ci(release): tag-triggered release.yaml orchestrator + draft-release capstone

.github/workflows/_publish-dar-packages.yaml

@@ -48,6 +48,11 @@ on:
         required: false
         type: boolean
         default: false
+      release_tag:
+        description: 'Draft release tag to attach nupkgs to (e.g. v0.4.0-preview.4). Empty = v<codegen_cs_version>.'
+        required: false
+        type: string
+        default: ''
     secrets:
       COUNTERS_TOKEN:
         description: 'Token with Variables: read & write on this repo (used to read/persist the counter store).'
@@ -190,12 +195,12 @@ jobs:
         run: .github/scripts/persist-counters.sh
 
       - name: Attach packages to draft release (best-effort, never fails)
-        if: env.DRY_RUN != 'true'
         env:
           GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG_INPUT: ${{ inputs.release_tag }}
         run: |
           set -uo pipefail
-          TAG="v${CODEGEN_CS_VERSION}"
+          TAG="${RELEASE_TAG_INPUT:-v${CODEGEN_CS_VERSION}}"
           if gh release view "$TAG" >/dev/null 2>&1; then
             shopt -s nullglob
             files=("$NUPKG_DIR"/*.nupkg)

.github/workflows/_release-lifecycle.yaml

@@ -0,0 +1,84 @@
+name: Release lifecycle (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      action:
+        description: "'bootstrap' (ensure a draft prerelease exists) or 'finalize' (flip the draft to published)."
+        required: true
+        type: string
+      tag:
+        description: 'Release tag, including the leading v (e.g. v0.4.0-preview.4).'
+        required: true
+        type: string
+      name:
+        description: 'Release title. Empty = the tag.'
+        required: false
+        type: string
+        default: ''
+      notes:
+        description: 'Draft notes used when bootstrap creates a new draft.'
+        required: false
+        type: string
+        default: 'Draft release assembled by CI. Assets are attached automatically across the release pipeline; publish manually once complete.'
+    outputs:
+      release_url:
+        description: 'HTML URL of the affected release.'
+        value: ${{ jobs.lifecycle.outputs.release_url }}
+      created:
+        description: "'true' when bootstrap created a new draft; 'false' when it already existed."
+        value: ${{ jobs.lifecycle.outputs.created }}
+
+jobs:
+  lifecycle:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      release_url: ${{ steps.run.outputs.release_url }}
+      created: ${{ steps.run.outputs.created }}
+    steps:
+      - name: Run ${{ inputs.action }} for ${{ inputs.tag }}
+        id: run
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          ACTION: ${{ inputs.action }}
+          TAG: ${{ inputs.tag }}
+          NAME: ${{ inputs.name }}
+          NOTES: ${{ inputs.notes }}
+        run: |
+          set -euo pipefail
+          TITLE="${NAME:-$TAG}"
+          case "$ACTION" in
+            bootstrap)
+              if gh release view "$TAG" >/dev/null 2>&1; then
+                echo "created=false" >> "$GITHUB_OUTPUT"
+                echo "draft $TAG already exists"
+              else
+                gh release create "$TAG" --draft --prerelease --verify-tag --title "$TITLE" --notes "$NOTES"
+                echo "created=true" >> "$GITHUB_OUTPUT"
+                echo "created draft $TAG"
+              fi
+              ;;
+            finalize)
+              if ! gh release view "$TAG" >/dev/null 2>&1; then
+                echo "::error::cannot finalize: release $TAG does not exist"
+                exit 1
+              fi
+              is_draft="$(gh release view "$TAG" --json isDraft --jq '.isDraft')"
+              if [ "$is_draft" != "true" ]; then
+                echo "::warning::release $TAG is already published; nothing to finalize"
+              else
+                gh release edit "$TAG" --draft=false
+                echo "published $TAG"
+              fi
+              echo "created=false" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "::error::unknown action '$ACTION' (want bootstrap|finalize)"
+              exit 1
+              ;;
+          esac
+          url="$(gh release view "$TAG" --json url --jq '.url')"
+          echo "release_url=${url}" >> "$GITHUB_OUTPUT"

.github/workflows/build-oci-codegen-cs.yaml

@@ -31,10 +31,6 @@ on:
         type: boolean
         default: true
 
-  push:
-    tags:
-      - 'v*'
-
 concurrency:
   group: build-oci-codegen-cs-${{ inputs.version || github.ref_name }}
   cancel-in-progress: false
@@ -670,16 +666,16 @@ jobs:
           merge-multiple: true
           path: bundles
 
-      - name: Attach bundles to draft release (never publish)
+      - name: Attach bundles to draft release (upload only; never create/publish)
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
           TAG="${GITHUB_REF_NAME}"
           if ! gh release view "$TAG" >/dev/null 2>&1; then
-            gh release create "$TAG" --draft --prerelease --verify-tag --title "$TAG" \
-              --notes "Draft release assembled by CI. OCI bundle + NuGet packages are attached automatically; attach Splice/Daml.Finance packages, then publish manually."
+            echo "no draft release $TAG (orchestrator bootstrap should have created it); skipping attach"
+            exit 0
           fi
           shopt -s nullglob
           files=(bundles/*.tar.gz)

