release: prepare manifest inside GoReleaser lifecycle

.github/workflows/release.yml

@@ -23,24 +23,21 @@ jobs:
           git config --global url."https://x-access-token:${RELEASES_TOKEN}@github.com/GoCodeAlone/".insteadOf "https://github.com/GoCodeAlone/"
           go env -w GOPRIVATE=github.com/GoCodeAlone/*
           go env -w GONOSUMDB=github.com/GoCodeAlone/*
-      - name: Prepare release manifest
-        run: go run ./cmd/release-prep --tag "${{ github.ref_name }}" --write
       - name: Install wfctl v0.74.5
         run: |
           mkdir -p "${RUNNER_TEMP}/wfctl-bin"
           curl -sSfL -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
             -o "${RUNNER_TEMP}/wfctl-bin/wfctl" \
             "https://github.com/GoCodeAlone/workflow/releases/download/v0.74.5/wfctl-linux-amd64"
           chmod +x "${RUNNER_TEMP}/wfctl-bin/wfctl"
-      - name: Validate plugin contract for publish (pre-build)
-        run: "${{ runner.temp }}/wfctl-bin/wfctl plugin validate-contract --for-publish --tag ${{ github.ref_name }} ."
       - uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
         with:
           distribution: goreleaser
           version: '~> v2'
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          WFCTL_BIN: ${{ runner.temp }}/wfctl-bin/wfctl
       # workflow#765: runtime truth-check via plugin verify-capabilities.
       - name: Verify capabilities (runtime truth-check)
         run: |

.goreleaser.yml

@@ -4,6 +4,8 @@ before:
   hooks:
     - go mod tidy
     - go test ./...
+    - go run ./cmd/release-prep --tag "{{ .Tag }}" --write
+    - "{{ .Env.WFCTL_BIN }} plugin validate-contract --for-publish --tag {{ .Tag }} ."
 
 builds:
   - id: workflow-plugin-product-capture

release_workflow_test.go

@@ -29,12 +29,31 @@ func TestReleaseWorkflowUsesGlobalDispatchToken(t *testing.T) {
 	if !strings.Contains(workflow, "needs: [release, runtime-image]") {
 		t.Fatal("registry notification must wait for the runtime image publish")
 	}
-	if !strings.Contains(workflow, "go run ./cmd/release-prep --tag \"${{ github.ref_name }}\" --write") {
-		t.Fatal("release workflow must rewrite plugin.json metadata from the release tag before validation")
+	if strings.Contains(workflow, "go run ./cmd/release-prep --tag \"${{ github.ref_name }}\" --write") {
+		t.Fatal("release workflow must not dirty tracked plugin.json before GoReleaser starts")
+	}
+	if !strings.Contains(workflow, "WFCTL_BIN: ${{ runner.temp }}/wfctl-bin/wfctl") {
+		t.Fatal("release workflow must pass wfctl path into GoReleaser hooks")
 	}
 	assertWorkflowUsesPinnedActions(t, ".github/workflows/release.yml", workflow)
 }
 
+func TestGoReleaserPreparesReleaseManifestInsideLifecycle(t *testing.T) {
+	data, err := os.ReadFile(".goreleaser.yml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	config := string(data)
+	for _, want := range []string{
+		`go run ./cmd/release-prep --tag "{{ .Tag }}" --write`,
+		`"{{ .Env.WFCTL_BIN }} plugin validate-contract --for-publish --tag {{ .Tag }} ."`,
+	} {
+		if !strings.Contains(config, want) {
+			t.Fatalf(".goreleaser.yml missing release hook %q", want)
+		}
+	}
+}
+
 func TestCIWorkflowChecksReleaseManifest(t *testing.T) {
 	data, err := os.ReadFile(".github/workflows/ci.yml")
 	if err != nil {