From ad8599b23ba3c6b82ea91df5ef40f1126fd22b83 Mon Sep 17 00:00:00 2001
From: Jon Langevin <codingsloth@pm.me>
Date: Sat, 6 Jun 2026 14:51:49 -0400
Subject: [PATCH] release: prepare manifest in goreleaser hook

---
 .github/workflows/release.yml |  5 +----
 .goreleaser.yml               |  2 ++
 release_workflow_test.go      | 23 +++++++++++++++++++++--
 3 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 463693e..0a3f56e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,8 +23,6 @@ jobs:
           git config --global url."https://x-access-token:${RELEASES_TOKEN}@github.com/GoCodeAlone/".insteadOf "https://github.com/GoCodeAlone/"
           go env -w GOPRIVATE=github.com/GoCodeAlone/*
           go env -w GONOSUMDB=github.com/GoCodeAlone/*
-      - name: Prepare release manifest
-        run: go run ./cmd/release-prep --tag "${{ github.ref_name }}" --write
       - name: Install wfctl v0.74.5
         run: |
           mkdir -p "${RUNNER_TEMP}/wfctl-bin"
@@ -32,8 +30,6 @@ jobs:
             -o "${RUNNER_TEMP}/wfctl-bin/wfctl" \
             "https://github.com/GoCodeAlone/workflow/releases/download/v0.74.5/wfctl-linux-amd64"
           chmod +x "${RUNNER_TEMP}/wfctl-bin/wfctl"
-      - name: Validate plugin contract for publish (pre-build)
-        run: "${{ runner.temp }}/wfctl-bin/wfctl plugin validate-contract --for-publish --tag ${{ github.ref_name }} ."
       - uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
         with:
           distribution: goreleaser
@@ -41,6 +37,7 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          WFCTL_BIN: ${{ runner.temp }}/wfctl-bin/wfctl
       # workflow#765: runtime truth-check via plugin verify-capabilities.
       - name: Verify capabilities (runtime truth-check)
         run: |
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 4c49eb8..1a9af04 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -4,6 +4,8 @@ before:
   hooks:
     - go mod tidy
     - go test ./...
+    - go run ./cmd/release-prep --tag "{{ .Tag }}" --write
+    - "{{ .Env.WFCTL_BIN }} plugin validate-contract --for-publish --tag {{ .Tag }} ."
 
 builds:
   - id: workflow-plugin-product-capture
diff --git a/release_workflow_test.go b/release_workflow_test.go
index cc7c27d..778aaee 100644
--- a/release_workflow_test.go
+++ b/release_workflow_test.go
@@ -29,12 +29,31 @@ func TestReleaseWorkflowUsesGlobalDispatchToken(t *testing.T) {
 	if !strings.Contains(workflow, "needs: [release, runtime-image]") {
 		t.Fatal("registry notification must wait for the runtime image publish")
 	}
-	if !strings.Contains(workflow, "go run ./cmd/release-prep --tag \"${{ github.ref_name }}\" --write") {
-		t.Fatal("release workflow must rewrite plugin.json metadata from the release tag before validation")
+	if strings.Contains(workflow, "go run ./cmd/release-prep --tag \"${{ github.ref_name }}\" --write") {
+		t.Fatal("release workflow must not dirty tracked plugin.json before GoReleaser starts")
+	}
+	if !strings.Contains(workflow, "WFCTL_BIN: ${{ runner.temp }}/wfctl-bin/wfctl") {
+		t.Fatal("release workflow must pass wfctl path into GoReleaser hooks")
 	}
 	assertWorkflowUsesPinnedActions(t, ".github/workflows/release.yml", workflow)
 }
 
+func TestGoReleaserPreparesReleaseManifestInsideLifecycle(t *testing.T) {
+	data, err := os.ReadFile(".goreleaser.yml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	config := string(data)
+	for _, want := range []string{
+		`go run ./cmd/release-prep --tag "{{ .Tag }}" --write`,
+		`"{{ .Env.WFCTL_BIN }} plugin validate-contract --for-publish --tag {{ .Tag }} ."`,
+	} {
+		if !strings.Contains(config, want) {
+			t.Fatalf(".goreleaser.yml missing release hook %q", want)
+		}
+	}
+}
+
 func TestCIWorkflowChecksReleaseManifest(t *testing.T) {
 	data, err := os.ReadFile(".github/workflows/ci.yml")
 	if err != nil {