feat!: migrate to git-cliff and rewrite gitops workflows

.github/workflows/_test-gh.yaml

@@ -1,4 +1,4 @@
-name: Test GitHub Release Workflow
+name: Test GitHub Release Workflow (git-cliff)
 
 on:
   pull_request:
@@ -9,82 +9,79 @@ on:
       - ".github/workflows/gh-release.yaml"
 
 jobs:
-  test_semantic_release_dry_run:
+  test_dry_run:
+    name: Test dry-run (whole repo)
     uses: ./.github/workflows/gh-release.yaml
     with:
-      use_semantic_release: true
       dry_run: true
 
-  test_outputs:
-    needs: test_semantic_release_dry_run
+  test_dry_run_outputs:
+    name: Validate dry-run outputs
+    needs: test_dry_run
     runs-on: ubuntu-latest
     steps:
-      - name: Display all outputs
+      - name: Display outputs
         run: |
-          echo "new_release_published: ${{ needs.test_semantic_release_dry_run.outputs.new_release_published }}"
-          echo "new_release_version: ${{ needs.test_semantic_release_dry_run.outputs.new_release_version }}"
-          echo "new_release_major_version: ${{ needs.test_semantic_release_dry_run.outputs.new_release_major_version }}"
-          echo "new_release_minor_version: ${{ needs.test_semantic_release_dry_run.outputs.new_release_minor_version }}"
-          echo "new_release_patch_version: ${{ needs.test_semantic_release_dry_run.outputs.new_release_patch_version }}"
-          echo "new_release_git_tag: ${{ needs.test_semantic_release_dry_run.outputs.new_release_git_tag }}"
-          echo "new_release_git_head: ${{ needs.test_semantic_release_dry_run.outputs.new_release_git_head }}"
+          echo "new_release_published: ${{ needs.test_dry_run.outputs.new_release_published }}"
+          echo "new_release_version: ${{ needs.test_dry_run.outputs.new_release_version }}"
+          echo "new_release_major_version: ${{ needs.test_dry_run.outputs.new_release_major_version }}"
+          echo "new_release_minor_version: ${{ needs.test_dry_run.outputs.new_release_minor_version }}"
+          echo "new_release_patch_version: ${{ needs.test_dry_run.outputs.new_release_patch_version }}"
+          echo "new_release_git_tag: ${{ needs.test_dry_run.outputs.new_release_git_tag }}"
+          echo "dry_run: ${{ needs.test_dry_run.outputs.dry_run }}"
 
-      - name: Validate outputs are set
+      - name: Validate dry_run flag
         run: |
-          if [ "${{ needs.test_semantic_release_dry_run.outputs.new_release_published }}" == "true" ]; then
-            echo "✅ New release will be published"
-            echo "   Version: ${{ needs.test_semantic_release_dry_run.outputs.new_release_version }}"
-            echo "   Git tag: ${{ needs.test_semantic_release_dry_run.outputs.new_release_git_tag }}"
-          else
-            echo "ℹ️  No new release needed"
+          if [ "${{ needs.test_dry_run.outputs.dry_run }}" != "true" ]; then
+            echo "::error::Expected dry_run to be true"
+            exit 1
           fi
+          echo "Dry run flag correctly set"
 
-  test_custom_tag_format:
+  test_scoped_dry_run:
+    name: Test dry-run (scoped with service_name)
     uses: ./.github/workflows/gh-release.yaml
     with:
-      use_semantic_release: true
+      service_name: test-service
+      service_path: tests/lambda/python
       dry_run: true
-      tag_format: "foo-v${version}"
 
-  test_working_directory:
-    uses: ./.github/workflows/gh-release.yaml
-    with:
-      working_directory: tests/lambda/python
-      dry_run: true
-
-  test_working_directory_outputs:
-    needs: test_working_directory
+  test_scoped_outputs:
+    name: Validate scoped outputs
+    needs: test_scoped_dry_run
     runs-on: ubuntu-latest
     steps:
-      - name: Display all outputs
+      - name: Display outputs
         run: |
-          echo "=== Working Directory Test Outputs ==="
-          echo "new_release_published: ${{ needs.test_working_directory.outputs.new_release_published }}"
-          echo "new_release_version: ${{ needs.test_working_directory.outputs.new_release_version }}"
-          echo "new_release_major_version: ${{ needs.test_working_directory.outputs.new_release_major_version }}"
-          echo "new_release_minor_version: ${{ needs.test_working_directory.outputs.new_release_minor_version }}"
-          echo "new_release_patch_version: ${{ needs.test_working_directory.outputs.new_release_patch_version }}"
-          echo "new_release_git_tag: ${{ needs.test_working_directory.outputs.new_release_git_tag }}"
-          echo "new_release_git_head: ${{ needs.test_working_directory.outputs.new_release_git_head }}"
+          echo "new_release_published: ${{ needs.test_scoped_dry_run.outputs.new_release_published }}"
+          echo "new_release_version: ${{ needs.test_scoped_dry_run.outputs.new_release_version }}"
+          echo "new_release_git_tag: ${{ needs.test_scoped_dry_run.outputs.new_release_git_tag }}"
 
