feat: implement append for release notes

.github/workflows/build-publish-container-goreleaser.yml

@@ -21,6 +21,11 @@ on:
         type: string
         required: false
         description: 'Path to a go.mod or .go-version file containing the Go version. Mutually exclusive with go_version.'
+      release_draft:
+        type: boolean
+        required: false
+        default: false
+        description: 'Create the release as a draft, overriding release.draft in .goreleaser.yml'
       is_pr_build:
         type: boolean
         required: false
@@ -98,7 +103,7 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         with:
           version: '~> 2'
-          args: release --clean ${{ inputs.is_pr_build && '--skip=announce,validate,archive' || '' }}${{ env.SKIP_CONTAINER_PUBLISH == 'true' && (inputs.is_pr_build && ',publish' || '--skip=publish') || '' }}
+          args: release --clean ${{ inputs.is_pr_build && '--skip=announce,validate,archive' || '' }}${{ env.SKIP_CONTAINER_PUBLISH == 'true' && (inputs.is_pr_build && ',publish' || '--skip=publish') || '' }}${{ inputs.release_draft && ' --draft' || '' }}
         id: goreleaser
       - name: Process goreleaser output
         if: env.SKIP_CONTAINER_PUBLISH == 'false'

.github/workflows/publish-release.yml

@@ -0,0 +1,27 @@
+# Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+#
+# Reusable workflow: publishes the draft GitHub Release for a tag once every
+# upstream job has finished attaching its artifacts.
+name: Publish release
+run-name: Publish release for ${{ github.ref }}
+permissions:
+  contents: write
+on:
+  workflow_call:
+    inputs:
+      make_latest:
+        description: 'Mark the published release as the latest release. Use "legacy" to defer to GitHub'
+        type: string
+        default: 'true'
+        required: false
+jobs:
+  publish-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Publish release
+        uses: softprops/action-gh-release@v3.0.2
+        with:
+          tag_name: ${{ github.ref_name }}
+          draft: false
+          make_latest: ${{ inputs.make_latest }}

.github/workflows/release-signed-artifacts.yml

@@ -21,6 +21,21 @@ on:
         type: string
         default: 'public-keys'
         required: false
+      append_body:
+        description: 'Append the verification instructions to the existing release body instead of replacing it'
+        type: boolean
+        default: true
+        required: false
+      release_draft:
+        description: 'Leave the release in draft state'
+        type: boolean
+        default: false
+        required: false
+      release_name:
+        description: 'Release title. When empty, the existing release name is kept'
+        type: string
+        default: ''
+        required: false
 jobs:
   artifacts-release:
     runs-on: ubuntu-latest
@@ -51,7 +66,9 @@ jobs:
         uses: softprops/action-gh-release@v3.0.2
         with:
           tag_name: ${{ github.ref_name }}
-          name: Release ${{ github.ref_name }}
+          name: ${{ inputs.release_name }}
+          draft: ${{ inputs.release_draft }}
+          append_body: ${{ inputs.append_body }}
           fail_on_unmatched_files: true
           files: |
             dist/rpms/**/*.rpm

README.md

@@ -21,6 +21,7 @@ Reusable GitHub Actions for CI/CD.
 - `.github/workflows/gpg-sign-artifacts.yml`: Signs unsigned RPM artifacts with a per-run ephemeral key
 - `.github/workflows/validate-rpm-quadlet.yml`: Validates a signed quadlet RPM's installed file list
 - `.github/workflows/release-signed-artifacts.yml`: Publishes a GitHub Release with signed RPMs and public keys
+- `.github/workflows/publish-release.yml`: Publishes the draft GitHub Release for a tag
 - `.github/workflows/lint-workflows.yml`: Reusable workflow that lints workflow files (actionlint + zizmor)
 - `.github/workflows/govulncheck.yml`: Reusable workflow that scans Go modules for known CVEs
 - `.github/workflows/dependency-review.yml`: Reusable workflow that gates PRs introducing CVE-flagged deps
@@ -164,6 +165,7 @@ jobs:
     uses: OpenCHAMI/github-actions/.github/workflows/build-publish-container-goreleaser.yml@v3.5
     with:
       registry_subject_name: ghcr.io/openchami/foo
+      release_draft: false
 ```
 
 ### build-rpm-quadlet (Reusable Workflow)
@@ -210,6 +212,19 @@ Publishes a GitHub Release for a tag, attaching signed RPMs and public keys, wit
 jobs:
   release:
     uses: OpenCHAMI/github-actions/.github/workflows/release-signed-artifacts.yml@v3.5
+    with:
+      release_draft: false
+```
+
+### publish-release (Reusable Workflow)
+Publishes the draft GitHub Release for a tag, for pipelines that set `release_draft: true` upstream so the release only appears once every artifact is attached.
+
+**Usage:**
+```yaml
+jobs:
+  publish:
+    needs: release
+    uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@v3.9
 ```
 
 ### pr-registry-cleanup (Reusable Workflow)