GHA-287 Support gh-action_release v7

[alex-meseldzija-sonarsource]

Part of NET-2437

Might be easiest to review by commit:

• first is functional
• documentation
• rename draft to dry-run for this action.

[hashicorp-vault-sonar-prod]

GHA-287

[sonar-review-alpha]

Summary

Adds gh-action_release v7 support to publish-github-release action with automatic version detection.

This PR makes the publish-github-release action backward-compatible with both v6 and v7 by automatically detecting which version the caller's release workflow uses (grepping for @v6 or @v7).

Key change: v7 uses a draft-first flow where releases are always created as drafts and the action only passes version and dryRun inputs to the workflow (no releaseId). v7 itself handles the draft → published promotion after artifact promotion completes. v6 continues to work as before with the existing releaseId and release event logic.

Documentation updated throughout to reflect v7 changes, with examples showing the simplified workflow inputs.

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

What reviewers should know

Where to focus:

1. Main logic: publish-github-release/action.yml — the detection logic (lines ~70-80) and conditional branching for v6 vs v7 handling (around lines 100-155, 175-200)
2. Compatibility guarantees: Existing v6-based workflows continue unchanged; no breaking changes
3. Key behavioral difference: v7 always creates drafts regardless of the draft input; v6 respects it

Non-obvious decisions:

• Detection happens by grepping the caller's workflow file — simple but effective for auto-detection
• v7 draft reuse is idempotent (will reuse existing drafts, fail if published release exists)
• The action currently uses alex/v7 branch ref in automated-release.yml — should be v7 before final merge

Note: Author mentions reviewing by commit for logical grouping (functional, docs, rename), but shallow clone only shows tip. Review reflects the logical sections in the diff.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[jonas-wielage-sonarsource]

There's a lot of good changes already and I think the support for v7 works with the changes. (Did you validate this?)

However we can't just break compatibility with v6, we need to be backwards compatible for a while (especially so close to a SQS release)

[jonas-wielage-sonarsource]

While this is now supporting v7, this change is essentially breaking all release workflows for users still on v6.
Especially so close to SQS release, we shouldn't expect users to migrate to v7 before they can release.

My suggestion:
Verify which release flow is used and then either add the releaseId or not.
Something like this (but cleaned up)

# Fetch the workflow YAML once
WORKFLOW_YAML=$(gh workflow view "$RELEASE_WORKFLOW" --repo "${{ github.repository }}" --yaml)

ON_V7 = "false"
if echo "$WORKFLOW_YAML" | grep -q "main.yaml@v7"; then
    ON_V7 = "true"
fi

V6_ADDITIONAL_INPUT=""
if [[ "$ON_V7" != "true" ]]; then
  V6_ADDITIONAL_INPUT="-f "releaseId=$RELEASE_ID_VALUE""
fi

....

gh workflow run "$RELEASE_WORKFLOW" \
          --repo "${{ github.repository }}" \
          --ref $GITHUB_REF \
          -f "version=$VALIDATED_VERSION" \
          -f "dryRun=$DRY_RUN" \
          $V6_ADDITIONAL_INPUT

[alex-meseldzija-sonarsource]

Good idea! I figured it would have to be a breaking change, but didnt think about actually parsing the yaml.

[jonas-wielage-sonarsource]

In order to support v6 we still need to be able to not create draft PR's.

[sonar-review-alpha]

Solid rename — the code logic is correct and the dual-version detection works as intended. Two small inaccuracies in the README are worth fixing before this ships.

🗣️ Give feedback

[sonar-review-alpha]

The first two bullets describe v6-only behavior, but there's no label saying so. For v7 callers, neither bullet applies — the behavior is always governed by the third bullet regardless of whether draft is true or false. Suggest making the v6 scope explicit:

• When draft=true (v6 only): …
• When draft=false (v6 only): …
• When using v7: …

Otherwise a v7 user reading the first bullet would expect a warning when an existing release is found, but the code silently reuses the draft.

Suggested change

	- **When `draft=true`**: If a release with the same title already exists, the action logs a warning and skips creation without failing.
	- **When `draft=false`**: If an existing draft release with the same title is found, it will be published instead of creating a new release. If a published release with the same title already exists, the action will fail with an error.
	- **When using v7**: Existing drafts are reused (idempotent). Existing published releases cause an error.
	- **When `draft=true` (v6 only)**: If a release with the same title already exists, the action logs a warning and skips creation without failing.
	- **When `draft=false` (v6 only)**: If an existing draft release with the same title is found, it will be published instead of creating a new release. If a published release with the same title already exists, the action will fail with an error.
	- **When using v7**: Existing drafts are reused (idempotent). Existing published releases cause an error.

• Mark as noise

[sonar-review-alpha]

This says the action greps for @v6 or @v7, but the detection code (action.yml line 70) only greps for @v6. Anything that doesn't match is treated as v7 by default — there's no explicit v7 pattern. The description is misleading for anyone trying to understand or debug the detection logic.

Suggested change

	- Detects `gh-action_release` version by grepping the caller's release workflow for `@v6` or `@v7`
	- Detects `gh-action_release` version by grepping the caller's release workflow for `@v6`; defaults to v7 if not found

• Mark as noise

[sonar-review-alpha]

One blocking issue that must be fixed before merge, and two previously flagged documentation issues still open.

🗣️ Give feedback

[alex-meseldzija-sonarsource]

This is for testing and needs to be reverted before merge.

It is hard to validate the V7 behaviour fully as the dry-run skips the step that picks up or creates the draft release.

I have a test with sonar-vb pointing at this branch.

Test run can be found here.

Which triggered this dry-run release which is green