feat(go-release): add optional runner input (default ubuntu-latest)

Lets a caller run the release jobs on a self-hosted runner via with.runner,
e.g. runner: self-hosted. Defaults to ubuntu-latest so existing consumers are
unaffected.

.github/actions/goreleaser/action.yml

@@ -33,6 +33,18 @@ runs:
       run: |
         git config user.name "github-actions[bot]"
         git config user.email "github-actions[bot]@users.noreply.github.com"
+        # Fold any build-time source changes (e.g. version stamping by a
+        # repo-local workflow-prepare.sh) into the tagged commit. This is needed
+        # so consumers that fetch the tag's SOURCE — e.g. Yaegi-interpreted
+        # Traefik plugins, which Traefik never compiles — see the stamped value,
+        # and so GoReleaser's `release --clean` sees a clean working tree. The
+        # commit is reachable only via the tag; the branch is NOT advanced, so a
+        # source-tree placeholder (e.g. 0.0.0-dev on main) is preserved. No-op
+        # when the tree is already clean → unchanged for repos that don't stamp.
+        if ! git diff --quiet || ! git diff --cached --quiet; then
+          git add -A
+          git commit -m "chore(release): ${{ inputs.version-tag }}"
+        fi
         git tag -a ${{ inputs.version-tag }} -m "Release ${{ inputs.version-tag }}" || true
         if [[ "${{ inputs.mode }}" != "split" ]]; then
           git push origin ${{ inputs.version-tag }} || true

.github/workflows/go-release.yaml

@@ -33,6 +33,11 @@ on:
         required: false
         type: boolean
         default: false
+      runner:
+        description: "Runner label(s) for the release jobs. Defaults to ubuntu-latest; set to a self-hosted label (e.g. self-hosted) to run on your own runner."
+        required: false
+        type: string
+        default: "ubuntu-latest"
     outputs:
       version:
         description: "The calculated version (without v prefix)"
@@ -44,7 +49,7 @@ on:
 jobs:
   test:
     name: Test
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -67,7 +72,7 @@ jobs:
   version:
     name: Calculate Version
     needs: test
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     outputs:
       version: ${{ steps.semver.outputs.version }}
       version_tag: ${{ steps.semver.outputs.version_tag }}
@@ -96,7 +101,7 @@ jobs:
     name: Release
     needs: version
     if: needs.version.outputs.version_tag != ''
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     permissions:
       contents: write
       packages: write
@@ -109,6 +114,14 @@ jobs:
           lfs: ${{ inputs.lfs }}
 
       - name: Run workflow prepare script
+        # Expose the computed release version to a repo-local workflow-prepare.sh
+        # (e.g. to stamp the version into source for runtimes that cannot resolve
+        # it at build time, such as Yaegi-interpreted Traefik plugins). Only the
+        # release job has a version; the test/version jobs run the hook without
+        # it. VERSION is the bare semver (1.2.3); VERSION_TAG keeps the v prefix.
+        env:
+          VERSION: ${{ needs.version.outputs.version }}
+          VERSION_TAG: ${{ needs.version.outputs.version_tag }}
         shell: bash
         run: |
           if [ -f "./workflow-prepare.sh" ]; then