From 012a035eaa5fb9eb4bb333dda749ad61e3f01a21 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 08:44:35 -0400
Subject: [PATCH 01/76] wip - releaser to gha

---
 .github/workflows/release.yml                | 66 ++++++++++++++++++
 scripts/release/publish-dry-run.sh           | 23 ++++++
 scripts/release/publish-runners/bitbucket.sh | 41 +++++++++++
 scripts/release/publish-runners/circleci.sh  | 73 ++++++++++++++++++++
 scripts/release/publish-runners/gha.sh       | 61 ++++++++++++++++
 scripts/release/publish.sh                   | 20 ++++++
 scripts/release/update-version.sh            | 37 ++++++++++
 7 files changed, 321 insertions(+)
 create mode 100644 .github/workflows/release.yml
 create mode 100755 scripts/release/publish-dry-run.sh
 create mode 100755 scripts/release/publish-runners/bitbucket.sh
 create mode 100755 scripts/release/publish-runners/circleci.sh
 create mode 100755 scripts/release/publish-runners/gha.sh
 create mode 100755 scripts/release/publish.sh
 create mode 100755 scripts/release/update-version.sh

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 000000000..87957afe3
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,66 @@
+on:
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        description: Perform a dry-run only
+        required: false
+        type: boolean
+      releaseVersion:
+        description: Next release version
+        required: true
+        type: string
+      changeLog:
+        description: Pending changelog
+        required: true
+        type: string
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    env:
+      LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
+      GH_TOKEN: ${{ secrets.BOT_TOKEN }}
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
+      CIRCLECI_CLI_TOKEN: ${{ secrets.CIRCLECI_CLI_TOKEN }}
+      BITBUCKET_USERNAME: ${{ secrets.BITBUCKET_USERNAME }}
+      BITBUCKET_TOKEN: ${{ secrets.BITBUCKET_TOKEN }}
+      DRY_RUN: ${{ inputs.dryRun }}
+      ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
+    steps:
+      - uses: actions/checkout@v4
+      # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.1.0
+      #   name: Get secrets
+      #   with:
+      #     aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
+      #     s3_path_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
+      - name: update-version
+        run: |
+          ./scripts/release/update-version.sh
+      - name: build
+        run: |
+          if [[ $LD_RELEASE_VERSION == v* ]]; then
+            echo "Remove v prefix from version: $LD_RELEASE_VERSION"
+            exit 1
+          fi
+
+          make build
+      - name: publish
+        run: |
+          if [[ "$DRY_RUN" = true ]]; then
+            ./scripts/release/publish-dry-run.sh
+          else
+            ./scripts/release/publish.sh
+          fi
+  # create-release:
+  #   runs-on: ubuntu-latest
+  #   permissions:
+  #     contents: write
+  #   needs: release
+  #   steps:
+  #     - uses: ncipollo/release-action@v1.14.0
+  #       with:
+  #         token: ${{ secrets.BOT_TOKEN }}
+  #         tag: v${{ inputs.releaseVersion }}
+  #         body: ${{ inputs.changeLog }}
+
diff --git a/scripts/release/publish-dry-run.sh b/scripts/release/publish-dry-run.sh
new file mode 100755
index 000000000..761f041ef
--- /dev/null
+++ b/scripts/release/publish-dry-run.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+sudo docker login --username ${DOCKER_USERNAME} --password-stdin ${DOCKER_TOKEN}
+
+sudo PATH=${PATH} GITHUB_TOKEN=${GITHUB_TOKEN} make products-for-release
+
+# Copy the Docker image that goreleaser just built into the artifacts - we only do
+# this in a dry run, because in a real release the image will be available from
+# DockerHub anyway so there's no point in attaching it to the release.
+BASE_CODEREFS=ld-find-code-refs
+GH_CODEREFS=ld-find-code-refs-github-action
+BB_CODEREFS=ld-find-code-refs-bitbucket-pipeline
+sudo docker save launchdarkly/${BASE_CODEREFS}:latest | gzip >${ARTIFACT_DIRECTORY}/${BASE_CODEREFS}.tar.gz
+sudo docker save launchdarkly/${GH_CODEREFS}:latest | gzip >${ARTIFACT_DIRECTORY}/${GH_CODEREFS}.tar.gz
+sudo docker save launchdarkly/${BB_CODEREFS}:latest | gzip >${ARTIFACT_DIRECTORY}/${BB_CODEREFS}.tar.gz
+
+for script in $(dirname $0)/publish-runners/*.sh; do
+  source script
+done
+
+dry_run_gha
+dry_run_circleci
+dry_run_bitbucket
diff --git a/scripts/release/publish-runners/bitbucket.sh b/scripts/release/publish-runners/bitbucket.sh
new file mode 100755
index 000000000..4821c7a3e
--- /dev/null
+++ b/scripts/release/publish-runners/bitbucket.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+
+# Run this in publish step after all version information have been updated.
+set -ev
+
+setup() (
+  rm -rf bitbucketMetadataUpdates
+  mkdir -p bitbucketMetadataUpdates
+  git clone "https://${BITBUCKET_USERNAME}:${BITBUCKET_TOKEN}@bitbucket.org/launchdarkly/ld-find-code-refs-pipe.git" bitbucketMetadataUpdates
+  cp build/metadata/bitbucket/* bitbucketMetadataUpdates/
+  cp CHANGELOG.md bitbucketMetadataUpdates/
+  cd bitbucketMetadataUpdates
+  git config user.email "launchdarklyreleasebot@launchdarkly.com"
+  git config user.name "LaunchDarklyReleaseBot"
+  git add -u
+  git commit -m "Release auto update version $LD_RELEASE_VERSION"
+  git remote add bb-origin "https://${BITBUCKET_USERNAME}:${BITBUCKET_TOKEN}@bitbucket.org/launchdarkly/ld-find-code-refs-pipe.git"
+)
+
+clean_up() (
+  cd .. && rm -rf bitbucketMetadataUpdates
+)
+
+publish_bitbucket() (
+  setup
+
+  echo "Live run: will publish pipe to bitbucket."
+  git tag $LD_RELEASE_VERSION
+  git push bb-origin master --tags
+
+  clean_up
+)
+
+dry_run_bitbucket() (
+  setup
+
+  echo "Dry run: will not publish pipe to bitbucket."
+  git push bb-origin master --tags --dry-run
+
+  clean_up
+)
diff --git a/scripts/release/publish-runners/circleci.sh b/scripts/release/publish-runners/circleci.sh
new file mode 100755
index 000000000..4406debfc
--- /dev/null
+++ b/scripts/release/publish-runners/circleci.sh
@@ -0,0 +1,73 @@
+#!/bin/bash
+
+# Run this in publish step after all version information have been updated.
+set -ev
+
+CIRCLECI_CLI_HOST="https://circleci.com"
+
+install_circleci() (
+  # Install the CircleCI CLI tool.
+  # https://github.com/CircleCI-Public/circleci-cli
+  # Dependencies: curl, cut
+  # The version to install and the binary location can be passed in via VERSION and DESTDIR respectively.
+
+  # GitHub's URL for the latest release, will redirect.
+  local GITHUB_BASE_URL="https://github.com/CircleCI-Public/circleci-cli"
+  local LATEST_URL="${GITHUB_BASE_URL}/releases/latest/"
+  local DESTDIR="${DESTDIR:-/usr/local/bin}"
+  local VERSION=$(curl -sLI -o /dev/null -w '%{url_effective}' "$LATEST_URL" | cut -d "v" -f 2)
+
+  # Run the script in a temporary directory that we know is empty.
+  local SCRATCH=$(mktemp -d || mktemp -d -t 'tmp')
+  cd "$SCRATCH"
+
+  error() (
+    echo "An error occured installing the tool."
+    echo "The contents of the directory $SCRATCH have been left in place to help to debug the issue."
+  )
+
+  trap error ERR
+
+  case "$(uname)" in
+    Linux)
+      OS='linux'
+    ;;
+    Darwin)
+      OS='darwin'
+    ;;
+    *)
+      echo "This operating system is not supported."
+      exit 1
+    ;;
+  esac
+
+  local RELEASE_URL="${GITHUB_BASE_URL}/releases/download/v${VERSION}/circleci-cli_${VERSION}_${OS}_amd64.tar.gz"
+
+  # Download & unpack the release tarball.
+  curl -sL --retry 3 "${RELEASE_URL}" | tar zx --strip 1
+  install circleci "$DESTDIR"
+  command -v circleci
+
+  # Delete the working directory when the install was successful.
+  rm -r "$SCRATCH"
+)
+
+validate_circleci_orb_config() (
+  circleci orb validate build/package/circleci/orb.yml || (echo "Unable to validate orb"; exit 1)
+)
+
+publish_circleci() (
+  install_circleci
+  validate_circleci_orb_config
+
+  echo "Live run: will publish orb to production circleci repo."
+  circleci orb publish build/package/circleci/orb.yml launchdarkly/ld-find-code-refs@$LD_RELEASE_VERSION --token $CIRCLECI_CLI_TOKEN --host $CIRCLECI_CLI_HOST
+)
+
+dry_run_circleci() (
+  install_circleci
+  validate_circleci_orb_config
+
+  echo "Dry run: will not publish orb to production. Will publish to circleci dev repo instead."
+  circleci orb publish build/package/circleci/orb.yml launchdarkly/ld-find-code-refs@dev:$LD_RELEASE_VERSION --token $CIRCLECI_CLI_TOKEN --host $CIRCLECI_CLI_HOST
+)
diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
new file mode 100755
index 000000000..aa1fa3f3d
--- /dev/null
+++ b/scripts/release/publish-runners/gha.sh
@@ -0,0 +1,61 @@
+#!/bin/bash
+
+# Run this in publish step after all version information have been updated.
+set -ev
+
+RELEASE_TAG="v${LD_RELEASE_VERSION}"
+RELEASE_NOTES="$(make echo-release-notes)"
+
+# All users of github action to reference major version tag
+VERSION_MAJOR="${LD_RELEASE_VERSION%%\.*}"
+RELEASE_TAG_MAJOR="v${VERSION_MAJOR}"
+
+setup() (
+  # install gh cli so we can create a release later https://github.com/cli/cli/blob/trunk/docs/install_linux.md
+  curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
+  echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
+  sudo apt update
+  sudo apt install gh
+
+  # use gh cli to login to github and set up git credentials
+  gh auth login --with-token < $GITHUB_TOKEN
+  gh auth setup-git
+
+  # clone checkout commit and push all metadata changes to gha repo
+  rm -rf githubActionsMetadataUpdates
+  mkdir -p githubActionsMetadataUpdates
+  gh repo clone launchdarkly/find-code-references githubActionsMetadataUpdates
+  cp build/metadata/github-actions/* githubActionsMetadataUpdates
+  cd githubActionsMetadataUpdates
+  git config user.email "launchdarklyreleasebot@launchdarkly.com"
+  git config user.name "LaunchDarklyReleaseBot"
+  git add -u
+  git commit -m "Release auto update version $LD_RELEASE_VERSION"
+)
+
+clean_up() (
+  cd .. && rm -rf githubActionsMetadataUpdates
+)
+
+publish_gha() (
+  setup
+
+  echo "Live run: will publish action to github action marketplace."
+  # tag the commit with the release version and create release
+  git tag $RELEASE_TAG
+  git push origin main --tags
+  git tag -f $RELEASE_TAG_MAJOR
+  git push -f origin $RELEASE_TAG_MAJOR
+  gh release create $RELEASE_TAG --notes "$RELEASE_NOTES"
+
+  clean_up
+)
+
+dry_run_gha() (
+  setup
+
+  echo "Dry run: will not publish action to github action marketplace."
+  git push origin main --tags --dry-run
+
+  clean_up
+)
diff --git a/scripts/release/publish.sh b/scripts/release/publish.sh
new file mode 100755
index 000000000..0ef5aa5dd
--- /dev/null
+++ b/scripts/release/publish.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+sudo docker login --username ${DOCKER_USERNAME} --password-stdin ${DOCKER_TOKEN}
+
+sudo PATH=${PATH} GITHUB_TOKEN=${GITHUB_TOKEN} make publish
+
+# make bitbucket and github known hosts to push successfully
+mkdir –m700 ~/.ssh
+touch ~/.ssh/known_hosts
+chmod 644 ~/.ssh/known_hosts
+ssh-keyscan -t rsa bitbucket.org >> ~/.ssh/known_hosts
+ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts
+
+for script in $(dirname $0)/publish-runners/*.sh; do
+  source script
+done
+
+publish_gha
+publish_circleci
+publish_bitbucket
diff --git a/scripts/release/update-version.sh b/scripts/release/update-version.sh
new file mode 100755
index 000000000..6575bff3a
--- /dev/null
+++ b/scripts/release/update-version.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+set -e
+
+RELEASE_TAG="v${LD_RELEASE_VERSION}"
+
+update_go() (
+  VERSION_GO=internal/version/version.go
+  sed -i "s/const Version =.*/const Version = \"${LD_RELEASE_VERSION}\"/g" ${VERSION_GO}
+)
+
+update_orb() (
+  VERSION_ORB=build/package/circleci/orb.yml
+  sed -i "s#launchdarkly: launchdarkly/ld-find-code-refs@.*#launchdarkly: launchdarkly/ld-find-code-refs@${LD_RELEASE_VERSION}#g" ${VERSION_ORB}
+  sed -i "s#- image: launchdarkly/ld-find-code-refs:.*#- image: launchdarkly/ld-find-code-refs:${LD_RELEASE_VERSION}#g" ${VERSION_ORB}
+)
+
+update_gha() (
+  README=build/metadata/github-actions/README.md
+  sed -i "s#launchdarkly/find-code-references@v.*#launchdarkly/find-code-references@${RELEASE_TAG}#g" ${README}
+
+  DOCKERFILE=build/metadata/github-actions/Dockerfile
+  sed -i "s#launchdarkly/ld-find-code-refs-github-action:.*#launchdarkly/ld-find-code-refs-github-action:${LD_RELEASE_VERSION}#g" ${DOCKERFILE}
+)
+
+update_bitbucket() (
+  README=build/metadata/bitbucket/README.md
+  sed -i "s#- pipe: launchdarkly/ld-find-code-refs-pipe.*#- pipe: launchdarkly/ld-find-code-refs-pipe:${LD_RELEASE_VERSION}#g" ${README}
+
+  YML=build/metadata/bitbucket/pipe.yml
+  sed -i "s#image: launchdarkly/ld-find-code-refs-bitbucket-pipeline:.*#image: launchdarkly/ld-find-code-refs-bitbucket-pipeline:${LD_RELEASE_VERSION}#g" ${YML}
+)
+
+update_go
+update_orb
+update_gha
+update_bitbucket

