ci(goreleaser): commit build-time source changes into the tagged commit

Before tagging, fold any working-tree changes left by a repo-local workflow-prepare.sh (e.g. version stamping) into the tagged commit. Without this the tag captured the unstamped source AND GoReleaser's 'release --clean' failed on the dirty tree. The commit is reachable only via the tag (the branch is not pushed), so a 0.0.0-dev placeholder on main is preserved. No-op when the tree is clean, so repos that do not stamp are unaffected.

.github/actions/goreleaser/action.yml

@@ -33,6 +33,18 @@ runs:
       run: |
         git config user.name "github-actions[bot]"
         git config user.email "github-actions[bot]@users.noreply.github.com"
+        # Fold any build-time source changes (e.g. version stamping by a
+        # repo-local workflow-prepare.sh) into the tagged commit. This is needed
+        # so consumers that fetch the tag's SOURCE — e.g. Yaegi-interpreted
+        # Traefik plugins, which Traefik never compiles — see the stamped value,
+        # and so GoReleaser's `release --clean` sees a clean working tree. The
+        # commit is reachable only via the tag; the branch is NOT advanced, so a
+        # source-tree placeholder (e.g. 0.0.0-dev on main) is preserved. No-op
+        # when the tree is already clean → unchanged for repos that don't stamp.
+        if ! git diff --quiet || ! git diff --cached --quiet; then
+          git add -A
+          git commit -m "chore(release): ${{ inputs.version-tag }}"
+        fi
         git tag -a ${{ inputs.version-tag }} -m "Release ${{ inputs.version-tag }}" || true
         if [[ "${{ inputs.mode }}" != "split" ]]; then
           git push origin ${{ inputs.version-tag }} || true

.github/workflows/go-release.yaml

@@ -109,6 +109,14 @@ jobs:
           lfs: ${{ inputs.lfs }}
 
       - name: Run workflow prepare script
+        # Expose the computed release version to a repo-local workflow-prepare.sh
+        # (e.g. to stamp the version into source for runtimes that cannot resolve
+        # it at build time, such as Yaegi-interpreted Traefik plugins). Only the
+        # release job has a version; the test/version jobs run the hook without
+        # it. VERSION is the bare semver (1.2.3); VERSION_TAG keeps the v prefix.
+        env:
+          VERSION: ${{ needs.version.outputs.version }}
+          VERSION_TAG: ${{ needs.version.outputs.version_tag }}
         shell: bash
         run: |
           if [ -f "./workflow-prepare.sh" ]; then