Prepare release artifacts from tags

Build and verify unsigned registry assets in a read-only tag workflow so release owners can inspect a deterministic handoff before signing or publication is enabled.

Author: IlyaasK

.github/workflows/release.yml

@@ -0,0 +1,115 @@
+name: Release preparation
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    name: Prepare release artifacts
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Check release preconditions
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          test -s LICENSE || {
+            echo "LICENSE must exist before a public provider release." >&2
+            exit 1
+          }
+
+          visibility="$(gh api "repos/${GITHUB_REPOSITORY}" --jq .visibility)"
+          if [ "$visibility" != "public" ]; then
+            echo "The provider repository must be public before a registry release." >&2
+            exit 1
+          fi
+
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
+            echo "Release tags must point to commits reachable from origin/main." >&2
+            exit 1
+          fi
+
+      - name: Set up Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build release artifacts
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
+        with:
+          distribution: goreleaser
+          version: v2.17.0
+          args: release --clean --skip=publish
+
+      - name: Verify release artifacts
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          version="${RELEASE_TAG#v}"
+          cp terraform-registry-manifest.json "dist/terraform-provider-kernel_${version}_manifest.json"
+
+          checksum="dist/terraform-provider-kernel_${version}_SHA256SUMS"
+          test -s "$checksum"
+          (cd dist && sha256sum --check "$(basename "$checksum")")
+
+          expected_assets="$(
+            printf '%s\n' \
+              "terraform-provider-kernel_${version}_darwin_amd64.zip" \
+              "terraform-provider-kernel_${version}_darwin_arm64.zip" \
+              "terraform-provider-kernel_${version}_freebsd_386.zip" \
+              "terraform-provider-kernel_${version}_freebsd_amd64.zip" \
+              "terraform-provider-kernel_${version}_freebsd_arm.zip" \
+              "terraform-provider-kernel_${version}_freebsd_arm64.zip" \
+              "terraform-provider-kernel_${version}_linux_386.zip" \
+              "terraform-provider-kernel_${version}_linux_amd64.zip" \
+              "terraform-provider-kernel_${version}_linux_arm.zip" \
+              "terraform-provider-kernel_${version}_linux_arm64.zip" \
+              "terraform-provider-kernel_${version}_manifest.json" \
+              "terraform-provider-kernel_${version}_windows_386.zip" \
+              "terraform-provider-kernel_${version}_windows_amd64.zip" \
+              "terraform-provider-kernel_${version}_windows_arm64.zip"
+          )"
+          actual_assets="$(awk 'NF == 2 { print $2 }' "$checksum" | sort)"
+          diff -u <(printf '%s\n' "$expected_assets") <(printf '%s\n' "$actual_assets")
+
+          for archive in dist/*.zip; do
+            files="$(unzip -Z1 "$archive")"
+            case "$(basename "$archive")" in
+              *_windows_*) expected_binary="terraform-provider-kernel_v${version}.exe" ;;
+              *) expected_binary="terraform-provider-kernel_v${version}" ;;
+            esac
+            if [ "$files" != "$expected_binary" ]; then
+              echo "$archive contains unexpected file: $files" >&2
+              exit 1
+            fi
+          done
+
+      - name: Upload release artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-${{ github.ref_name }}-${{ github.run_id }}
+          path: |
+            dist/*.zip
+            dist/*_manifest.json
+            dist/*_SHA256SUMS
+          if-no-files-found: error
+          retention-days: 7
+          compression-level: 0
+          overwrite: true

.goreleaser.yml

@@ -43,17 +43,6 @@ checksum:
     - glob: terraform-registry-manifest.json
       name_template: "{{ .ProjectName }}_{{ .Version }}_manifest.json"
 
-signs:
-  - artifacts: checksum
-    args:
-      - --batch
-      - --local-user
-      - "{{ .Env.GPG_FINGERPRINT }}"
-      - --output
-      - ${signature}
-      - --detach-sign
-      - ${artifact}
-
 release:
   extra_files:
     - glob: terraform-registry-manifest.json

docs/release.md

@@ -13,7 +13,7 @@ Use this checklist before publishing a Kernel Terraform provider version.
 - Run `go test -short -timeout=2m ./...`.
 - Run `go vet ./...`.
 - Run `goreleaser check`.
-- Run `goreleaser release --snapshot --clean --skip=sign` and inspect the
+- Run `goreleaser release --snapshot --clean` and inspect the
   registry-shaped archives and checksum file in `dist/`. Confirm every archive
   contains only its provider binary and the checksum file includes the renamed
   manifest. A snapshot proves artifact construction only; it is not a signed or
@@ -54,11 +54,16 @@ Do not replace or mutate assets for a published version. If an asset, checksum,
 ## GoReleaser Notes
 
 - `.goreleaser.yml` is the source of truth for registry artifact names, target
-  platforms, checksums, manifest inclusion, and checksum signing.
+  platforms, checksums, and manifest inclusion.
 - Normal CI runs `goreleaser check`; it does not cross-compile every target or
   publish artifacts.
-- Prefer a tag-triggered GitHub Actions release workflow once the signing key owner is decided.
-- Store the ASCII-armored private signing key as `GPG_PRIVATE_KEY` and its passphrase as `PASSPHRASE`.
+- `.github/workflows/release.yml` runs for `v*` tags with read-only repository
+  access. It requires a non-empty `LICENSE`, public repository visibility, and a
+  tag commit reachable from `main`, then builds and validates the unsigned
+  registry assets. The workflow artifact is retained for seven days for release
+  inspection.
+- Signing and publication remain separate manual release gates until release
+  ownership and a protected publication workflow are configured.
 
 ## Registry Setup
 
@@ -91,4 +96,3 @@ References:
 
 - HashiCorp Terraform provider publishing: https://developer.hashicorp.com/terraform/registry/providers/publishing
 - HashiCorp provider registry protocol: https://developer.hashicorp.com/terraform/internals/provider-registry-protocol
-- GoReleaser checksum signing: https://goreleaser.com/customization/sign/