From bd3c806943c36d9a8d878ab02f682664fde604d2 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 09:32:50 -0400
Subject: [PATCH 02/76] force gha workflow


From 56ceffec52fc311928b4fb61ef32bd94397588d0 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 09:34:00 -0400
Subject: [PATCH 03/76] give workflow a name

---
 .github/workflows/release.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 87957afe3..725451f3b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,3 +1,5 @@
+name: Release
+
 on:
   workflow_dispatch:
     inputs:

From 793faf5950309bfce0993b607e56d6392ba99af5 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 09:51:52 -0400
Subject: [PATCH 04/76] hack to enable the action to run on my branch

---
 .github/workflows/release.yml | 37 ++++++++++++++++++++---------------
 1 file changed, 21 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 725451f3b..7fb100260 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,33 +1,38 @@
 name: Release
 
 on:
-  workflow_dispatch:
-    inputs:
-      dryRun:
-        description: Perform a dry-run only
-        required: false
-        type: boolean
-      releaseVersion:
-        description: Next release version
-        required: true
-        type: string
-      changeLog:
-        description: Pending changelog
-        required: true
-        type: string
+  pull_request
+  # workflow_dispatch:
+  #   inputs:
+  #     dryRun:
+  #       description: Perform a dry-run only
+  #       required: false
+  #       type: boolean
+  #     releaseVersion:
+  #       description: Next release version
+  #       required: true
+  #       type: string
+  #     changeLog:
+  #       description: Pending changelog
+  #       required: true
+  #       type: string
 
 jobs:
   release:
     runs-on: ubuntu-latest
     env:
-      LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
+      # temporary ENV VARs for input; this is only because workflow_dispatch
+      # actions can only run on main for some reason
+      LD_RELEASE_VERSION: 2.14.0
+      # LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
       GH_TOKEN: ${{ secrets.BOT_TOKEN }}
       DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
       CIRCLECI_CLI_TOKEN: ${{ secrets.CIRCLECI_CLI_TOKEN }}
       BITBUCKET_USERNAME: ${{ secrets.BITBUCKET_USERNAME }}
       BITBUCKET_TOKEN: ${{ secrets.BITBUCKET_TOKEN }}
-      DRY_RUN: ${{ inputs.dryRun }}
+      DRY_RUN: true
+      # DRY_RUN: ${{ inputs.dryRun }}
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
     steps:
       - uses: actions/checkout@v4

From c4f63d2f60e37a1e6c60431b602eab5dd798cea3 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 10:08:44 -0400
Subject: [PATCH 05/76] fix github token name

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7fb100260..0a637c081 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
       # actions can only run on main for some reason
       LD_RELEASE_VERSION: 2.14.0
       # LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
-      GH_TOKEN: ${{ secrets.BOT_TOKEN }}
+      GITHUB_TOKEN: ${{ secrets.BOT_TOKEN }}
       DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
       CIRCLECI_CLI_TOKEN: ${{ secrets.CIRCLECI_CLI_TOKEN }}

From 87579d5682f73c48f84ddffa13ba20a7620625fd Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 11:02:47 -0400
Subject: [PATCH 06/76] grab ENV VARS from SSM

---
 .github/workflows/release.yml | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0a637c081..06d67b682 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,22 +25,22 @@ jobs:
       # actions can only run on main for some reason
       LD_RELEASE_VERSION: 2.14.0
       # LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
-      GITHUB_TOKEN: ${{ secrets.BOT_TOKEN }}
-      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
-      CIRCLECI_CLI_TOKEN: ${{ secrets.CIRCLECI_CLI_TOKEN }}
-      BITBUCKET_USERNAME: ${{ secrets.BITBUCKET_USERNAME }}
-      BITBUCKET_TOKEN: ${{ secrets.BITBUCKET_TOKEN }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      # DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
+      # CIRCLECI_CLI_TOKEN: ${{ secrets.CIRCLECI_CLI_TOKEN }}
+      # BITBUCKET_USERNAME: ${{ secrets.BITBUCKET_USERNAME }}
+      # BITBUCKET_TOKEN: ${{ secrets.BITBUCKET_TOKEN }}
       DRY_RUN: true
       # DRY_RUN: ${{ inputs.dryRun }}
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
     steps:
       - uses: actions/checkout@v4
-      # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.1.0
-      #   name: Get secrets
-      #   with:
-      #     aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
-      #     s3_path_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
+      - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.1.0
+        name: Get secrets
+        with:
+          aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
+          s3_path_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
       - name: update-version
         run: |
           ./scripts/release/update-version.sh

From ce846170324ace8d09d8e5c9bb3e657c8874f6cd Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 11:16:02 -0400
Subject: [PATCH 07/76] use latest release-secrets

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 06d67b682..97744765f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,7 +36,7 @@ jobs:
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
     steps:
       - uses: actions/checkout@v4
-      - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.1.0
+      - uses: launchdarkly/gh-actions/actions/release-secrets
         name: Get secrets
         with:
           aws_assume_role: ${{ vars.AWS_ROLE_ARN }}

From 9b0c86400166b002859a4a9493198c8179f5539a Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 11:20:49 -0400
Subject: [PATCH 08/76] force GHA


From bfdb84669c81d5cb9659cc254326e25e9157b4c1 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 11:21:49 -0400
Subject: [PATCH 09/76] debugging

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 97744765f..125bfaf54 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,7 +36,7 @@ jobs:
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
     steps:
       - uses: actions/checkout@v4
-      - uses: launchdarkly/gh-actions/actions/release-secrets
+      - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
         name: Get secrets
         with:
           aws_assume_role: ${{ vars.AWS_ROLE_ARN }}

From 6d26799ea64a033ee99616f4d0c09fefeb362d03 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 13:11:28 -0400
Subject: [PATCH 10/76] remove failing step for now to continue debugging

---
 .github/workflows/release.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 125bfaf54..75cc83300 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,11 +36,11 @@ jobs:
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
     steps:
       - uses: actions/checkout@v4
-      - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
-        name: Get secrets
-        with:
-          aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
-          s3_path_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
+      # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
+      #   name: Get secrets
+      #   with:
+      #     aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
+      #     s3_path_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
       - name: update-version
         run: |
           ./scripts/release/update-version.sh

From 92323e05a8420067d8c333190b78befc4a2cb3e4 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 13:36:31 -0400
Subject: [PATCH 11/76] add some flags to help debugging

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 49aa5b859..a05cc07ed 100644
--- a/Makefile
+++ b/Makefile
@@ -72,7 +72,7 @@ clean:
 	rm -f build/package/github-actions/ld-find-code-refs-github-action
 	rm -f build/package/bitbucket-pipelines/ld-find-code-refs-bitbucket-pipeline
 
-RELEASE_CMD=curl -sL https://git.io/goreleaser | GOPATH=$(mktemp -d) VERSION=$(GORELEASER_VERSION) GITHUB_TOKEN=$(GITHUB_TOKEN) bash -s -- --clean --release-notes $(RELEASE_NOTES)
+RELEASE_CMD=curl -sSLi https://git.io/goreleaser | GOPATH=$(mktemp -d) VERSION=$(GORELEASER_VERSION) GITHUB_TOKEN=$(GITHUB_TOKEN) bash -s -- --clean --release-notes $(RELEASE_NOTES)
 
 publish:
 	$(RELEASE_CMD)

From ce5915e4fddabdc808bee3d7a1115fa54be660bd Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 14:04:05 -0400
Subject: [PATCH 12/76] remove release notes temporarily

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index a05cc07ed..48864fff5 100644
--- a/Makefile
+++ b/Makefile
@@ -72,7 +72,7 @@ clean:
 	rm -f build/package/github-actions/ld-find-code-refs-github-action
 	rm -f build/package/bitbucket-pipelines/ld-find-code-refs-bitbucket-pipeline
 
-RELEASE_CMD=curl -sSLi https://git.io/goreleaser | GOPATH=$(mktemp -d) VERSION=$(GORELEASER_VERSION) GITHUB_TOKEN=$(GITHUB_TOKEN) bash -s -- --clean --release-notes $(RELEASE_NOTES)
+RELEASE_CMD=curl -sSLi https://git.io/goreleaser | GOPATH=$(mktemp -d) VERSION=$(GORELEASER_VERSION) GITHUB_TOKEN=$(GITHUB_TOKEN) bash -s -- --clean
 
 publish:
 	$(RELEASE_CMD)

From 2fbf5138920baed5b83f1a50ef45455519ca28a7 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 14:11:07 -0400
Subject: [PATCH 13/76] debugging goreleaser

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 48864fff5..9f832327a 100644
--- a/Makefile
+++ b/Makefile
@@ -72,7 +72,7 @@ clean:
 	rm -f build/package/github-actions/ld-find-code-refs-github-action
 	rm -f build/package/bitbucket-pipelines/ld-find-code-refs-bitbucket-pipeline
 
-RELEASE_CMD=curl -sSLi https://git.io/goreleaser | GOPATH=$(mktemp -d) VERSION=$(GORELEASER_VERSION) GITHUB_TOKEN=$(GITHUB_TOKEN) bash -s -- --clean
+RELEASE_CMD=curl -sL https://git.io/goreleaser | GOPATH=$(mktemp -d) VERSION=$(GORELEASER_VERSION) GITHUB_TOKEN=$(GITHUB_TOKEN) bash -s -- --clean --debug --release-notes $(RELEASE_NOTES)
 
 publish:
 	$(RELEASE_CMD)

From 1a27ee8bf9d7c50e7ffbc88cda1c88bbbecd2346 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 14:18:55 -0400
Subject: [PATCH 14/76] pull tags when cloning

---
 .github/workflows/release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 75cc83300..535b12c24 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,6 +36,7 @@ jobs:
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
     steps:
       - uses: actions/checkout@v4
+        fetch-depth: 0
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets
       #   with:

From 6adb8f6bdbea6c3259b80ec3be05b07815ba6d99 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 14:21:48 -0400
Subject: [PATCH 15/76] fix checkout step

---
 .github/workflows/release.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 535b12c24..b94105bdf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,7 +36,8 @@ jobs:
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
     steps:
       - uses: actions/checkout@v4
-        fetch-depth: 0
+        with:
+          fetch-depth: 0
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets
       #   with:

From 09e14a6d3bd13c024a20c7be88e6a654a82347bb Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 14:28:58 -0400
Subject: [PATCH 16/76] create artifact directory

---
 scripts/release/publish-dry-run.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/release/publish-dry-run.sh b/scripts/release/publish-dry-run.sh
index 761f041ef..d1bc0085b 100755
--- a/scripts/release/publish-dry-run.sh
+++ b/scripts/release/publish-dry-run.sh
@@ -4,6 +4,8 @@ sudo docker login --username ${DOCKER_USERNAME} --password-stdin ${DOCKER_TOKEN}
 
 sudo PATH=${PATH} GITHUB_TOKEN=${GITHUB_TOKEN} make products-for-release
 
+mkdir -p ${ARTIFACT_DIRECTORY}
+
 # Copy the Docker image that goreleaser just built into the artifacts - we only do
 # this in a dry run, because in a real release the image will be available from
 # DockerHub anyway so there's no point in attaching it to the release.

