feat(go-release): manifest publish for per-component tags and a non-root go.mod #901

Request Type

New input / parameter for an existing workflow

Affected Workflow (if applicable)

Go (ci, security, release, pr-analysis)

Problem / Motivation

go-release.yml's permission_manifest_publish job (run_manifest_publish) only accepts plain release tags (vX.Y.Z, vX.Y.Z-beta.N, vX.Y.Z-rc.N). It also scopes itself through the root go.mod, checking for a direct lib-auth dependency.

A monorepo with per-component tags (<service>-vX.Y.Z) and no root go.mod, such as LerianStudio/br-sfn, gets manifest publish skipped on every tag. The repo therefore keeps a bespoke permission-manifest-publish.yml that calls the src/validate/permission-manifest-publish composite directly, with its own copy of the tag list, its own environment resolution from the tag, and a hard-coded go-mod-path: services/spi/go.mod.

Proposed Solution

• Accept the component tag format: reuse component_tag_pattern if that lands (feat(go-release): pre-build release gate for per-component tags (release_check_command) #898), or take a manifest_tag_pattern input. Then derive the environment folder from the version part.
• Add a manifest_go_mod_path input to point the scope gate at a module other than the root one.
• Keep repo-wide manifest discovery (already in the composite).

Alternatives Considered

The caller-side workflow (current state). It duplicates tag-to-environment logic that the umbrella already owns.

Example Usage

uses: LerianStudio/github-actions-shared-workflows/.github/workflows/go-release.yml@tier-2
with:
  run_manifest_publish: true
  manifest_go_mod_path: services/spi/go.mod
  manifest_tag_pattern: '^(?<component>[a-z][a-z0-9-]*)-(?<version>v\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?)$'

Would This Be a Breaking Change?

No — fully backward compatible

Checklist

• I searched existing issues and this is not a duplicate.
• This feature aligns with the repository's goal of providing reusable, organization-wide workflows.

Additional Context

Consumer: LerianStudio/br-sfn (.github/workflows/permission-manifest-publish.yml). Related closed work: #672.