Fix tooling release issues

.github/workflows/reusable-cd.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   release:
     name: Release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04-8core
     permissions:
       contents: write # Needed to create the release
       packages: write # Needed to upload the images to GHCR
@@ -23,36 +23,47 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Get the name of the tool
         working-directory: ${{ inputs.tool-directory }}
-        run: set -e; echo "TOOL_NAME=$(make tool-name)" >> "${GITHUB_ENV}"
+        run: set -euo pipefail; echo "TOOL_NAME=$(make print-tool-name)" >> "${GITHUB_ENV}"
       - name: Create event-specific values
         id: setup
+        working-directory: ${{ inputs.tool-directory }}
         run: |
+          set -euo pipefail
           # Determine if the workflow was triggered via a push to main or a tag
           # and get the version based off of that
           if [[ "${GITHUB_REF}" =~ refs/tags/.* ]]; then
             # Transforms tag refs like refs/tags/tools/${TOOL_NAME}/v1.2.3 into v1.2.3
-            echo "version=${GITHUB_REF#refs/tags/tools/${TOOL_NAME}}" >> "${GITHUB_OUTPUT}"
+            VERSION="${GITHUB_REF#refs/tags/tools/${TOOL_NAME}/}"
+            echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
 
             # Eventually the parse-version action from the teleport.e repo
             # should move into this repo and replace this logic
             echo "should-release=true" >> "${GITHUB_OUTPUT}"
 
-            # Any '-' character means in a tag ref means that it is a prerelease
-            if [[ "${GITHUB_REF}" == *-* ]]; then
+            # Any '-' character in the version means that it is a prerelease
+            if [[ "${VERSION}" == *-* ]]; then
               echo "is-prerelease=true" >> "${GITHUB_OUTPUT}"
             fi
+
+            # Verify that the tag version matches the tool version
+            MAKEFILE_VERSION="$(make print-version)"
+            if [[ "${MAKEFILE_VERSION}" != "${VERSION}" ]]; then
+              echo "Makefile version '${MAKEFILE_VERSION}' does not match tag '${VERSION}'" >&2
+              exit 1
+            fi
           fi
 
       # Build the binaries
       - name: Setup Go
         uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version-file: '${{ inputs.tool-directory }}/go.mod'
-          cache-dependency-path: '${{ inputs.tool-directory }}/go.sum'
+          go-version-file: "${{ inputs.tool-directory }}/go.mod"
+          cache-dependency-path: "${{ inputs.tool-directory }}/go.sum"
 
       - name: Build the project
         working-directory: ${{ inputs.tool-directory }}
         run: |
+          set -euo pipefail
           make tarball OS=linux ARCH=amd64
           make tarball OS=linux ARCH=arm64
           make tarball OS=darwin ARCH=amd64
@@ -117,7 +128,9 @@ jobs:
         env:
           VERSION: ${{ steps.setup.outputs.version }}
           IS_PRERELEASE: ${{ steps.setup.outputs.is-prerelease }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          set -euo pipefail
           if [[ "${IS_PRERELEASE}" == 'true' ]]; then
             EXTRA_FLAGS=("--prerelease")
           else
@@ -134,4 +147,3 @@ jobs:
           gh release create --title "${TOOL_NAME} ${VERSION}" --verify-tag \
             --generate-notes "${EXTRA_FLAGS[@]}" "${GITHUB_REF_NAME}" \
             "${RELEASE_TARBALLS[@]}"
-

tools/env-loader/Makefile

@@ -1,4 +1,6 @@
 TOOL_NAME = env-loader
 PACKAGE_PATH = ./cmd/env-loader.go
+VERSION = v0.0.0-dev
+
 
 include ../repo-release-tooling/tooling.mk

tools/repo-release-tooling/tooling.mk

@@ -12,9 +12,12 @@ BINARY_NAME := $(BINARY_NAME).exe
 endif
 DOCKERFILE_PATH ?= ../repo-release-tooling/Dockerfile
 
-tool-name:
+print-tool-name:
 	@echo "$(TOOL_NAME)"
 
+print-version:
+	@echo "$(VERSION)"
+
 lint:
 	@golangci-lint run ./... --out-format colored-line-number -vvv
 
@@ -39,4 +42,4 @@ clean:
 	@rm -rf build/
 	@docker image rm -f "$(TOOL_NAME):$(CONTAINER_VERSION)" 2> /dev/null > /dev/null
 
-.PHONY: tool-name lint test binary tarball container-image clean
+.PHONY: print-tool-name print-version lint test binary tarball container-image clean