From d941ef69eec31649bc3eeff957fa2cf675e7e5f5 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 14:38:15 -0400
Subject: [PATCH 17/76] fix typo

---
 scripts/release/publish-dry-run.sh | 2 +-
 scripts/release/publish.sh         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/release/publish-dry-run.sh b/scripts/release/publish-dry-run.sh
index d1bc0085b..5a895b843 100755
--- a/scripts/release/publish-dry-run.sh
+++ b/scripts/release/publish-dry-run.sh
@@ -17,7 +17,7 @@ sudo docker save launchdarkly/${GH_CODEREFS}:latest | gzip >${ARTIFACT_DIRECTORY
 sudo docker save launchdarkly/${BB_CODEREFS}:latest | gzip >${ARTIFACT_DIRECTORY}/${BB_CODEREFS}.tar.gz
 
 for script in $(dirname $0)/publish-runners/*.sh; do
-  source script
+  source $script
 done
 
 dry_run_gha
diff --git a/scripts/release/publish.sh b/scripts/release/publish.sh
index 0ef5aa5dd..3f7c1f14b 100755
--- a/scripts/release/publish.sh
+++ b/scripts/release/publish.sh
@@ -12,7 +12,7 @@ ssh-keyscan -t rsa bitbucket.org >> ~/.ssh/known_hosts
 ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts
 
 for script in $(dirname $0)/publish-runners/*.sh; do
-  source script
+  source $script
 done
 
 publish_gha

From 42b4e011e534af8e28372bbf90cfa8a22b4145e9 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 14:48:15 -0400
Subject: [PATCH 18/76] fix attempted interactive login from non-TTY

---
 scripts/release/publish-dry-run.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/release/publish-dry-run.sh b/scripts/release/publish-dry-run.sh
index 5a895b843..8b64ac582 100755
--- a/scripts/release/publish-dry-run.sh
+++ b/scripts/release/publish-dry-run.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-sudo docker login --username ${DOCKER_USERNAME} --password-stdin ${DOCKER_TOKEN}
+echo ${DOCKER_TOKEN} | sudo docker login --username ${DOCKER_USERNAME} --password-stdin
 
 sudo PATH=${PATH} GITHUB_TOKEN=${GITHUB_TOKEN} make products-for-release
 

From d25011346275a11c9c03b660cbc108ba0bae185c Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 14:57:51 -0400
Subject: [PATCH 19/76] remove unneeded command

---
 scripts/release/publish-runners/gha.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
index aa1fa3f3d..e40d08552 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/publish-runners/gha.sh
@@ -18,11 +18,10 @@ setup() (
   sudo apt install gh
 
   # use gh cli to login to github and set up git credentials
-  gh auth login --with-token < $GITHUB_TOKEN
+  gh auth login --with-token < ${GITHUB_TOKEN}
   gh auth setup-git
 
   # clone checkout commit and push all metadata changes to gha repo
-  rm -rf githubActionsMetadataUpdates
   mkdir -p githubActionsMetadataUpdates
   gh repo clone launchdarkly/find-code-references githubActionsMetadataUpdates
   cp build/metadata/github-actions/* githubActionsMetadataUpdates

From 7d4a929d0f8f4306bb1c2734904a23789d68cfd2 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 15:07:34 -0400
Subject: [PATCH 20/76] debugging

---
 scripts/release/publish-runners/gha.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
index e40d08552..2b129178f 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/publish-runners/gha.sh
@@ -18,7 +18,7 @@ setup() (
   sudo apt install gh
 
   # use gh cli to login to github and set up git credentials
-  gh auth login --with-token < ${GITHUB_TOKEN}
+  echo ${GITHUB_TOKEN} | gh auth login --with-token
   gh auth setup-git
 
   # clone checkout commit and push all metadata changes to gha repo

From edea22e154c865aa5e614e31a393553d65f71791 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 15:24:48 -0400
Subject: [PATCH 21/76] fix gh login flow

---
 scripts/release/publish-runners/gha.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
index 2b129178f..050c00b2b 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/publish-runners/gha.sh
@@ -18,7 +18,7 @@ setup() (
   sudo apt install gh
 
   # use gh cli to login to github and set up git credentials
-  echo ${GITHUB_TOKEN} | gh auth login --with-token
+  gh auth login
   gh auth setup-git
 
   # clone checkout commit and push all metadata changes to gha repo

From 40eef5e4a1367572888d37ac0d42f847d0a914bc Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 15:31:51 -0400
Subject: [PATCH 22/76] debugging

---
 scripts/release/publish-runners/gha.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
index 050c00b2b..a8ecd2bbb 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/publish-runners/gha.sh
@@ -19,7 +19,9 @@ setup() (
 
   # use gh cli to login to github and set up git credentials
   gh auth login
+  echo "okay here"
   gh auth setup-git
+  echo "not here prolly"
 
   # clone checkout commit and push all metadata changes to gha repo
   mkdir -p githubActionsMetadataUpdates

From d7ce08e454b582370b163d9082fdceec94ec6977 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 15:43:16 -0400
Subject: [PATCH 23/76] debugging

---
 scripts/release/publish-runners/gha.sh | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
index a8ecd2bbb..1546e6b01 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/publish-runners/gha.sh
@@ -18,10 +18,9 @@ setup() (
   sudo apt install gh
 
   # use gh cli to login to github and set up git credentials
-  gh auth login
-  echo "okay here"
+  # gh auth login
+  gh auth status
   gh auth setup-git
-  echo "not here prolly"
 
   # clone checkout commit and push all metadata changes to gha repo
   mkdir -p githubActionsMetadataUpdates

From 5d9424722c2cdd26230b6d5522dcfe8cac3f4270 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 16:03:16 -0400
Subject: [PATCH 24/76] debugging

---
 scripts/release/publish-runners/gha.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
index 1546e6b01..82c00cfd9 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/publish-runners/gha.sh
@@ -17,9 +17,6 @@ setup() (
   sudo apt update
   sudo apt install gh
 
-  # use gh cli to login to github and set up git credentials
-  # gh auth login
-  gh auth status
   gh auth setup-git
 
   # clone checkout commit and push all metadata changes to gha repo
@@ -55,6 +52,7 @@ dry_run_gha() (
   setup
 
   echo "Dry run: will not publish action to github action marketplace."
+  git show-ref
   git push origin main --tags --dry-run
 
   clean_up

From 9a8ce27d2904715cb7250c53f265fb3c15b5de40 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 16:32:06 -0400
Subject: [PATCH 25/76] debugging

---
 scripts/release/publish-runners/gha.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
index 82c00cfd9..1f32672c3 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/publish-runners/gha.sh
@@ -26,6 +26,7 @@ setup() (
   cd githubActionsMetadataUpdates
   git config user.email "launchdarklyreleasebot@launchdarkly.com"
   git config user.name "LaunchDarklyReleaseBot"
+  git branch -vv
   git add -u
   git commit -m "Release auto update version $LD_RELEASE_VERSION"
 )
@@ -52,6 +53,7 @@ dry_run_gha() (
   setup
 
   echo "Dry run: will not publish action to github action marketplace."
+  pwd
   git show-ref
   git push origin main --tags --dry-run
 

From 62d89da3e7b8014599169d4ee97c0b42c8a2147b Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri, 20 Jun 2025 16:39:27 -0400
Subject: [PATCH 26/76] debugging

---
 scripts/release/publish-runners/gha.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
index 1f32672c3..5e5692ec2 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/publish-runners/gha.sh
@@ -29,6 +29,7 @@ setup() (
   git branch -vv
   git add -u
   git commit -m "Release auto update version $LD_RELEASE_VERSION"
+  pwd
 )
 
 clean_up() (
@@ -53,7 +54,7 @@ dry_run_gha() (
   setup
 
   echo "Dry run: will not publish action to github action marketplace."
-  pwd
+  cd githubActionsMetadataUpdates
   git show-ref
   git push origin main --tags --dry-run
 

From 506d02f55189080c5cf41f39143c00b7087a531f Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 23 Jun 2025 11:22:05 -0400
Subject: [PATCH 27/76] add find-code-references deploy key secret

---
 .github/workflows/release.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b94105bdf..42158ee2d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,6 +38,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - uses: launchdarkly/common-action/ssh-key-by-repo@main
+        with:
+          repo_keys_map: |
+            {
+              "launchdarkly/find-code-references" = ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERECES_DEPLOY_KEY) }}
+            }
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets
       #   with:
@@ -72,4 +78,3 @@ jobs:
   #         token: ${{ secrets.BOT_TOKEN }}
   #         tag: v${{ inputs.releaseVersion }}
   #         body: ${{ inputs.changeLog }}
-

From 673095f18e3a020a03956d0042fa1cd5239fa5d6 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 23 Jun 2025 11:24:48 -0400
Subject: [PATCH 28/76] fix typo

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 42158ee2d..604da49f4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,7 +38,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: launchdarkly/common-action/ssh-key-by-repo@main
+      - uses: launchdarkly/common-actions/ssh-key-by-repo@main
         with:
           repo_keys_map: |
             {

From 4709160c3c21c81a212f1436ddcccaceeecc3061 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 23 Jun 2025 12:37:22 -0400
Subject: [PATCH 29/76] add version for common-actions/ssh-key-by-repo

---
 .github/workflows/release.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 604da49f4..594b09fbb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,7 +38,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: launchdarkly/common-actions/ssh-key-by-repo@main
+      - name: setup access for find-code-references
+        uses: launchdarkly/common-actions/ssh-key-by-repo@main
         with:
           repo_keys_map: |
             {

From e8c40f06a3f1129a2d6b0ecfe2c3f40bb26bb6ca Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 23 Jun 2025 12:44:21 -0400
Subject: [PATCH 30/76] try a different version of common-actions

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 594b09fbb..3b8253d88 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,7 +39,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: setup access for find-code-references
-        uses: launchdarkly/common-actions/ssh-key-by-repo@main
+        uses: launchdarkly/common-actions/ssh-key-by-repo@a96f43594a08620a981f2e85aecd60c4a469885d
         with:
           repo_keys_map: |
             {

From b44aaec9f7af1bed94771575332d88dfebe5f9bd Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 23 Jun 2025 13:19:24 -0400
Subject: [PATCH 31/76] debugging

---
 .github/workflows/release.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3b8253d88..0c9c0ad5a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,12 +39,13 @@ jobs:
         with:
           fetch-depth: 0
       - name: setup access for find-code-references
-        uses: launchdarkly/common-actions/ssh-key-by-repo@a96f43594a08620a981f2e85aecd60c4a469885d
+        uses: launchdarkly/common-actions/ssh-key-by-repo@main
         with:
           repo_keys_map: |
             {
               "launchdarkly/find-code-references" = ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERECES_DEPLOY_KEY) }}
             }
+      - run: git submodule update --init --recursive
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets
       #   with:

