feat(preflight): fail early when a secret or repository access is missing

A release run used to fail at the GoReleaser step when a secret was
empty, after the tests and the version job had finished.

A new preflight action checks the required names, the .Env references
in the GoReleaser config and push access to optional repositories. It
lists every problem in one run. The release and release-cgo workflows
run it in a first job, so a missing secret fails in seconds.

The release-cgo workflow requires GORELEASER_PRO. The release workflow
requires the secrets that the GoReleaser config references. Set the
preflight input to false to skip the check. Set preflight-repos to check
access to a Homebrew tap or helm-charts repository.

.github/workflows/go-release.yaml

@@ -38,6 +38,16 @@ on:
         required: false
         type: string
         default: ""
+      preflight:
+        description: "Fail early when a required secret, env var or GoReleaser .Env reference is missing"
+        required: false
+        type: boolean
+        default: true
+      preflight-repos:
+        description: "Comma-separated owner/repo list the token must have push access to (e.g. a Homebrew tap or helm-charts repo)"
+        required: false
+        type: string
+        default: ""
     outputs:
       version:
         description: "The calculated version (without v prefix)"
@@ -51,8 +61,30 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  preflight:
+    name: Preflight
+    runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest' || toJSON(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        if: inputs.preflight
+        uses: actions/checkout@v6
+        with:
+          lfs: false
+
+      - name: Check secrets and access
+        if: inputs.preflight
+        uses: lukaszraczylo/shared-actions/.github/actions/preflight@main
+        with:
+          require: GITHUB_TOKEN
+          repo-access: ${{ inputs.preflight-repos }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+
   test:
     name: Test
+    needs: preflight
     runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest' || toJSON(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
     timeout-minutes: 30
     steps: