AST-165915: stop forcing linux/amd64 on every container image

.github/workflows/Hooks-Release.yml

@@ -0,0 +1,77 @@
+name: Go Module Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to release as X.Y.Z, e.g. 1.2.3 (a leading 'v' is added automatically)"
+        required: true
+        type: string
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Tag & Publish Go Module
+    runs-on: cx-public-ubuntu-x64
+    permissions:
+      contents: write # required to create git tags and GitHub releases
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version-file: go.mod
+
+      # Validate version (bare X.Y.Z; the 'v' prefix is added by the tag action)
+      - name: Validate version input
+        env:
+          VERSION: ${{ github.event.inputs.version }}
+        run: |
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "❌ Invalid version format: $VERSION"
+            echo "Use format: X.Y.Z (e.g. 1.2.3) — do not include a leading 'v'"
+            exit 1
+          fi
+
+      # ✅ Build, vet, and test before tagging so a release never ships broken code
+      - name: Build and test
+        run: |
+          go build ./...
+          go vet ./...
+          go test ./... -count=1
+
+      # 🔑 Tag Creation
+      - name: Bump version and push tag
+        id: tag_version
+        uses: step-security/github-tag-action@9c71d71802cca8038be2220876265db07000b404 # v6.2.1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          tag_prefix: v
+          custom_tag: ${{ github.event.inputs.version }}
+
+      # 📦 Verify Go module
+      - name: Verify Go module
+        run: |
+          go list -m all
+          go mod tidy
+          go mod verify
+
+      # 📦 Create GitHub Release
+      - name: Create GitHub Release
+        uses: step-security/action-gh-release@277bfa82abcfdb73e5bbb19e213fd76532ee2be5 # v3.0.0
+        with:
+          tag_name: ${{ steps.tag_version.outputs.new_tag }}
+          name: Release ${{ steps.tag_version.outputs.new_tag }}
+          generate_release_notes: true

.github/workflows/ci.yml

@@ -6,12 +6,19 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   unit-tests:
+    name: Run unit tests
     runs-on: cx-public-ubuntu-x64
     steps:
       - name: Checkout the repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
 
       - name: Set up Go version
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0

.github/workflows/pr-name-validation.yml

@@ -9,16 +9,25 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   validate_jira_key:
+    name: Validate Jira key
     runs-on: cx-public-ubuntu-x64
     steps:
       - name: Validate Jira Key
         if: ${{ github.event_name != 'push' }}
+        env:
+          GH_API_URL: ${{ github.api_url }}
+          GH_REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.number }}
         run: |
           pr_title=$(curl -s \
                      -H "Accept: application/vnd.github.v3+json" \
-                     ${{ github.api_url }}/repos/${{ github.repository }}/pulls/${{ github.event.number }} | \
+                     "$GH_API_URL/repos/$GH_REPOSITORY/pulls/$PR_NUMBER" | \
                      jq -r '.title')
 
           if [[ ! $pr_title =~ (\(|\[)?[A-Z]+-[0-9]+(,[A-Z]+-[0-9]+)*(\)|\])? ]]; then