run GoReleaser for Docker OCI"
+assert_tag_pin goreleaser-docker "Run GoReleaser for Lambda"