-      - name: Validate first release
+      - name: Validate scoped tag format
+        if: needs.test_scoped_dry_run.outputs.new_release_published == 'true'
         run: |
-          if [ "${{ needs.test_working_directory.outputs.new_release_published }}" != "true" ]; then
-            echo "❌ Expected new_release_published to be true"
+          TAG="${{ needs.test_scoped_dry_run.outputs.new_release_git_tag }}"
+          if [[ "$TAG" != test-service-v* ]]; then
+            echo "::error::Expected tag to start with 'test-service-v', got: $TAG"
             exit 1
           fi
+          echo "Scoped tag format correct: $TAG"
 
-          if [ "${{ needs.test_working_directory.outputs.new_release_version }}" != "1.0.0" ]; then
-            echo "❌ Expected version to be 1.0.0 (first release), got: ${{ needs.test_working_directory.outputs.new_release_version }}"
-            exit 1
-          fi
+  test_pr_dry_run:
+    name: Test PR context (auto dry-run)
+    uses: ./.github/workflows/gh-release.yaml
+    with:
+      dry_run: false
 
-          if [ "${{ needs.test_working_directory.outputs.new_release_git_tag }}" != "python-lambda-v1.0.0" ]; then
-            echo "❌ Expected tag to be python-lambda-v1.0.0, got: ${{ needs.test_working_directory.outputs.new_release_git_tag }}"
+  test_pr_dry_run_outputs:
+    name: Validate PR forces dry-run
+    needs: test_pr_dry_run
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate PR context forces dry_run
+        run: |
+          if [ "${{ needs.test_pr_dry_run.outputs.dry_run }}" != "true" ]; then
+            echo "::error::Expected dry_run to be true in PR context"
             exit 1
           fi
-
-          echo "✅ Working directory test passed!"
-          echo "   Version: ${{ needs.test_working_directory.outputs.new_release_version }}"
-          echo "   Git tag: ${{ needs.test_working_directory.outputs.new_release_git_tag }}"
-          echo "   Tag format from .releaserc.json was correctly applied"
+          echo "PR context correctly forces dry-run"

.github/workflows/_test-gitops-image-tag.yaml

@@ -0,0 +1,56 @@
+name: Test GitOps Image Tag Workflow
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/_test-gitops-image-tag.yaml"
+      - ".github/workflows/gitops-image-tag.yaml"
+
+jobs:
+  test_image_mode_dry_run:
+    name: Test image mode (dry-run)
+    uses: ./.github/workflows/gitops-image-tag.yaml
+    with:
+      image_tag: "abc1234"
+      image_name: "my-app"
+      values_files: "tests/gitops-image-tag/values.yaml"
+      create_pr: false
+      dry_run: true
+
+  test_key_mode_dry_run:
+    name: Test key mode (dry-run)
+    uses: ./.github/workflows/gitops-image-tag.yaml
+    with:
+      image_tag: "abc1234"
+      image_tag_keys: |
+        webapp.image.tag
+        sidecar.image.tag
+      values_files: "tests/gitops-image-tag/values.yaml"
+      create_pr: false
+      dry_run: true
+
+  test_validation_fails_without_mode:
+    name: Test validation (no image_name or keys)
+    uses: ./.github/workflows/gitops-image-tag.yaml
+    with:
+      image_tag: "abc1234"
+      values_files: "tests/gitops-image-tag/values.yaml"
+      create_pr: false
+      dry_run: true
+    # This job is expected to fail — validation rejects missing image_name + image_tag_keys
+    continue-on-error: true
+
+  validate_failure:
+    name: Validate input validation works
+    needs: test_validation_fails_without_mode
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check that validation job failed
+        run: |
+          if [ "${{ needs.test_validation_fails_without_mode.result }}" != "failure" ]; then
+            echo "::error::Expected validation job to fail when neither image_name nor image_tag_keys is provided"
+            exit 1
+          fi
+          echo "Input validation correctly rejected missing mode inputs"