fix: make the release publishable on demand through one shared workflow

[aurimasbutkus]

No description provided.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in:4 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f0b7b3d3-3e4f-4364-94f0-c2b627248726

📥 Commits

Reviewing files that changed from the base of the PR and between 116ddbd and c6fc6df.

📒 Files selected for processing (2)

• .github/workflows/build-release.yaml
• .github/workflows/release.yaml

📝 Walkthrough

Walkthrough

The release process now supports manual dispatch, separates tag creation from publishing, and invokes publishing through a reusable workflow. The publishing workflow accepts an optional tag and uses a GitHub App token for GoReleaser access.

Changes

Release workflow

Layer / File(s)	Summary
Tag and publish orchestration .github/workflows/build-release.yaml	The workflow adds manual dispatch, exposes the generated tag from the tag job, and delegates publishing to release.yaml. Failure notifications now depend on tagging and publishing jobs.
Authenticated release publishing .github/workflows/release.yaml	The reusable workflow accepts an optional tag, generates a GitHub App token scoped to api-cli and homebrew-tap, and passes the token and tag to GoReleaser.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
participant GitHubActions
participant TagJob
participant ReleaseWorkflow
participant GoReleaser
GitHubActions->>TagJob: create release tag
TagJob->>ReleaseWorkflow: pass generated tag
ReleaseWorkflow->>GoReleaser: pass App token and GORELEASER_CURRENT_TAG
GoReleaser->>GitHubActions: publish release artifacts

Loading

Possibly related PRs

• hostinger/api-cli#42 — Both changes modify the tagging and GoReleaser flow in .github/workflows/build-release.yaml.

Suggested reviewers:ugnsma, zygintas, fizikiukas

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	No pull request description was provided, so the changeset has no author-written explanation.	Add a short description that explains the manual dispatch support, shared release workflow, and token changes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly describes the main change: enabling on-demand releases through a shared workflow.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dispatchable-release

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-release.yaml:
- Around line 39-42: Replace broad secrets inheritance for the release workflow
call with explicit mappings for HOSTINGERBOT_APP_ID and
HOSTINGERBOT_PRIVATE_KEY, and declare only those two secrets in release.yaml
under on.workflow_call.secrets. Preserve the existing tag input and release
workflow behavior while preventing unrelated caller secrets from being
forwarded.
In @.github/workflows/release.yaml:
- Around line 25-34: Update the Get GitHub token step using
actions/create-github-app-token@v3 to explicitly set permission-contents to
write, while preserving the existing app credentials, owner, and repository
configuration.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e3f0b611-e20d-4b9c-8d9e-262ba6f7d919

📥 Commits

Reviewing files that changed from the base of the PR and between 3a4078c and 116ddbd.

📒 Files selected for processing (2)

• .github/workflows/build-release.yaml
• .github/workflows/release.yaml