.github/workflows/finalize-release.yaml

@@ -0,0 +1,18 @@
+name: Finalize Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version whose draft release to publish (no leading v, e.g. 0.4.0-preview.4).'
+        required: true
+        type: string
+
+jobs:
+  finalize:
+    permissions:
+      contents: write
+    uses: ./.github/workflows/_release-lifecycle.yaml
+    with:
+      action: finalize
+      tag: v${{ inputs.version }}

.github/workflows/publish-daml-finance.yaml

@@ -1,6 +1,48 @@
 name: Publish Daml.Finance DAR Packages
 
 on:
+  workflow_call:
+    inputs:
+      daml_finance_version:
+        description: 'Daml.Finance SDK release version (digital-asset/daml-finance sdk/<ver> tag).'
+        required: false
+        type: string
+        default: '2.10.0'
+      codegen_cs_version:
+        description: 'Version of ghcr.io/peacefulstudio/dpm-codegen-cs to pull. Empty = Directory.Build.props <Version>.'
+        required: false
+        type: string
+        default: ''
+      damlc_version:
+        description: 'damlc component version listed under daml.yaml components.'
+        required: false
+        type: string
+        default: '3.4.11'
+      runtime_version:
+        description: 'Daml.Runtime NuGet version referenced from generated csprojs. Empty = Directory.Build.props <Version>.'
+        required: false
+        type: string
+        default: ''
+      package_license:
+        description: 'SPDX license expression emitted into generated csprojs.'
+        required: false
+        type: string
+        default: 'Apache-2.0'
+      dry_run:
+        description: 'Build + pack + verify but skip the NuGet push AND the DAML_FINANCE_RELEASE_COUNTERS write-back.'
+        required: false
+        type: boolean
+        default: false
+      release_tag:
+        description: 'Draft release tag to attach nupkgs to. Empty = v<codegen_cs_version>.'
+        required: false
+        type: string
+        default: ''
+    secrets:
+      RELEASE_COUNTERS_TOKEN:
+        required: true
+      NUGET_USER:
+        required: true
   workflow_dispatch:
     inputs:
       daml_finance_version:
@@ -60,6 +102,7 @@ jobs:
       runtime_version: ${{ inputs.runtime_version }}
       package_license: ${{ inputs.package_license }}
       dry_run: ${{ inputs.dry_run }}
+      release_tag: ${{ inputs.release_tag }}
     secrets:
       COUNTERS_TOKEN: ${{ secrets.RELEASE_COUNTERS_TOKEN }}
       NUGET_USER: ${{ secrets.NUGET_USER }}

.github/workflows/publish-splice.yaml

@@ -1,6 +1,47 @@
 name: Publish Splice DAR Packages
 
 on:
+  workflow_call:
+    inputs:
+      splice_version:
+        description: 'Splice version (decentralized-canton-sync release tag, e.g. 0.6.11). No default — always pass the version explicitly.'
+        required: true
+        type: string
+      codegen_cs_version:
+        description: 'Version of ghcr.io/peacefulstudio/dpm-codegen-cs to pull. Empty = Directory.Build.props <Version>.'
+        required: false
+        type: string
+        default: ''
+      damlc_version:
+        description: 'damlc component version listed under daml.yaml components.'
+        required: false
+        type: string
+        default: '3.4.11'
+      runtime_version:
+        description: 'Daml.Runtime NuGet version referenced from generated csprojs. Empty = Directory.Build.props <Version>.'
+        required: false
+        type: string
+        default: ''
+      package_license:
+        description: 'SPDX license expression emitted into generated csprojs.'
+        required: false
+        type: string
+        default: 'Apache-2.0'
+      dry_run:
+        description: 'Build + pack + verify but skip the NuGet push AND the SPLICE_RELEASE_COUNTERS write-back.'
+        required: false
+        type: boolean
+        default: false
+      release_tag:
+        description: 'Draft release tag to attach nupkgs to. Empty = v<codegen_cs_version>.'
+        required: false
+        type: string
+        default: ''
+    secrets:
+      RELEASE_COUNTERS_TOKEN:
+        required: true
+      NUGET_USER:
+        required: true
   workflow_dispatch:
     inputs:
       splice_version:
@@ -52,6 +93,7 @@ jobs:
       runtime_version: ${{ inputs.runtime_version }}
       package_license: ${{ inputs.package_license }}
       dry_run: ${{ inputs.dry_run }}
+      release_tag: ${{ inputs.release_tag }}
     secrets:
       COUNTERS_TOKEN: ${{ secrets.RELEASE_COUNTERS_TOKEN }}
       NUGET_USER: ${{ secrets.NUGET_USER }}