From b5eb78c9534227cfccd02b3141597e962d33d6ec Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 23 Jun 2025 14:53:57 -0400
Subject: [PATCH 32/76] try just checking out find-code-references

---
 .github/workflows/release.yml | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0c9c0ad5a..731adeb29 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,14 +38,17 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: setup access for find-code-references
-        uses: launchdarkly/common-actions/ssh-key-by-repo@main
+      - uses: actions/checkout@v4
         with:
-          repo_keys_map: |
-            {
-              "launchdarkly/find-code-references" = ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERECES_DEPLOY_KEY) }}
-            }
-      - run: git submodule update --init --recursive
+          fetch-depth: 0
+          repository: launchdarkly/find-code-references
+      # - name: setup access for find-code-references
+      #   uses: launchdarkly/common-actions/ssh-key-by-repo@main
+      #   with:
+      #     repo_keys_map: |
+      #       {
+      #         "launchdarkly/find-code-references" = ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERECES_DEPLOY_KEY) }}
+      #       }
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets
       #   with:

From a0b4dac189c72e8d0420eb2735c922644d657400 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 23 Jun 2025 15:03:44 -0400
Subject: [PATCH 33/76] debugging

---
 .github/workflows/release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 731adeb29..bf2f4eb55 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -42,6 +42,7 @@ jobs:
         with:
           fetch-depth: 0
           repository: launchdarkly/find-code-references
+          path: find-code-references
       # - name: setup access for find-code-references
       #   uses: launchdarkly/common-actions/ssh-key-by-repo@main
       #   with:

From c0712e03c9da22a1ec4b9ed9a0db69ac25a1be35 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Tue, 1 Jul 2025 16:06:56 -0400
Subject: [PATCH 34/76] use new public ssh-key-by-repo action

---
 .github/workflows/release.yml | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bf2f4eb55..6fed55d86 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,18 +38,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          repository: launchdarkly/find-code-references
-          path: find-code-references
-      # - name: setup access for find-code-references
-      #   uses: launchdarkly/common-actions/ssh-key-by-repo@main
-      #   with:
-      #     repo_keys_map: |
-      #       {
-      #         "launchdarkly/find-code-references" = ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERECES_DEPLOY_KEY) }}
-      #       }
+      - name: setup access for find-code-references
+        uses: launchdarkly/gh-actions/actions/ssh-key-by-repo@main
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets
       #   with:

From 68c307b36f9eaf31009c516f8791fdef563df61d Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Tue, 1 Jul 2025 16:13:06 -0400
Subject: [PATCH 35/76] fix ssh-key-by-repo usage

---
 .github/workflows/release.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6fed55d86..9ec801902 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,6 +40,11 @@ jobs:
           fetch-depth: 0
       - name: setup access for find-code-references
         uses: launchdarkly/gh-actions/actions/ssh-key-by-repo@main
+        with:
+          repo_keys_map: |
+          {
+            "launchdarkly/find-code-references" = ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERECES_DEPLOY_KEY) }}
+          }
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets
       #   with:

From dff8f288ca98a5b0442f51dde7652b0edfb9c50d Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Tue, 1 Jul 2025 16:21:21 -0400
Subject: [PATCH 36/76] debugging

---
 .github/workflows/release.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9ec801902..11cd46006 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,8 +38,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: setup access for find-code-references
-        uses: launchdarkly/gh-actions/actions/ssh-key-by-repo@main
+      - uses: launchdarkly/gh-actions/actions/ssh-key-by-repo@main
         with:
           repo_keys_map: |
           {

From 2f141b0239740d8c429fdac9eec23d314f3e145d Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Tue, 1 Jul 2025 16:48:21 -0400
Subject: [PATCH 37/76] debugging

---
 .github/workflows/release.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 11cd46006..7f1256690 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,12 +38,14 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: launchdarkly/gh-actions/actions/ssh-key-by-repo@main
+      - name: setup access for find-code-references
+        uses: launchdarkly/gh-actions/actions/ssh-key-by-repo@main
         with:
           repo_keys_map: |
           {
             "launchdarkly/find-code-references" = ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERECES_DEPLOY_KEY) }}
           }
+      - run: git submodule update --init --recursive
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets
       #   with:

From dbe6ec8f0f81396e16b205af9a6eed99dbd9c23a Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Tue, 1 Jul 2025 16:51:18 -0400
Subject: [PATCH 38/76] debugging

---
 .github/workflows/release.yml | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7f1256690..3d3bac2bb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,14 +38,13 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: setup access for find-code-references
-        uses: launchdarkly/gh-actions/actions/ssh-key-by-repo@main
-        with:
-          repo_keys_map: |
-          {
-            "launchdarkly/find-code-references" = ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERECES_DEPLOY_KEY) }}
-          }
-      - run: git submodule update --init --recursive
+      # - name: setup access for find-code-references
+      #   uses: launchdarkly/gh-actions/actions/ssh-key-by-repo@main
+      #   with:
+      #     repo_keys_map: |
+      #     {
+      #       "launchdarkly/find-code-references" = ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERECES_DEPLOY_KEY) }}
+      #     }
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets
       #   with:

From 1ee29df9c3600f07d9f6f6f1338b637f97c712c4 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Wed, 2 Jul 2025 09:31:52 -0400
Subject: [PATCH 39/76] fix indentation issue

---
 .github/workflows/release.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3d3bac2bb..902f10bac 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,13 +38,13 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      # - name: setup access for find-code-references
-      #   uses: launchdarkly/gh-actions/actions/ssh-key-by-repo@main
-      #   with:
-      #     repo_keys_map: |
-      #     {
-      #       "launchdarkly/find-code-references" = ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERECES_DEPLOY_KEY) }}
-      #     }
+      - name: setup access for find-code-references
+        uses: launchdarkly/gh-actions/actions/ssh-key-by-repo@main
+        with:
+          repo_keys_map: |
+            {
+              "launchdarkly/find-code-references" = ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERENCES_DEPLOY_KEY) }}
+            }
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets
       #   with:

From 0683609b1459ce2ec541b2ea5ee418337cca8fd1 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Wed, 2 Jul 2025 09:36:05 -0400
Subject: [PATCH 40/76] debugging

---
 .github/workflows/release.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 902f10bac..52818c3e6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,6 +38,9 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - name: Debug repo_keys_map
+        run: |
+          echo '${{ secrets.LAUNCHDARKLY_FIND_CODE_REFERECES_DEPLOY_KEY }}' | jq .
       - name: setup access for find-code-references
         uses: launchdarkly/gh-actions/actions/ssh-key-by-repo@main
         with:

From eeb11090751d53c9580887fbafa45e16d8d43cac Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Wed, 2 Jul 2025 09:37:30 -0400
Subject: [PATCH 41/76] debugging

---
 .github/workflows/release.yml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 52818c3e6..88c7a1404 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,15 +38,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Debug repo_keys_map
-        run: |
-          echo '${{ secrets.LAUNCHDARKLY_FIND_CODE_REFERECES_DEPLOY_KEY }}' | jq .
       - name: setup access for find-code-references
         uses: launchdarkly/gh-actions/actions/ssh-key-by-repo@main
         with:
           repo_keys_map: |
             {
-              "launchdarkly/find-code-references" = ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERENCES_DEPLOY_KEY) }}
+              "launchdarkly/find-code-references": ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERENCES_DEPLOY_KEY) }}
             }
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets

From 3f139f7b2c6a6aeff072ad5b2bff8f5280d34fda Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Tue, 15 Jul 2025 16:02:57 -0400
Subject: [PATCH 42/76] debugging

---
 scripts/release/publish-runners/gha.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
index 5e5692ec2..65ae7e2ad 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/publish-runners/gha.sh
@@ -56,6 +56,7 @@ dry_run_gha() (
   echo "Dry run: will not publish action to github action marketplace."
   cd githubActionsMetadataUpdates
   git show-ref
+  echo "Gonna push if you let me...but I get the feeling you won't"
   git push origin main --tags --dry-run
 
   clean_up

From 9d9f1ba00552c983d25d8c4405d191bc63053fde Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Tue, 15 Jul 2025 16:16:11 -0400
Subject: [PATCH 43/76] debugging

---
 scripts/release/publish-runners/gha.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
index 65ae7e2ad..5e5692ec2 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/publish-runners/gha.sh
@@ -56,7 +56,6 @@ dry_run_gha() (
   echo "Dry run: will not publish action to github action marketplace."
   cd githubActionsMetadataUpdates
   git show-ref
-  echo "Gonna push if you let me...but I get the feeling you won't"
   git push origin main --tags --dry-run
 
   clean_up

From 7e8829f94bfbe0ffc009bd4c6d18649d77508056 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Tue, 15 Jul 2025 16:42:02 -0400
Subject: [PATCH 44/76] debugging

---
 scripts/release/publish-runners/gha.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
index 5e5692ec2..b54e1a38b 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/publish-runners/gha.sh
@@ -56,6 +56,7 @@ dry_run_gha() (
   echo "Dry run: will not publish action to github action marketplace."
   cd githubActionsMetadataUpdates
   git show-ref
+  git remote -v
   git push origin main --tags --dry-run
 
   clean_up

From 17df0371ba32305998da88d79448606a70f37dbe Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Thu, 17 Jul 2025 10:06:13 -0400
Subject: [PATCH 45/76] force gha


From b97cb58e1da1d8d375707c241992054c1a380866 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Thu, 17 Jul 2025 11:53:14 -0400
Subject: [PATCH 46/76] get secrets

---
 .github/workflows/release.yml          | 14 +++++++-------
 scripts/release/publish-runners/gha.sh |  1 -
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 88c7a1404..6dbd4138b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,15 +24,15 @@ jobs:
       # temporary ENV VARs for input; this is only because workflow_dispatch
       # actions can only run on main for some reason
       LD_RELEASE_VERSION: 2.14.0
+      DRY_RUN: true
       # LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
+      # DRY_RUN: ${{ inputs.dryRun }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       # DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       # DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
       # CIRCLECI_CLI_TOKEN: ${{ secrets.CIRCLECI_CLI_TOKEN }}
       # BITBUCKET_USERNAME: ${{ secrets.BITBUCKET_USERNAME }}
       # BITBUCKET_TOKEN: ${{ secrets.BITBUCKET_TOKEN }}
-      DRY_RUN: true
-      # DRY_RUN: ${{ inputs.dryRun }}
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
     steps:
       - uses: actions/checkout@v4
@@ -45,11 +45,11 @@ jobs:
             {
               "launchdarkly/find-code-references": ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERENCES_DEPLOY_KEY) }}
             }
-      # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
-      #   name: Get secrets
-      #   with:
-      #     aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
-      #     s3_path_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
+      - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
+        name: Get secrets
+        with:
+          aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
+          s3_path_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
       - name: update-version
         run: |
           ./scripts/release/update-version.sh
diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
index b54e1a38b..5e5692ec2 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/publish-runners/gha.sh
@@ -56,7 +56,6 @@ dry_run_gha() (
   echo "Dry run: will not publish action to github action marketplace."
   cd githubActionsMetadataUpdates
   git show-ref
-  git remote -v
   git push origin main --tags --dry-run
 
   clean_up

From f6253aaaa92046c680c1b97d83bcccaabc0af2eb Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Thu, 17 Jul 2025 11:58:03 -0400
Subject: [PATCH 47/76] try repo secret for circleci

---
 .github/workflows/release.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6dbd4138b..8ac7e7daf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,7 +30,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       # DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       # DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
-      # CIRCLECI_CLI_TOKEN: ${{ secrets.CIRCLECI_CLI_TOKEN }}
+      CIRCLECI_CLI_TOKEN: ${{ secrets.CIRCLECI_CLI_TOKEN }}
       # BITBUCKET_USERNAME: ${{ secrets.BITBUCKET_USERNAME }}
       # BITBUCKET_TOKEN: ${{ secrets.BITBUCKET_TOKEN }}
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
@@ -45,11 +45,11 @@ jobs:
             {
               "launchdarkly/find-code-references": ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERENCES_DEPLOY_KEY) }}
             }
-      - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
-        name: Get secrets
-        with:
-          aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
-          s3_path_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
+      # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
+      #   name: Get secrets
+      #   with:
+      #     aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
+      #     s3_path_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
       - name: update-version
         run: |
           ./scripts/release/update-version.sh

