feat: draft releases, version verification, and reusable workflows (#210)

* feat: draft releases, version verification, and reusable workflows

* fix: run verify-version in parallel with pack and use msbuild for .csproj parsing

- Remove `needs: [pack]` from verify-version so it runs immediately on
  tag pushes for fast failure
- Add `pack` to publish's needs so it still gates on the artifact
- Replace grep-based XML parsing with `dotnet msbuild -getProperty:Version`
- Add trailing newline to file

Author: SoulPancake

.github/workflows/main.yaml

@@ -202,10 +202,40 @@ jobs:
             artifact-pack/*.snupkg
           retention-days: 7
 
+  verify-version:
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-test')
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+        with:
+          dotnet-version: 8.0.x
+
+      - name: Verify versions match
+        run: |
+          TAG_VERSION="${GITHUB_REF#refs/tags/v}"
+          MANIFEST_VERSION=$(jq -r '.["."]' .release-please-manifest.json)
+          CSPROJ_VERSION=$(dotnet msbuild src/OpenFga.Sdk/OpenFga.Sdk.csproj -getProperty:Version -p:TargetFramework=net8.0 -noRestore -nologo | tr -d '[:space:]')
+
+          echo "Tag: $TAG_VERSION | Manifest: $MANIFEST_VERSION | .csproj: $CSPROJ_VERSION"
+
+          if [[ "$TAG_VERSION" != "$MANIFEST_VERSION" ]]; then
+            echo "ERROR: Tag version does not match manifest version"
+            exit 1
+          fi
+          if [[ "$CSPROJ_VERSION" != "$MANIFEST_VERSION" ]]; then
+            echo "ERROR: .csproj version does not match manifest version"
+            exit 1
+          fi
+          echo "All versions verified: $TAG_VERSION"
+
   publish:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-test')
-    needs: [pack]
+    needs: [pack, verify-version]
     permissions:
       id-token: write # For OIDC authentication with NuGet.org
       packages: write # For publishing to the GitHub Nuget Registry
@@ -246,24 +276,9 @@ jobs:
 
 
 
-  create-release:
-    runs-on: ubuntu-latest
+  undraft-release:
     if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-test')
     needs: [publish]
-
     permissions:
       contents: write
-
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
-        with:
-          fetch-depth: 0
-
-      - uses: Roang-zero1/github-create-release-action@57eb9bdce7a964e48788b9e78b5ac766cb684803 # v3.0.1
-        with:
-          version_regex: ^v[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+
-          prerelease_regex: ^v[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+-(alpha|beta|preview)\.[[:digit:]]+$
-          changelog_file: CHANGELOG.md
-          create_draft: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    uses: openfga/sdk-generator/.github/workflows/undraft-release.yml@main

.github/workflows/pr-title-conventional-commit.yml

@@ -7,15 +7,8 @@ on:
       - main
 
 jobs:
-  validate-pr-title:
-    name: Validate PR Title
-    runs-on: ubuntu-latest
+  pr-title-check:
     permissions:
       pull-requests: read
-    steps:
-      - name: PR Conventional Commit Validation
-        uses: ytanikin/pr-conventional-commits@639145d78959c53c43112365837e3abd21ed67c1 # v1.5.2
-        with:
-          task_types: '["feat","fix","docs","test","refactor","ci","perf","chore","revert","release"]'
-          add_label: 'false'
+    uses: openfga/sdk-generator/.github/workflows/pr-title-check.yml@main
 

release-please-config.json

@@ -2,6 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
   "release-type": "simple",
   "pull-request-title-pattern": "release: v${version}",
+  "draft": true,
   "packages": {
     ".": {
       "package-name": "",