chore: update checks for modfiles (#91)

## Description

Adds some guardrails to release while cross-team talks happen for
release engineering of `pkg`.

Author: Racer159

.github/actions/bump-and-notes/action.yaml

@@ -4,6 +4,9 @@ inputs:
   module:
     description: "The module to be released"
     required: true
+  pr-title:
+    description: "The PR Title that will be merged"
+    default: ""
 
 outputs:
   new-version:
@@ -23,10 +26,13 @@ runs:
     - name: bump module version
       env:
         MODULE: ${{ inputs.module }}
+        PR_TITLE: ${{ inputs.pr-title }}
       id: bump-version
+      # We run the go mod check twice and outside echo so as to not swallow the exit code / error message
       run: |
         cd internal/release
-        echo "new-version=$(go run main.go "$MODULE")" >> "$GITHUB_OUTPUT"
+        go run main.go "$MODULE" "$PR_TITLE"
+        echo "new-version=$(go run main.go "$MODULE" "$PR_TITLE")" >> "$GITHUB_OUTPUT"
       shell: bash
 
     - name: install git cliff

.github/workflows/check-exec.yaml

@@ -0,0 +1,29 @@
+name: Check Exec
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, edited, synchronize]
+    paths:
+      - "exec/**"
+
+permissions:
+  contents: read
+
+jobs:
+  bump-version-and-release-notes:
+    runs-on: ubuntu-latest
+    outputs:
+      new-version: ${{ steps.bump-version.outputs.new-version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        with:
+          fetch-depth: 0
+
+      - name: Bump Version and Generate Release Notes
+        uses: ./.github/actions/bump-and-notes
+        id: bump-version
+        with:
+          module: "exec"
+          pr-title: ${{ github.event.pull_request.title }}

.github/workflows/check-helpers.yaml

@@ -0,0 +1,29 @@
+name: Check Helpers
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, edited, synchronize]
+    paths:
+      - "helpers/**"
+
+permissions:
+  contents: read
+
+jobs:
+  bump-version-and-release-notes:
+    runs-on: ubuntu-latest
+    outputs:
+      new-version: ${{ steps.bump-version.outputs.new-version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        with:
+          fetch-depth: 0
+
+      - name: Bump Version and Generate Release Notes
+        uses: ./.github/actions/bump-and-notes
+        id: bump-version
+        with:
+          module: "helpers"
+          pr-title: ${{ github.event.pull_request.title }}

.github/workflows/check-oci.yaml

@@ -0,0 +1,29 @@
+name: Check OCI
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, edited, synchronize]
+    paths:
+      - "oci/**"
+
+permissions:
+  contents: read
+
+jobs:
+  bump-version-and-release-notes:
+    runs-on: ubuntu-latest
+    outputs:
+      new-version: ${{ steps.bump-version.outputs.new-version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        with:
+          fetch-depth: 0
+
+      - name: Bump Version and Generate Release Notes
+        uses: ./.github/actions/bump-and-notes
+        id: bump-version
+        with:
+          module: "oci"
+          pr-title: ${{ github.event.pull_request.title }}

helpers/transport.go

@@ -93,5 +93,6 @@ func (t *Transport) roundTrip(req *http.Request) (resp *http.Response, err error
 			t.ProgressBar.Write(b)
 		}
 	}
+
 	return resp, err
 }

internal/release/main.go

@@ -11,6 +11,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"sort"
+	"strconv"
 	"strings"
 
 	"github.com/Masterminds/semver"
@@ -29,29 +30,55 @@ func getProjectPath() (string, error) {
 	return filepath.Dir(filepath.Dir(wd)), nil
 }
 
-func validateModFile(path string) error {
+func validateModFile(path string, version *semver.Version) error {
 	// Ensure the path is consistent with the go mod
 	baseProjectPath, err := getProjectPath()
 	if err != nil {
 		return err
 	}
+
 	modPath := filepath.Join(baseProjectPath, path, "go.mod")
 	bytes, err := os.ReadFile(modPath)
 	if err != nil {
 		return err
 	}
+
 	modFile, err := modfile.Parse(modPath, bytes, nil)
 	if err != nil {
 		return err
 	}
+
+	actualModPath := modFile.Module.Mod.Path
+	var actualMajorVersion int64
+
+	// Strip the /vX from the end of any mod paths
+	actualModPathSections := strings.Split(actualModPath, "/")
+	if len(actualModPathSections) == 5 {
+		actualModPath = strings.Join(actualModPathSections[:4], "/")
+		actualMajorVersion, err = strconv.ParseInt(strings.TrimPrefix(actualModPathSections[4], "v"), 10, 0)
+		if err != nil {
+			return err
+		}
+	}
+
+	// Check that the mod path is what we expect
 	expectedModPath := fmt.Sprintf("github.com/defenseunicorns/pkg/%s", path)
-	if expectedModPath != modFile.Module.Mod.Path {
+	if expectedModPath != actualModPath {
 		return fmt.Errorf("the module name is incorrect or a %s does not exist as a module", path)
 	}
+
+	// Check that the mod version is what we expect
+	expectedMajorVersion := version.Major()
+	if actualMajorVersion == 0 && expectedMajorVersion > 1 {
+		return fmt.Errorf("the module name does not end in /v%d for a major version > 1", expectedMajorVersion)
+	} else if actualMajorVersion > 1 && actualMajorVersion != expectedMajorVersion {
+		return fmt.Errorf("the expected module version /v%d does not match /v%d", expectedMajorVersion, actualMajorVersion)
+	}
+
 	return nil
 }
 
-func bumpVersion(module string) (*semver.Version, error) {
+func bumpVersion(module string, prTitle string) (*semver.Version, error) {
 	repoPath, err := getProjectPath()
 	if err != nil {
 		return nil, err
@@ -92,6 +119,11 @@ func bumpVersion(module string) (*semver.Version, error) {
 	if err != nil {
 		return nil, err
 	}
+
+	if prTitle != "" {
+		commits = append(commits, prTitle)
+	}
+
 	if len(commits) == 0 {
 		return nil, fmt.Errorf("no commits affecting module %s since last tag", module)
 	}
@@ -222,20 +254,29 @@ func getTypeOfChange(commits []string) string {
 }
 
 func main() {
-	if len(os.Args) != 2 {
+	if len(os.Args) < 2 {
 		panic("this program should be called with the module name. For example, \"go run main.go helpers\"")
 	}
+
+	var prCommitMsg string
+	if len(os.Args) == 3 {
+		prCommitMsg = os.Args[2]
+	}
+
 	module := os.Args[1]
-	err := validateModFile(module)
+
+	newVersion, err := bumpVersion(module, prCommitMsg)
 	if err != nil {
 		fmt.Println("Error: ", err)
 		os.Exit(1)
 	}
-	newVersion, err := bumpVersion(module)
+
+	err = validateModFile(module, newVersion)
 	if err != nil {
 		fmt.Println("Error: ", err)
 		os.Exit(1)
 	}
+
 	fmt.Printf("%s/v%s", module, newVersion.String())
 	os.Exit(0)
 }