From acdd02aa7c08aaa0554973a1b6e0b00c0e6642ff Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Thu, 17 Jul 2025 12:12:43 -0400
Subject: [PATCH 48/76] skip orb publish for now

---
 .github/workflows/release.yml      | 6 +++---
 scripts/release/publish-dry-run.sh | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8ac7e7daf..3e9300281 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,9 +30,9 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       # DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       # DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
-      CIRCLECI_CLI_TOKEN: ${{ secrets.CIRCLECI_CLI_TOKEN }}
-      # BITBUCKET_USERNAME: ${{ secrets.BITBUCKET_USERNAME }}
-      # BITBUCKET_TOKEN: ${{ secrets.BITBUCKET_TOKEN }}
+      # CIRCLECI_CLI_TOKEN: ${{ secrets.CIRCLECI_CLI_TOKEN }}
+      BITBUCKET_USERNAME: ${{ secrets.BITBUCKET_USERNAME }}
+      BITBUCKET_TOKEN: ${{ secrets.BITBUCKET_TOKEN }}
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
     steps:
       - uses: actions/checkout@v4
diff --git a/scripts/release/publish-dry-run.sh b/scripts/release/publish-dry-run.sh
index 8b64ac582..c8360d42c 100755
--- a/scripts/release/publish-dry-run.sh
+++ b/scripts/release/publish-dry-run.sh
@@ -21,5 +21,5 @@ for script in $(dirname $0)/publish-runners/*.sh; do
 done
 
 dry_run_gha
-dry_run_circleci
+# dry_run_circleci
 dry_run_bitbucket

From d601e187c442debb0f78fef5a5f5fb2aa8748761 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Thu, 17 Jul 2025 13:47:34 -0400
Subject: [PATCH 49/76] debugging

---
 scripts/release/publish-runners/bitbucket.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/release/publish-runners/bitbucket.sh b/scripts/release/publish-runners/bitbucket.sh
index 4821c7a3e..96b4ae2f6 100755
--- a/scripts/release/publish-runners/bitbucket.sh
+++ b/scripts/release/publish-runners/bitbucket.sh
@@ -35,7 +35,8 @@ dry_run_bitbucket() (
   setup
 
   echo "Dry run: will not publish pipe to bitbucket."
-  git push bb-origin master --tags --dry-run
+  git show-ref
+  git push bb-origin main --tags --dry-run
 
   clean_up
 )

From 630bbd218dda37e97267a5cf7f24f1d6b72ab8c1 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Thu, 17 Jul 2025 13:56:14 -0400
Subject: [PATCH 50/76] debugging

---
 scripts/release/publish-runners/bitbucket.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/release/publish-runners/bitbucket.sh b/scripts/release/publish-runners/bitbucket.sh
index 96b4ae2f6..b7e539f95 100755
--- a/scripts/release/publish-runners/bitbucket.sh
+++ b/scripts/release/publish-runners/bitbucket.sh
@@ -36,6 +36,7 @@ dry_run_bitbucket() (
 
   echo "Dry run: will not publish pipe to bitbucket."
   git show-ref
+  git remote -v
   git push bb-origin main --tags --dry-run
 
   clean_up

From 3eb49030d8d7100a164bc4535ce3d3d6947d329c Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Thu, 17 Jul 2025 14:03:53 -0400
Subject: [PATCH 51/76] debugging

---
 scripts/release/publish-dry-run.sh           | 2 +-
 scripts/release/publish-runners/bitbucket.sh | 4 +---
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/scripts/release/publish-dry-run.sh b/scripts/release/publish-dry-run.sh
index c8360d42c..a283f7248 100755
--- a/scripts/release/publish-dry-run.sh
+++ b/scripts/release/publish-dry-run.sh
@@ -20,6 +20,6 @@ for script in $(dirname $0)/publish-runners/*.sh; do
   source $script
 done
 
-dry_run_gha
+# dry_run_gha
 # dry_run_circleci
 dry_run_bitbucket
diff --git a/scripts/release/publish-runners/bitbucket.sh b/scripts/release/publish-runners/bitbucket.sh
index b7e539f95..5eafb15b9 100755
--- a/scripts/release/publish-runners/bitbucket.sh
+++ b/scripts/release/publish-runners/bitbucket.sh
@@ -35,9 +35,7 @@ dry_run_bitbucket() (
   setup
 
   echo "Dry run: will not publish pipe to bitbucket."
-  git show-ref
-  git remote -v
-  git push bb-origin main --tags --dry-run
+  git push origin main --tags --dry-run
 
   clean_up
 )

From 35fb7437541dfe0a441537227b944f134702bd5e Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Thu, 17 Jul 2025 14:54:55 -0400
Subject: [PATCH 52/76] fix coliding function names

---
 scripts/release/publish-runners/bitbucket.sh | 16 +++++++++-------
 scripts/release/publish-runners/gha.sh       |  8 ++++----
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/scripts/release/publish-runners/bitbucket.sh b/scripts/release/publish-runners/bitbucket.sh
index 5eafb15b9..5a3623553 100755
--- a/scripts/release/publish-runners/bitbucket.sh
+++ b/scripts/release/publish-runners/bitbucket.sh
@@ -3,7 +3,7 @@
 # Run this in publish step after all version information have been updated.
 set -ev
 
-setup() (
+setup_bitbucket() (
   rm -rf bitbucketMetadataUpdates
   mkdir -p bitbucketMetadataUpdates
   git clone "https://${BITBUCKET_USERNAME}:${BITBUCKET_TOKEN}@bitbucket.org/launchdarkly/ld-find-code-refs-pipe.git" bitbucketMetadataUpdates
@@ -17,25 +17,27 @@ setup() (
   git remote add bb-origin "https://${BITBUCKET_USERNAME}:${BITBUCKET_TOKEN}@bitbucket.org/launchdarkly/ld-find-code-refs-pipe.git"
 )
 
-clean_up() (
+clean_up_bitbucket() (
   cd .. && rm -rf bitbucketMetadataUpdates
 )
 
 publish_bitbucket() (
-  setup
+  setup_bitbucket
 
   echo "Live run: will publish pipe to bitbucket."
   git tag $LD_RELEASE_VERSION
   git push bb-origin master --tags
 
-  clean_up
+  clean_up_bitbucket
 )
 
 dry_run_bitbucket() (
-  setup
+  setup_bitbucket
 
   echo "Dry run: will not publish pipe to bitbucket."
-  git push origin main --tags --dry-run
+  git show-ref
+  git remote -v
+  git push bb-origin master --tags --dry-run
 
-  clean_up
+  clean_up_bitbucket
 )
diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/publish-runners/gha.sh
index 5e5692ec2..29d12e0b9 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/publish-runners/gha.sh
@@ -10,7 +10,7 @@ RELEASE_NOTES="$(make echo-release-notes)"
 VERSION_MAJOR="${LD_RELEASE_VERSION%%\.*}"
 RELEASE_TAG_MAJOR="v${VERSION_MAJOR}"
 
-setup() (
+setup_gha() (
   # install gh cli so we can create a release later https://github.com/cli/cli/blob/trunk/docs/install_linux.md
   curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
   echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
@@ -32,12 +32,12 @@ setup() (
   pwd
 )
 
-clean_up() (
+clean_up_gha() (
   cd .. && rm -rf githubActionsMetadataUpdates
 )
 
 publish_gha() (
-  setup
+  setup_gha
 
   echo "Live run: will publish action to github action marketplace."
   # tag the commit with the release version and create release
@@ -58,5 +58,5 @@ dry_run_gha() (
   git show-ref
   git push origin main --tags --dry-run
 
-  clean_up
+  clean_up_gha
 )

From edfec5259005278b4a7eb342d55002b4837dd0a1 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Thu, 17 Jul 2025 15:08:04 -0400
Subject: [PATCH 53/76] debugging

---
 scripts/release/publish-runners/bitbucket.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/release/publish-runners/bitbucket.sh b/scripts/release/publish-runners/bitbucket.sh
index 5a3623553..48e9c04d2 100755
--- a/scripts/release/publish-runners/bitbucket.sh
+++ b/scripts/release/publish-runners/bitbucket.sh
@@ -35,6 +35,7 @@ dry_run_bitbucket() (
   setup_bitbucket
 
   echo "Dry run: will not publish pipe to bitbucket."
+  pwd
   git show-ref
   git remote -v
   git push bb-origin master --tags --dry-run

From 7df1a7c443c1a84116bdea7042572266f85d33d3 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Thu, 17 Jul 2025 15:16:47 -0400
Subject: [PATCH 54/76] debugging

---
 scripts/release/publish-runners/bitbucket.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/release/publish-runners/bitbucket.sh b/scripts/release/publish-runners/bitbucket.sh
index 48e9c04d2..5948def0c 100755
--- a/scripts/release/publish-runners/bitbucket.sh
+++ b/scripts/release/publish-runners/bitbucket.sh
@@ -35,7 +35,7 @@ dry_run_bitbucket() (
   setup_bitbucket
 
   echo "Dry run: will not publish pipe to bitbucket."
-  pwd
+  cd bitbucketMetadataUpdates
   git show-ref
   git remote -v
   git push bb-origin master --tags --dry-run

From 52b33a5a383ba41386a0f29b11cd60694fe60518 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Thu, 17 Jul 2025 15:27:42 -0400
Subject: [PATCH 55/76] debugging

---
 .github/workflows/release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3e9300281..d971b8275 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,6 +45,7 @@ jobs:
             {
               "launchdarkly/find-code-references": ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERENCES_DEPLOY_KEY) }}
             }
+      - run: echo ${{ vars.AWS_ROLE_ARN }}
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets
       #   with:

From 0aa3c983db333e52f5952f1928ac8cabf9cd83dd Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Thu, 17 Jul 2025 15:58:27 -0400
Subject: [PATCH 56/76] use workflow_dispatch

---
 .github/workflows/release.yml | 41 ++++++++++++++++++-----------------
 1 file changed, 21 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d971b8275..4b60edba9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,21 +1,21 @@
 name: Release
 
 on:
-  pull_request
-  # workflow_dispatch:
-  #   inputs:
-  #     dryRun:
-  #       description: Perform a dry-run only
-  #       required: false
-  #       type: boolean
-  #     releaseVersion:
-  #       description: Next release version
-  #       required: true
-  #       type: string
-  #     changeLog:
-  #       description: Pending changelog
-  #       required: true
-  #       type: string
+  # pull_request
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        description: Perform a dry-run only
+        required: false
+        type: boolean
+      releaseVersion:
+        description: Next release version
+        required: true
+        type: string
+      # changeLog:
+      #   description: Pending changelog
+      #   required: true
+      #   type: string
 
 jobs:
   release:
@@ -23,10 +23,10 @@ jobs:
     env:
       # temporary ENV VARs for input; this is only because workflow_dispatch
       # actions can only run on main for some reason
-      LD_RELEASE_VERSION: 2.14.0
-      DRY_RUN: true
-      # LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
-      # DRY_RUN: ${{ inputs.dryRun }}
+      # LD_RELEASE_VERSION: 2.14.0
+      # DRY_RUN: true
+      LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
+      DRY_RUN: ${{ inputs.dryRun }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       # DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       # DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
@@ -45,7 +45,8 @@ jobs:
             {
               "launchdarkly/find-code-references": ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERENCES_DEPLOY_KEY) }}
             }
-      - run: echo ${{ vars.AWS_ROLE_ARN }}
+      - name: "Print role arn"
+        run: echo "role arn -> ${{ vars.AWS_ROLE_ARN }}"
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets
       #   with:

From b3490d7f1a45535894221088ce7d2fa2aef9a46e Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 21 Jul 2025 10:10:16 -0400
Subject: [PATCH 57/76] comment out workflow_dispatch again

