Context

Commit 14be9fb86 in github.com/mongodb-labs/drivers-github-tools fixed a typo in the secure-checkout/action.yml that was accidentally making it possible to checkout master in the golang/pre-publish action. While it was there, actions/checkout fell back to fetching every branch, so master was always available. Once this was patched and the Go driver bumped versions, releases are now failing.

See here for more details + remediation: https://docs.google.com/document/d/1n0z5SbuOFPg7apGC0Yo-rjFGnORJZVLFmHqLH5KEdAg/edit?tab=t.37d6i6wwze3a#heading=h.ke4v15ev7je3

Definition of done

We should add fetch-depth: 0 to .github/wofklows/release.yml in the pre-publish job: required for release/2.9 and master. Fetch-depth controls how much git history actions/checkout downloads, 0 means full history of all branches and tags.

Dry run should no longer be optional, it must be a preflight check to release.

Additionally, we should create an internal/cmd/release-preflight/main.go which should require flag inputs that align with the optional dry run in the "Use workflow form":

• Base branch
• The new version to set
• The previous tagged version

The preflight should include checks for:

• If the next branch is present: origin/master must be in the checkout (this catches the bug that caused the failures in 2.9.1 and 2.9.2)
• The checkout must have full history, which the merge into master needs
• The suggested tag must not exist which would stop a re-run of a release that was already partially completed.
• The previous tag must exist on the release branch which would catch a typo in the previous tagged version input for the workflow form
• version/version.go on the release branch must equal prev-version. That catches a tag pushed without the branch bump
• Nothing is waiting to merge up. The release branch must not have commits that aren’t on master. That lost the CVE data from GODRIVER-4075.

• Here is a POC generated by Claude:
  https://github.com/mongodb/mongo-go-driver/compare/master...prestonvasquez:mongo-go-driver:test/release-preflight

Example usage:

go run ./internal/cmd/release-preflight -remote upstream -release-branch release/2.9 -version 2.9.3 -prev-version 2.9.2

So the workflow should now be: dry-run -> pre-publish -> static-scan -> publish . In dry-run we:

• Run secure-checkout with fetch-depth: 0
• Run setup
• Do the release preflight defined in the Go driver
• Do pre-publish (dry run)

Pitfalls

Not investigated