[STF-1869] Validate release notes and select the release tag

[oschwald]

Related to STF-1869. Companion to mmdbinspect #253.

Reject empty release notes before changing the version file or pushing. Preserve Markdown headings in annotated tags and pass the script's selected tag to GoReleaser. This prevents GoReleaser from choosing another version tag on the same commit.

Local publishing remains in place. ENG-5518 tracks moving publication to GitHub Actions.

Validation

• ShellCheck 0.11.0 and shfmt 3.13.1 pass.
• Temporary-repository tests run the full script with empty and whitespace-only notes, plus unsigned and SSH-signed tags with valid notes. They check the version file is unchanged on rejection, headings survive, signatures verify, and the selected tag and notes reach GoReleaser.
• GoReleaser 2.17.1 smoke tests with builds disabled load supplied notes, reject a missing notes file, and retain the selected tag.
• Snapshot binaries, documentation, archives, and packages build with GoReleaser 2.17.1, Go 1.27.1, and Pandoc 3.10.1. Docker builds were skipped because the test environment has no Docker daemon. No releases were published.
• The existing Docker config deprecation warnings remain. ENG-5222 tracks that migration.

Repository settings

Immutable releases are enforced by the organization. The local process needs no Actions configuration changes. The repo currently has no release environment, release-tag ruleset, or repository Actions secrets. ENG-5518 records those setup requirements for the CI migration. The script retains its checks for the releaser's GitHub token and Docker registry logins.

Summary by CodeRabbit

• Chores
  • Release preparation now stops if the release notes are blank, preventing releases from proceeding without announcement text.
  • Release note whitespace is cleaned up consistently before publishing, and release metadata is passed through to the publishing process.
  • If publishing fails, the existing cleanup behavior remains in place. No changes to product features or user-facing functionality are included in this update.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: cd594f2c-413f-4c6f-aecf-5b497b86fe3d

📥 Commits

Reviewing files that changed from the base of the PR and between f005f48 and b235683.

📒 Files selected for processing (1)

• dev-bin/release.sh

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The release script now stops when release notes contain only whitespace. It creates the annotated tag with Git’s whitespace cleanup mode and passes the tag to GoReleaser through GORELEASER_CURRENT_TAG.

Changes

Release script

Layer / File(s)	Summary
Validate and publish release tag dev-bin/release.sh	The script rejects blank release notes before proceeding. It creates the annotated tag with whitespace cleanup and passes the tag to GoReleaser. The existing failure path still deletes the tag and exits.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to b2356

The script rejects blank notes before changing the version and passes its selected tag and notes to GoReleaser. No merge-blocking issue was established; proceed with normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to b2356

This is a narrow improvement to the release workflow: blank notes are rejected earlier, and publication receives the selected tag explicitly. No new publication destinations or privileges were identified. Recovery after partial remote publication remains unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — Configured publication sinks include the GitHub release and geoipupdate images and manifests at Docker Hub and GitHub Container Registry. Their tag templates consume the selected release identity; this PR does not change those destinations. The credentials' maximum authorized scope is not established.

Security Findings and Attack Paths

• inferred — The changed handoff does not establish a new attacker-controlled publication path: it overrides tag autodetection with the same constrained, locally created tag rather than accepting an additional caller-supplied tag. The comparison identified no added destination, credential source, or weaker authentication control.

Trust Boundaries and Controls

• observed — Repository changelog content crosses into privileged release operations after version parsing, date validation, a clean-tree check, module-version alignment, and operator confirmation. The new notes gate strengthens that sequence, and the quoted process-local tag assignment does not evaluate changelog content as shell code.

Resilience and Maintainability Implications

• observed — The existing workflow has no invocation lock or signal-based rollback. Cancellation can leave a modified version file, interruption can leave a local tag, and publisher failure has only local-tag cleanup. These preexisting limits do not prove safe retry or remote recovery, but the patch does not introduce them.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies both main changes: validating release notes and selecting the release tag. It is concise and directly matches the pull request objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{I’m a rabbit, ears held high,
I check the notes before they fly.
A tidy tag, a name passed through,
GoReleaser knows the tag to use.
Then off I hop beneath the moon.}

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Modver result

This report was generated by Modver,
a Go package and command that helps you obey semantic versioning rules in your Go module.

This PR does not require a change in your module’s version number.
(You might still consider bumping the patchlevel anyway.)