ci(gitops-engine): support tagged releases for gitops-engine

.github/workflows/init-release.yaml

@@ -12,7 +12,7 @@ on:
         required: true
         type: string
 
-permissions: {}
+permissions: { }
 
 env:
   # a workaround to disable harden runner
@@ -60,6 +60,14 @@ jobs:
           echo "Bumping version from $(cat VERSION) to ${{ inputs.TARGET_VERSION }}"
           echo "${{ inputs.TARGET_VERSION }}" > VERSION
 
+      - name: Update go.mod gitops-engine version to release tag
+        run: |
+          set -xue
+          # Update the require line to reference the gitops-engine tag that will be created at release time
+          # Handles both semver (v3.4.1) and pseudo-versions (v0.0.0-20260212142940-0cdd44bda77a)
+          GE_VERSION="v${{ inputs.TARGET_VERSION }}"
+          sed -i "s|github.com/argoproj/argo-cd/gitops-engine v[^ ]*|github.com/argoproj/argo-cd/gitops-engine ${GE_VERSION}|" go.mod
+
         # We install kustomize in the dist directory
       - name: Add dist to PATH
         run: |

.github/workflows/release.yaml

@@ -7,17 +7,17 @@ on:
       - '!v2.5*'
       - '!v2.6*'
 
-permissions: {}
+permissions: { }
 
 env:
   # renovate: datasource=golang-version packageName=golang
   GOLANG_VERSION: '1.26.3' # Note: go-version must also be set in job argocd-image.with.go-version  
   # a workaround to disable harden runner
   STEP_SECURITY_HARDEN_RUNNER: ${{ vars.disable_harden_runner }}
-  
+
 jobs:
   argocd-image:
-    needs: [setup-variables]
+    needs: [ setup-variables ]
     permissions:
       contents: read
       id-token: write # for creating OIDC tokens for signing.
@@ -101,7 +101,7 @@ jobs:
           echo "allow_fork_release=$ALLOW_FORK_RELEASE" >> $GITHUB_OUTPUT
 
   argocd-image-provenance:
-    needs: [setup-variables, argocd-image]
+    needs: [ setup-variables, argocd-image ]
     permissions:
       actions: read # for detecting the Github Actions environment.
       id-token: write # for creating OIDC tokens for signing.
@@ -193,7 +193,7 @@ jobs:
           echo "hashes=$hashes" >> $GITHUB_OUTPUT
 
   goreleaser-provenance:
-    needs: [goreleaser, setup-variables]
+    needs: [ goreleaser, setup-variables ]
     permissions:
       actions: read # for detecting the Github Actions environment
       id-token: write # Needed for provenance signing and ID
@@ -293,7 +293,7 @@ jobs:
             /tmp/sbom.tar.gz
 
   sbom-provenance:
-    needs: [generate-sbom, setup-variables]
+    needs: [ generate-sbom, setup-variables ]
     permissions:
       actions: read # for detecting the Github Actions environment
       id-token: write # Needed for provenance signing and ID
@@ -313,7 +313,7 @@ jobs:
       - goreleaser
       - generate-sbom
     permissions:
-      contents: write # Needed to push commit to update stable tag
+      contents: write # Needed to push commit to update stable and gitops-engine tags
       pull-requests: write # Needed to create PR for VERSION update.
     if: github.repository == 'argoproj/argo-cd' || needs.setup-variables.outputs.allow_fork_release == 'true'
     runs-on: ubuntu-24.04
@@ -338,6 +338,16 @@ jobs:
           git push -f origin stable
         if: ${{ env.TAG_STABLE == 'true' }}
 
+      - name: Tag gitops-engine submodule
+        run: |
+          set -xue
+          # Create a path-prefixed tag for gitops-engine
+          # so downstream consumers can resolve github.com/argoproj/argo-cd/gitops-engine
+          # https://go.dev/doc/modules/managing-source#multiple-module-source
+          GE_TAG="gitops-engine/${{ github.ref_name }}"
+          git tag "${GE_TAG}" ${{ github.ref_name }}
+          git push origin "${GE_TAG}"
+
       - name: Check to see if VERSION should be updated on master branch
         run: |
           set -xue

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/TomOnTime/utfutil v1.0.0
 	github.com/alicebob/miniredis/v2 v2.37.0
-	github.com/argoproj/argo-cd/gitops-engine v0.7.1-0.20250908182407-97ad5b59a627
+	github.com/argoproj/argo-cd/gitops-engine v0.0.0-20260507145512-134b428d78ca // Tagged as gitops-engine/vX.Y.Z at release time
 	github.com/argoproj/notifications-engine v0.5.1-0.20260503100631-0cff13b8a717
 	github.com/argoproj/pkg/v2 v2.0.1
 	github.com/aws/aws-sdk-go-v2 v1.41.7