feat: add gitops release workflow with goreleaser

[TerryHowe]

Summary

Replaces the manual issue-vote → tag → release process with a PR-based GitOps workflow.

Changes

• .goreleaser.yaml — Minimal config for a Go library (no binary builds, archives, or checksums). prerelease: auto marks tags containing -alpha, -beta, or -rc as pre-release on GitHub.
• .github/workflows/release.yml — Triggers on merge of a release/vX.Y.Z branch into v2. Extracts the version from the branch name, tags the merge commit, and publishes the GitHub Release using the PR body as release notes. The goreleaser/goreleaser-action is pinned to e435ccd (v6.4.0).
• RELEASES.md — Documents the full release process, the --allow-empty branch convention, and three levels of local testing with act.
• .github/act/release-event.json — Mock PR event payload for local workflow testing.

How a release works

1. Create a branch named release/vX.Y.Z from v2 with an empty commit (required for GitHub to allow a PR with no code diff):

   git fetch upstream
   git checkout -b release/v2.7.0 upstream/v2
   git commit --allow-empty -s -m "chore: prepare release v2.7.0"
   git push origin release/v2.7.0

2. Open a PR to v2 — write the release notes in the PR description (same format as today's release issues)
3. Get the required approvals via branch protection (replaces the issue vote)
4. Merge — the workflow automatically tags the commit and publishes the GitHub Release using the PR body as release notes

The release PR does not need to contain the changes being released — those are already on v2. The PR is purely a trigger.

Local testing

Three levels of validation are available without triggering a real release:

# 1. Validate goreleaser config
goreleaser check

# 2. Validate workflow structure and job matching (dry run)
act pull_request -e .github/act/release-event.json -W .github/workflows/release.yml -n

# 3. Full end-to-end run (Colima + cached actions required)
act pull_request \
  -e .github/act/release-event.json \
  -W .github/workflows/release.yml \
  -s GITHUB_TOKEN=fake \
  --pull=false \
  --action-offline-mode \
  --container-daemon-socket -

The end-to-end run executes through checkout → Go setup → version extraction (printing version=vX.Y.Z) → then fails at git push with a permission error. That is the expected safe stopping point — no tag is pushed and no release is created.

Notes

• Branch protection on v2 should require the same approval quorum currently used in release issues (3 of 4 owners)
• Pre-release tags (-alpha, -beta, -rc) are automatically marked as pre-release on GitHub

🤖 Generated with Claude Code

[sajayantony]

This is really cool.

[sabre1041]

This is really great! thanks for putting this together. Only question is whether there should be a step that validates the tag follows Semantic Versioning

Otherwise, good to merge

[Copilot]

Pull request overview

Introduces a PR-driven GitOps release process for oras-go (v2 branch) that auto-tags and publishes GitHub Releases via GoReleaser when a release/vX.Y.Z PR is merged.

Changes:

• Add a minimal .goreleaser.yaml suitable for a Go library release (no build artifacts; auto prerelease detection).
• Add a GitHub Actions workflow to extract the version from release/ branch names, tag the merged commit, and publish a GitHub Release using the PR body as notes.
• Document the new release workflow and provide an act test payload for local validation.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

File	Description
RELEASES.md	Documents the new GitOps release PR process and local testing via act.
.goreleaser.yaml	Configures GoReleaser for library-only releases and prerelease auto-detection.
.github/workflows/release.yml	Implements the automated tagging + GitHub Release publication workflow.
.github/act/release-event.json	Provides a mock PR-closed event payload for local workflow testing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.