---
 .github/workflows/release.yml | 40 +++++++++++++++++------------------
 1 file changed, 19 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4b60edba9..3e9300281 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,21 +1,21 @@
 name: Release
 
 on:
-  # pull_request
-  workflow_dispatch:
-    inputs:
-      dryRun:
-        description: Perform a dry-run only
-        required: false
-        type: boolean
-      releaseVersion:
-        description: Next release version
-        required: true
-        type: string
-      # changeLog:
-      #   description: Pending changelog
-      #   required: true
-      #   type: string
+  pull_request
+  # workflow_dispatch:
+  #   inputs:
+  #     dryRun:
+  #       description: Perform a dry-run only
+  #       required: false
+  #       type: boolean
+  #     releaseVersion:
+  #       description: Next release version
+  #       required: true
+  #       type: string
+  #     changeLog:
+  #       description: Pending changelog
+  #       required: true
+  #       type: string
 
 jobs:
   release:
@@ -23,10 +23,10 @@ jobs:
     env:
       # temporary ENV VARs for input; this is only because workflow_dispatch
       # actions can only run on main for some reason
-      # LD_RELEASE_VERSION: 2.14.0
-      # DRY_RUN: true
-      LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
-      DRY_RUN: ${{ inputs.dryRun }}
+      LD_RELEASE_VERSION: 2.14.0
+      DRY_RUN: true
+      # LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
+      # DRY_RUN: ${{ inputs.dryRun }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       # DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       # DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
@@ -45,8 +45,6 @@ jobs:
             {
               "launchdarkly/find-code-references": ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERENCES_DEPLOY_KEY) }}
             }
-      - name: "Print role arn"
-        run: echo "role arn -> ${{ vars.AWS_ROLE_ARN }}"
       # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
       #   name: Get secrets
       #   with:

From f4f99404346e372e3ad2be9c8cbb8d93d504834c Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 21 Jul 2025 10:18:57 -0400
Subject: [PATCH 58/76] debugging

---
 .github/workflows/release.yml      | 10 +++++-----
 scripts/release/publish-dry-run.sh |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3e9300281..ece78cccb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,11 +45,11 @@ jobs:
             {
               "launchdarkly/find-code-references": ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERENCES_DEPLOY_KEY) }}
             }
-      # - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
-      #   name: Get secrets
-      #   with:
-      #     aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
-      #     s3_path_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
+      - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
+        name: Get secrets
+        with:
+          aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
+          s3_path_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
       - name: update-version
         run: |
           ./scripts/release/update-version.sh
diff --git a/scripts/release/publish-dry-run.sh b/scripts/release/publish-dry-run.sh
index a283f7248..a9ae2eeb5 100755
--- a/scripts/release/publish-dry-run.sh
+++ b/scripts/release/publish-dry-run.sh
@@ -21,5 +21,5 @@ for script in $(dirname $0)/publish-runners/*.sh; do
 done
 
 # dry_run_gha
-# dry_run_circleci
+dry_run_circleci
 dry_run_bitbucket

From 3cf3de9f749f75420c660316ab79999ee300a180 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 21 Jul 2025 11:16:31 -0400
Subject: [PATCH 59/76] force gha


From f8f284401c59e56aa16ec6707abad852d37c1daa Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 21 Jul 2025 17:02:52 -0400
Subject: [PATCH 60/76] fix ssm fetching

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ece78cccb..29f5e2cf8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,7 +49,7 @@ jobs:
         name: Get secrets
         with:
           aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
-          s3_path_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
+          ssm_parameter_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
       - name: update-version
         run: |
           ./scripts/release/update-version.sh

From 5f41bd414e792a50f757800ade669544e3d6591f Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 21 Jul 2025 17:09:01 -0400
Subject: [PATCH 61/76] debugging

---
 .github/workflows/release.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 29f5e2cf8..c884019b7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,6 +38,11 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
+        name: Get secrets
+        with:
+          aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
+          ssm_parameter_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
       - name: setup access for find-code-references
         uses: launchdarkly/gh-actions/actions/ssh-key-by-repo@main
         with:
@@ -45,11 +50,6 @@ jobs:
             {
               "launchdarkly/find-code-references": ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERENCES_DEPLOY_KEY) }}
             }
-      - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
-        name: Get secrets
-        with:
-          aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
-          ssm_parameter_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN, /production/common/releasing/circleci/orb-token= CIRCLECI_CLI_TOKEN, /production/common/releasing/bitbucket/username = BITBUCKET_USERNAME, /production/common/releasing/bitbucket/token = BITBUCKET_TOKEN'
       - name: update-version
         run: |
           ./scripts/release/update-version.sh

From a8d84f31f3b36fd5e68699999d397b2ba7efdf8e Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 21 Jul 2025 17:10:18 -0400
Subject: [PATCH 62/76] debugging

---
 .github/workflows/release.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c884019b7..6034cf582 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,8 +31,8 @@ jobs:
       # DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       # DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
       # CIRCLECI_CLI_TOKEN: ${{ secrets.CIRCLECI_CLI_TOKEN }}
-      BITBUCKET_USERNAME: ${{ secrets.BITBUCKET_USERNAME }}
-      BITBUCKET_TOKEN: ${{ secrets.BITBUCKET_TOKEN }}
+      # BITBUCKET_USERNAME: ${{ secrets.BITBUCKET_USERNAME }}
+      # BITBUCKET_TOKEN: ${{ secrets.BITBUCKET_TOKEN }}
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
     steps:
       - uses: actions/checkout@v4

From 7c7fe76ef13fb420fb4f47ff2eacb298de883fe3 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 21 Jul 2025 17:26:25 -0400
Subject: [PATCH 63/76] debugging

---
 .github/workflows/release.yml | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6034cf582..9ba7e5588 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,6 +19,8 @@ on:
 
 jobs:
   release:
+    permissions:
+      id-token:
     runs-on: ubuntu-latest
     env:
       # temporary ENV VARs for input; this is only because workflow_dispatch
@@ -28,11 +30,6 @@ jobs:
       # LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
       # DRY_RUN: ${{ inputs.dryRun }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      # DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      # DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
-      # CIRCLECI_CLI_TOKEN: ${{ secrets.CIRCLECI_CLI_TOKEN }}
-      # BITBUCKET_USERNAME: ${{ secrets.BITBUCKET_USERNAME }}
-      # BITBUCKET_TOKEN: ${{ secrets.BITBUCKET_TOKEN }}
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
     steps:
       - uses: actions/checkout@v4

From db4e4b0d16a3cd74d76d603d52b56c2626a9032b Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 21 Jul 2025 17:27:20 -0400
Subject: [PATCH 64/76] debugging

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9ba7e5588..5e1275b98 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ on:
 jobs:
   release:
     permissions:
-      id-token:
+      id-token
     runs-on: ubuntu-latest
     env:
       # temporary ENV VARs for input; this is only because workflow_dispatch

From 9c9ba998a488fba4ad764b273a8124b446b8d4cf Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 21 Jul 2025 17:29:28 -0400
Subject: [PATCH 65/76] debugging

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5e1275b98..6d1064260 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ on:
 jobs:
   release:
     permissions:
-      id-token
+      id-token: read
     runs-on: ubuntu-latest
     env:
       # temporary ENV VARs for input; this is only because workflow_dispatch

From fb5abfdaf22273c0ac0a2c00ce0fe89aba44ad55 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 21 Jul 2025 17:30:00 -0400
Subject: [PATCH 66/76] debugging

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6d1064260..c97187c4d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ on:
 jobs:
   release:
     permissions:
-      id-token: read
+      id-token: 'read'
     runs-on: ubuntu-latest
     env:
       # temporary ENV VARs for input; this is only because workflow_dispatch

From da9a860549d0e962c359ef5825a7c9fac17e419f Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Mon, 21 Jul 2025 17:31:30 -0400
Subject: [PATCH 67/76] debugging

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c97187c4d..1f4e65ce5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ on:
 jobs:
   release:
     permissions:
-      id-token: 'read'
+      id-token: 'write'
     runs-on: ubuntu-latest
     env:
       # temporary ENV VARs for input; this is only because workflow_dispatch

From 83a4f8ec72aa5ea5331229b997e241a47de902ff Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Tue, 22 Jul 2025 14:45:15 -0400
Subject: [PATCH 68/76] skip publish if version exists

---
 .github/workflows/release.yml                  |  4 ++--
 scripts/release/publish-dry-run.sh             |  4 ++--
 scripts/release/publish.sh                     |  2 +-
 .../{publish-runners => targets}/bitbucket.sh  | 13 ++++++++-----
 .../{publish-runners => targets}/circleci.sh   |  8 ++++++--
 .../{publish-runners => targets}/gha.sh        | 18 +++++++++++-------
 6 files changed, 30 insertions(+), 19 deletions(-)
 rename scripts/release/{publish-runners => targets}/bitbucket.sh (78%)
 rename scripts/release/{publish-runners => targets}/circleci.sh (84%)
 rename scripts/release/{publish-runners => targets}/gha.sh (77%)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1f4e65ce5..2132c17fe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -65,7 +65,7 @@ jobs:
           else
             ./scripts/release/publish.sh
           fi
-  # create-release:
+  # create-gh-release:
   #   runs-on: ubuntu-latest
   #   permissions:
   #     contents: write
@@ -73,6 +73,6 @@ jobs:
   #   steps:
   #     - uses: ncipollo/release-action@v1.14.0
   #       with:
-  #         token: ${{ secrets.BOT_TOKEN }}
+  #         token: ${{ secrets.GITHUB_TOKEN }}
   #         tag: v${{ inputs.releaseVersion }}
   #         body: ${{ inputs.changeLog }}
diff --git a/scripts/release/publish-dry-run.sh b/scripts/release/publish-dry-run.sh
index a9ae2eeb5..3f48932a3 100755
--- a/scripts/release/publish-dry-run.sh
+++ b/scripts/release/publish-dry-run.sh
@@ -16,10 +16,10 @@ sudo docker save launchdarkly/${BASE_CODEREFS}:latest | gzip >${ARTIFACT_DIRECTO
 sudo docker save launchdarkly/${GH_CODEREFS}:latest | gzip >${ARTIFACT_DIRECTORY}/${GH_CODEREFS}.tar.gz
 sudo docker save launchdarkly/${BB_CODEREFS}:latest | gzip >${ARTIFACT_DIRECTORY}/${BB_CODEREFS}.tar.gz
 
-for script in $(dirname $0)/publish-runners/*.sh; do
+for script in $(dirname $0)/targets/*.sh; do
   source $script
 done
 
-# dry_run_gha
+dry_run_gha
 dry_run_circleci
 dry_run_bitbucket
diff --git a/scripts/release/publish.sh b/scripts/release/publish.sh
index 3f7c1f14b..b4f550cd4 100755
--- a/scripts/release/publish.sh
+++ b/scripts/release/publish.sh
@@ -11,7 +11,7 @@ chmod 644 ~/.ssh/known_hosts
 ssh-keyscan -t rsa bitbucket.org >> ~/.ssh/known_hosts
 ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts
 
-for script in $(dirname $0)/publish-runners/*.sh; do
+for script in $(dirname $0)/targets/*.sh; do
   source $script
 done
 
diff --git a/scripts/release/publish-runners/bitbucket.sh b/scripts/release/targets/bitbucket.sh
similarity index 78%
rename from scripts/release/publish-runners/bitbucket.sh
rename to scripts/release/targets/bitbucket.sh
index 5948def0c..6f761d2ab 100755
--- a/scripts/release/publish-runners/bitbucket.sh
+++ b/scripts/release/targets/bitbucket.sh
@@ -23,10 +23,15 @@ clean_up_bitbucket() (
 
 publish_bitbucket() (
   setup_bitbucket
+  cd bitbucketMetadataUpdates
 
-  echo "Live run: will publish pipe to bitbucket."
-  git tag $LD_RELEASE_VERSION
-  git push bb-origin master --tags
+  if git ls-remote --tags origin "refs/tags/v$VERSION" | grep -q "v$VERSION"; then
+    echo "Version exists; skipping publishing BitBucket Pipe"
+  else
+    echo "Live run: will publish pipe to bitbucket."
+    git tag $LD_RELEASE_VERSION
+    git push bb-origin master --tags
+  fi
 
   clean_up_bitbucket
 )
@@ -36,8 +41,6 @@ dry_run_bitbucket() (
 
   echo "Dry run: will not publish pipe to bitbucket."
   cd bitbucketMetadataUpdates
-  git show-ref
-  git remote -v
   git push bb-origin master --tags --dry-run
 
   clean_up_bitbucket
diff --git a/scripts/release/publish-runners/circleci.sh b/scripts/release/targets/circleci.sh
similarity index 84%
rename from scripts/release/publish-runners/circleci.sh
rename to scripts/release/targets/circleci.sh
index 4406debfc..5cf4f3f43 100755
--- a/scripts/release/publish-runners/circleci.sh
+++ b/scripts/release/targets/circleci.sh
@@ -60,8 +60,12 @@ publish_circleci() (
   install_circleci
   validate_circleci_orb_config
 
