fix: ensure the correct workflow, users, and tags (#1775)

Signed-off-by: matttrach <[email protected]>
Co-authored-by: Matt Trachier <[email protected]>

Author: github-actions[bot]

.github/workflows/manual-rc-release.yml

@@ -19,6 +19,22 @@ jobs:
   rc-release:
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 https://github.com/actions/github-script/commits/main
+        id: check-user-in-maintainers
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          script: |
+            const isMaintainer = ${{ vars.TERRAFORM_MAINTAINERS }}.includes(context.actor);
+            return isMaintainer;
+      - run: |
+          # if the tag doesn't contain "rc" we should not be in this workflow
+          if grep -q "rc" <<< "${{ inputs.tag }}"; then
+            echo "Tag contains 'rc', continuing with RC release"
+          else
+            echo "Tag doesn't contain 'rc', please use the manual-release workflow"
+            exit 1
+          fi
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 https://github.com/actions/checkout
         with:
           fetch-depth: 0

.github/workflows/manual-release.yml

@@ -19,6 +19,20 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 https://github.com/actions/github-script/commits/main
+        id: check-user-in-maintainers
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          script: |
+            const isMaintainer = ${{ vars.TERRAFORM_MAINTAINERS }}.includes(context.actor);
+            return isMaintainer;
+      - run: |
+          # if the tag contains "rc" we should not be in this workflow
+          if grep -q "rc" <<< "${{ inputs.tag }}"; then
+            echo "Tag contains 'rc', please use the manual-rc-release workflow"
+            exit 1
+          fi
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 https://github.com/actions/checkout
         with:
           fetch-depth: 0
@@ -41,6 +55,11 @@ jobs:
         with:
           ref: ${{ inputs.tag }}
           path: ${{ github.workspace }}/tags/${{ inputs.tag }}
+      - run: |
+          # remove any tags that are not the one specified (to avoid goreleaser confusion)
+          cd "${{ github.workspace }}/tags/${{ inputs.tag }}"
+          git tag | grep -v "${{ inputs.tag }}" | xargs git tag -d
+          cd ../../
       - name: retrieve GPG Credentials
         id: retrieve-gpg-credentials
         uses: rancher-eio/read-vault-secrets@main