-  echo "Live run: will publish orb to production circleci repo."
-  circleci orb publish build/package/circleci/orb.yml launchdarkly/ld-find-code-refs@$LD_RELEASE_VERSION --token $CIRCLECI_CLI_TOKEN --host $CIRCLECI_CLI_HOST
+  if circleci orb list | grep launchdarkly/ld-find-code-refs@$LD_RELEASE_VERSION; then
+    echo "Version exists; skipping publishing CircleCI Orb"
+  else
+    echo "Live run: will publish orb to production circleci repo."
+    circleci orb publish build/package/circleci/orb.yml launchdarkly/ld-find-code-refs@$LD_RELEASE_VERSION --token $CIRCLECI_CLI_TOKEN --host $CIRCLECI_CLI_HOST
+  fi
 )
 
 dry_run_circleci() (
diff --git a/scripts/release/publish-runners/gha.sh b/scripts/release/targets/gha.sh
similarity index 77%
rename from scripts/release/publish-runners/gha.sh
rename to scripts/release/targets/gha.sh
index 29d12e0b9..cce5e86c0 100755
--- a/scripts/release/publish-runners/gha.sh
+++ b/scripts/release/targets/gha.sh
@@ -39,13 +39,17 @@ clean_up_gha() (
 publish_gha() (
   setup_gha
 
-  echo "Live run: will publish action to github action marketplace."
-  # tag the commit with the release version and create release
-  git tag $RELEASE_TAG
-  git push origin main --tags
-  git tag -f $RELEASE_TAG_MAJOR
-  git push -f origin $RELEASE_TAG_MAJOR
-  gh release create $RELEASE_TAG --notes "$RELEASE_NOTES"
+  if git ls-remote --tags origin "refs/tags/v$VERSION" | grep -q "v$VERSION"; then
+    echo "Version exists; skipping publishing GHA"
+  else
+    echo "Live run: will publish action to github action marketplace."
+    # tag the commit with the release version and create release
+    git tag $RELEASE_TAG
+    git push origin main --tags
+    git tag -f $RELEASE_TAG_MAJOR
+    git push -f origin $RELEASE_TAG_MAJOR
+    gh release create $RELEASE_TAG --notes "$RELEASE_NOTES"
+  fi
 
   clean_up
 )

From cf4573c09c09095056171f4ec872dbead7d7bede Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Tue, 22 Jul 2025 14:51:55 -0400
Subject: [PATCH 69/76] debugging

---
 scripts/release/targets/gha.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/release/targets/gha.sh b/scripts/release/targets/gha.sh
index cce5e86c0..f6501c03d 100755
--- a/scripts/release/targets/gha.sh
+++ b/scripts/release/targets/gha.sh
@@ -55,7 +55,7 @@ publish_gha() (
 )
 
 dry_run_gha() (
-  setup
+  setup_gha
 
   echo "Dry run: will not publish action to github action marketplace."
   cd githubActionsMetadataUpdates

From acdf7c28bf82d5abf3ea453c07100e9d83f72b37 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Tue, 22 Jul 2025 16:16:19 -0400
Subject: [PATCH 70/76] debugging

---
 .github/workflows/release.yml      | 38 ++++++++++++--------
 scripts/release/prepare-release.sh | 58 ++++++++++++++++++++++++++++++
 scripts/release/update-version.sh  | 37 -------------------
 3 files changed, 81 insertions(+), 52 deletions(-)
 create mode 100755 scripts/release/prepare-release.sh
 delete mode 100755 scripts/release/update-version.sh

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2132c17fe..55d64f76d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,7 +28,7 @@ jobs:
       LD_RELEASE_VERSION: 2.14.0
       DRY_RUN: true
       # LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
-      # DRY_RUN: ${{ inputs.dryRun }}
+      # DRY_RUN: ${{ inputs.dryRun || 'false' }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
     steps:
@@ -47,9 +47,6 @@ jobs:
             {
               "launchdarkly/find-code-references": ${{ toJSON(secrets.LAUNCHDARKLY_FIND_CODE_REFERENCES_DEPLOY_KEY) }}
             }
-      - name: update-version
-        run: |
-          ./scripts/release/update-version.sh
       - name: build
         run: |
           if [[ $LD_RELEASE_VERSION == v* ]]; then
@@ -65,14 +62,25 @@ jobs:
           else
             ./scripts/release/publish.sh
           fi
-  # create-gh-release:
-  #   runs-on: ubuntu-latest
-  #   permissions:
-  #     contents: write
-  #   needs: release
-  #   steps:
-  #     - uses: ncipollo/release-action@v1.14.0
-  #       with:
-  #         token: ${{ secrets.GITHUB_TOKEN }}
-  #         tag: v${{ inputs.releaseVersion }}
-  #         body: ${{ inputs.changeLog }}
+
+  create-gh-release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    needs: release
+    steps:
+      - name: prepare files for release
+        env:
+          # temporary ENV VARs for input; this is only because workflow_dispatch
+          # actions can only run on main for some reason
+          LD_RELEASE_VERSION: 2.14.0
+          DRY_RUN: true
+        run: |
+          ./scripts/release/prepare-release.sh
+      # - name: Create Github release
+      #   uses: ncipollo/release-action@v1.14.0
+      #   if: ${{ inputs.dryRun != 'true' }}
+      #   with:
+      #     token: ${{ secrets.GITHUB_TOKEN }}
+      #     tag: v${{ inputs.releaseVersion }}
+      #     body: ${{ inputs.changeLog }}
diff --git a/scripts/release/prepare-release.sh b/scripts/release/prepare-release.sh
new file mode 100755
index 000000000..de11e11d2
--- /dev/null
+++ b/scripts/release/prepare-release.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+
+set -euo pipefail
+
+RELEASE_TAG="v${LD_RELEASE_VERSION}"
+
+update_go() (
+  sed -i "s/const Version =.*/const Version = \"${LD_RELEASE_VERSION}\"/g" internal/version/version.go
+)
+
+update_orb() (
+  sed -i "s#launchdarkly/ld-find-code-refs@.*#launchdarkly/ld-find-code-refs@${LD_RELEASE_VERSION}#g" build/package/circleci/orb.yml
+  sed -i "s#- image: launchdarkly/ld-find-code-refs:.*#- image: launchdarkly/ld-find-code-refs:${LD_RELEASE_VERSION}#g" build/package/circleci/orb.yml
+)
+
+update_gha() (
+  sed -i "s#launchdarkly/find-code-references@v.*#launchdarkly/find-code-references@${RELEASE_TAG}#g" build/metadata/github-actions/README.md
+  sed -i "s#launchdarkly/ld-find-code-refs-github-action:.*#launchdarkly/ld-find-code-refs-github-action:${LD_RELEASE_VERSION}#g" build/metadata/github-actions/Dockerfile
+)
+
+update_bitbucket() (
+  sed -i "s#- pipe: launchdarkly/ld-find-code-refs-pipe.*#- pipe: launchdarkly/ld-find-code-refs-pipe:${LD_RELEASE_VERSION}#g" build/metadata/bitbucket/README.md
+  sed -i "s#image: launchdarkly/ld-find-code-refs-bitbucket-pipeline:.*#image: launchdarkly/ld-find-code-refs-bitbucket-pipeline:${LD_RELEASE_VERSION}#g" build/metadata/bitbucket/pipe.yml
+)
+
+tag_exists() (
+  git fetch --tags
+  git rev-parse "${RELEASE_TAG}" >/dev/null 2>&1
+)
+
+# update relevant files
+update_go
+update_orb
+update_gha
+update_bitbucket
+
+# preview changes (dry-run safe)
+echo "Changes staged for release $RELEASE_TAG:"
+git diff
+
+# commit, tag, and push
+if [[ "$DRY_RUN" == "true" ]]; then
+  echo "Dry run mode: skipping commit, tag, and push"
+else
+  if tag_exists; then
+    echo "❌ Tag $RELEASE_TAG already exists. Aborting."
+    exit 1
+  fi
+
+  git config user.name "LaunchDarklyReleaseBot"
+  git config user.email "releasebot@launchdarkly.com"
+  git add .
+  git commit -m "Prepare release ${RELEASE_TAG}"
+  git tag "${RELEASE_TAG}"
+  git push origin HEAD
+  git push origin "${RELEASE_TAG}"
+fi
+
diff --git a/scripts/release/update-version.sh b/scripts/release/update-version.sh
deleted file mode 100755
index 6575bff3a..000000000
--- a/scripts/release/update-version.sh
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/bin/bash
-
-set -e
-
-RELEASE_TAG="v${LD_RELEASE_VERSION}"
-
-update_go() (
-  VERSION_GO=internal/version/version.go
-  sed -i "s/const Version =.*/const Version = \"${LD_RELEASE_VERSION}\"/g" ${VERSION_GO}
-)
-
-update_orb() (
-  VERSION_ORB=build/package/circleci/orb.yml
-  sed -i "s#launchdarkly: launchdarkly/ld-find-code-refs@.*#launchdarkly: launchdarkly/ld-find-code-refs@${LD_RELEASE_VERSION}#g" ${VERSION_ORB}
-  sed -i "s#- image: launchdarkly/ld-find-code-refs:.*#- image: launchdarkly/ld-find-code-refs:${LD_RELEASE_VERSION}#g" ${VERSION_ORB}
-)
-
-update_gha() (
-  README=build/metadata/github-actions/README.md
-  sed -i "s#launchdarkly/find-code-references@v.*#launchdarkly/find-code-references@${RELEASE_TAG}#g" ${README}
-
-  DOCKERFILE=build/metadata/github-actions/Dockerfile
-  sed -i "s#launchdarkly/ld-find-code-refs-github-action:.*#launchdarkly/ld-find-code-refs-github-action:${LD_RELEASE_VERSION}#g" ${DOCKERFILE}
-)
-
-update_bitbucket() (
-  README=build/metadata/bitbucket/README.md
-  sed -i "s#- pipe: launchdarkly/ld-find-code-refs-pipe.*#- pipe: launchdarkly/ld-find-code-refs-pipe:${LD_RELEASE_VERSION}#g" ${README}
-
-  YML=build/metadata/bitbucket/pipe.yml
-  sed -i "s#image: launchdarkly/ld-find-code-refs-bitbucket-pipeline:.*#image: launchdarkly/ld-find-code-refs-bitbucket-pipeline:${LD_RELEASE_VERSION}#g" ${YML}
-)
-
-update_go
-update_orb
-update_gha
-update_bitbucket

From 569f330418febd7947937e77cf356610ed65f845 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Tue, 22 Jul 2025 16:30:04 -0400
Subject: [PATCH 71/76] debugging

---
 scripts/release/targets/bitbucket.sh | 2 ++
 scripts/release/targets/gha.sh       | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/release/targets/bitbucket.sh b/scripts/release/targets/bitbucket.sh
index 6f761d2ab..af45a5a80 100755
--- a/scripts/release/targets/bitbucket.sh
+++ b/scripts/release/targets/bitbucket.sh
@@ -12,6 +12,8 @@ setup_bitbucket() (
   cd bitbucketMetadataUpdates
   git config user.email "launchdarklyreleasebot@launchdarkly.com"
   git config user.name "LaunchDarklyReleaseBot"
+  git status
+  git diff
   git add -u
   git commit -m "Release auto update version $LD_RELEASE_VERSION"
   git remote add bb-origin "https://${BITBUCKET_USERNAME}:${BITBUCKET_TOKEN}@bitbucket.org/launchdarkly/ld-find-code-refs-pipe.git"
diff --git a/scripts/release/targets/gha.sh b/scripts/release/targets/gha.sh
index f6501c03d..309059a92 100755
--- a/scripts/release/targets/gha.sh
+++ b/scripts/release/targets/gha.sh
@@ -59,7 +59,6 @@ dry_run_gha() (
 
   echo "Dry run: will not publish action to github action marketplace."
   cd githubActionsMetadataUpdates
-  git show-ref
   git push origin main --tags --dry-run
 
   clean_up_gha

From 3e5d43397c98ecd9aaea3e7be7d9d1b9e4792c74 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Tue, 22 Jul 2025 16:46:42 -0400
Subject: [PATCH 72/76] debugging

---
 scripts/release/publish-dry-run.sh   | 2 +-
 scripts/release/targets/bitbucket.sh | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/scripts/release/publish-dry-run.sh b/scripts/release/publish-dry-run.sh
index 3f48932a3..aca3f39e5 100755
--- a/scripts/release/publish-dry-run.sh
+++ b/scripts/release/publish-dry-run.sh
@@ -20,6 +20,6 @@ for script in $(dirname $0)/targets/*.sh; do
   source $script
 done
 
+dry_run_bitbucket
 dry_run_gha
 dry_run_circleci
-dry_run_bitbucket
diff --git a/scripts/release/targets/bitbucket.sh b/scripts/release/targets/bitbucket.sh
index af45a5a80..b408c6db4 100755
--- a/scripts/release/targets/bitbucket.sh
+++ b/scripts/release/targets/bitbucket.sh
@@ -12,8 +12,10 @@ setup_bitbucket() (
   cd bitbucketMetadataUpdates
   git config user.email "launchdarklyreleasebot@launchdarkly.com"
   git config user.name "LaunchDarklyReleaseBot"
-  git status
-  git diff
+  git show -p
+  cat ../build/metadata/bitbucket/README.md
+  echo "\n"
+  cat ../build/metadata/bitbucket/pipe.yml
   git add -u
   git commit -m "Release auto update version $LD_RELEASE_VERSION"
   git remote add bb-origin "https://${BITBUCKET_USERNAME}:${BITBUCKET_TOKEN}@bitbucket.org/launchdarkly/ld-find-code-refs-pipe.git"

From ad48e35487413061343b5fc589984323acb58009 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Wed, 23 Jul 2025 08:48:12 -0400
Subject: [PATCH 73/76] some initial clean up

---
 .github/workflows/release.yml        |  6 ++++--
 scripts/release/commit-and-tag.sh    | 26 ++++++++++++++++++++++++++
 scripts/release/prepare-release.sh   | 24 ------------------------
 scripts/release/publish-dry-run.sh   |  2 ++
 scripts/release/publish.sh           |  2 ++
 scripts/release/targets/bitbucket.sh |  6 +-----
 scripts/release/targets/circleci.sh  |  2 +-
 scripts/release/targets/gha.sh       |  2 +-
 8 files changed, 37 insertions(+), 33 deletions(-)
 create mode 100755 scripts/release/commit-and-tag.sh

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 55d64f76d..b35e9aa2b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -55,6 +55,8 @@ jobs:
           fi
 
           make build
+      - name: prepare release
+        run: ./scripts/release/prepare-release.sh
       - name: publish
         run: |
           if [[ "$DRY_RUN" = true ]]; then
@@ -69,14 +71,14 @@ jobs:
       contents: write
     needs: release
     steps:
-      - name: prepare files for release
+      - name: Commit changes and tag
         env:
           # temporary ENV VARs for input; this is only because workflow_dispatch
           # actions can only run on main for some reason
           LD_RELEASE_VERSION: 2.14.0
           DRY_RUN: true
         run: |
-          ./scripts/release/prepare-release.sh
+          ./scripts/release/commit-and-tag.sh
       # - name: Create Github release
       #   uses: ncipollo/release-action@v1.14.0
       #   if: ${{ inputs.dryRun != 'true' }}
diff --git a/scripts/release/commit-and-tag.sh b/scripts/release/commit-and-tag.sh
new file mode 100755
index 000000000..72e9fdb30
--- /dev/null
+++ b/scripts/release/commit-and-tag.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+set -euo pipefail
+
+RELEASE_TAG="v${LD_RELEASE_VERSION}"
+
+echo "Changes staged for release $RELEASE_TAG:"
+git diff
+
+if [[ "$DRY_RUN" == "true" ]]; then
+  echo "Dry run mode: skipping commit, tag, and push"
+else
+  if tag_exists; then
+    echo "Tag $RELEASE_TAG already exists. Aborting."
+    exit 1
+  fi
+
+  git config user.name "LaunchDarklyReleaseBot"
+  git config user.email "releasebot@launchdarkly.com"
+  git add .
+  git commit -m "Prepare release ${RELEASE_TAG}"
+  git tag "${RELEASE_TAG}"
+  git push origin HEAD
+  git push origin "${RELEASE_TAG}"
+fi
+
diff --git a/scripts/release/prepare-release.sh b/scripts/release/prepare-release.sh
index de11e11d2..4970a6819 100755
--- a/scripts/release/prepare-release.sh
+++ b/scripts/release/prepare-release.sh
@@ -28,31 +28,7 @@ tag_exists() (
   git rev-parse "${RELEASE_TAG}" >/dev/null 2>&1
 )
 
-# update relevant files
 update_go
 update_orb
 update_gha
 update_bitbucket
-
-# preview changes (dry-run safe)
-echo "Changes staged for release $RELEASE_TAG:"
-git diff
-
-# commit, tag, and push
-if [[ "$DRY_RUN" == "true" ]]; then
-  echo "Dry run mode: skipping commit, tag, and push"
-else
-  if tag_exists; then
-    echo "❌ Tag $RELEASE_TAG already exists. Aborting."
-    exit 1
-  fi
-
-  git config user.name "LaunchDarklyReleaseBot"
-  git config user.email "releasebot@launchdarkly.com"
-  git add .
-  git commit -m "Prepare release ${RELEASE_TAG}"
-  git tag "${RELEASE_TAG}"
-  git push origin HEAD
-  git push origin "${RELEASE_TAG}"
-fi
-
diff --git a/scripts/release/publish-dry-run.sh b/scripts/release/publish-dry-run.sh
index aca3f39e5..8704dce53 100755
--- a/scripts/release/publish-dry-run.sh
+++ b/scripts/release/publish-dry-run.sh
@@ -1,5 +1,7 @@
 #!/bin/bash
 
+set -euo pipefail
+
 echo ${DOCKER_TOKEN} | sudo docker login --username ${DOCKER_USERNAME} --password-stdin
 
 sudo PATH=${PATH} GITHUB_TOKEN=${GITHUB_TOKEN} make products-for-release
diff --git a/scripts/release/publish.sh b/scripts/release/publish.sh
index b4f550cd4..59d4aca4a 100755
--- a/scripts/release/publish.sh
+++ b/scripts/release/publish.sh
@@ -1,5 +1,7 @@
 #!/bin/bash
 
+set -euo pipefail
+
 sudo docker login --username ${DOCKER_USERNAME} --password-stdin ${DOCKER_TOKEN}
 
 sudo PATH=${PATH} GITHUB_TOKEN=${GITHUB_TOKEN} make publish
diff --git a/scripts/release/targets/bitbucket.sh b/scripts/release/targets/bitbucket.sh
index b408c6db4..efdc16ade 100755
--- a/scripts/release/targets/bitbucket.sh
+++ b/scripts/release/targets/bitbucket.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # Run this in publish step after all version information have been updated.
-set -ev
+set -euo pipefail
 
 setup_bitbucket() (
   rm -rf bitbucketMetadataUpdates
@@ -12,10 +12,6 @@ setup_bitbucket() (
   cd bitbucketMetadataUpdates
   git config user.email "launchdarklyreleasebot@launchdarkly.com"
   git config user.name "LaunchDarklyReleaseBot"
-  git show -p
-  cat ../build/metadata/bitbucket/README.md
-  echo "\n"
-  cat ../build/metadata/bitbucket/pipe.yml
   git add -u
   git commit -m "Release auto update version $LD_RELEASE_VERSION"
   git remote add bb-origin "https://${BITBUCKET_USERNAME}:${BITBUCKET_TOKEN}@bitbucket.org/launchdarkly/ld-find-code-refs-pipe.git"
diff --git a/scripts/release/targets/circleci.sh b/scripts/release/targets/circleci.sh
index 5cf4f3f43..32ae63a65 100755
--- a/scripts/release/targets/circleci.sh
+++ b/scripts/release/targets/circleci.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # Run this in publish step after all version information have been updated.
-set -ev
+set -euo pipefail
 
 CIRCLECI_CLI_HOST="https://circleci.com"
 
diff --git a/scripts/release/targets/gha.sh b/scripts/release/targets/gha.sh
index 309059a92..4f229bcc0 100755
--- a/scripts/release/targets/gha.sh
+++ b/scripts/release/targets/gha.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # Run this in publish step after all version information have been updated.
-set -ev
+set -euo pipefail
 
 RELEASE_TAG="v${LD_RELEASE_VERSION}"
 RELEASE_NOTES="$(make echo-release-notes)"

From fa7430223d243b7cb7fb4197c3c89234363bb43b Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Wed, 23 Jul 2025 09:07:57 -0400
Subject: [PATCH 74/76] convert to a single job

---
 .github/workflows/release.yml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b35e9aa2b..5546a7940 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -64,13 +64,6 @@ jobs:
           else
             ./scripts/release/publish.sh
           fi
-
-  create-gh-release:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    needs: release
-    steps:
       - name: Commit changes and tag
         env:
           # temporary ENV VARs for input; this is only because workflow_dispatch

From 9843127b7f275b33eb3f60bec72d451717a122b9 Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Wed, 23 Jul 2025 09:59:09 -0400
Subject: [PATCH 75/76] getting close now

---
 .github/workflows/release.yml | 51 ++++++++++++++++-------------------
 1 file changed, 23 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5546a7940..1245ab0e6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,21 +1,20 @@
 name: Release
 
 on:
-  pull_request
-  # workflow_dispatch:
-  #   inputs:
-  #     dryRun:
-  #       description: Perform a dry-run only
-  #       required: false
-  #       type: boolean
-  #     releaseVersion:
-  #       description: Next release version
-  #       required: true
-  #       type: string
-  #     changeLog:
-  #       description: Pending changelog
-  #       required: true
-  #       type: string
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        description: Perform a dry-run only
+        required: false
+        type: boolean
+      releaseVersion:
+        description: Next release version
+        required: true
+        type: string
+      changeLog:
+        description: Pending changelog
+        required: true
+        type: string
 
 jobs:
   release:
@@ -23,12 +22,8 @@ jobs:
       id-token: 'write'
     runs-on: ubuntu-latest
     env:
-      # temporary ENV VARs for input; this is only because workflow_dispatch
-      # actions can only run on main for some reason
-      LD_RELEASE_VERSION: 2.14.0
-      DRY_RUN: true
-      # LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
-      # DRY_RUN: ${{ inputs.dryRun || 'false' }}
+      LD_RELEASE_VERSION: ${{ inputs.releaseVersion }}
+      DRY_RUN: ${{ inputs.dryRun || 'false' }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       ARTIFACT_DIRECTORY: "/tmp/release-artifacts"
     steps:
@@ -72,10 +67,10 @@ jobs:
           DRY_RUN: true
         run: |
           ./scripts/release/commit-and-tag.sh
-      # - name: Create Github release
-      #   uses: ncipollo/release-action@v1.14.0
-      #   if: ${{ inputs.dryRun != 'true' }}
-      #   with:
-      #     token: ${{ secrets.GITHUB_TOKEN }}
-      #     tag: v${{ inputs.releaseVersion }}
-      #     body: ${{ inputs.changeLog }}
+      - name: Create Github release
+        uses: ncipollo/release-action@v1.14.0
+        if: ${{ inputs.dryRun != 'true' }}
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          tag: v${{ inputs.releaseVersion }}
+          body: ${{ inputs.changeLog }}

From ea881908f833e6c4dd9f635bb28de2e74aa5137e Mon Sep 17 00:00:00 2001
From: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Wed, 23 Jul 2025 10:59:15 -0400
Subject: [PATCH 76/76] remove unneeded env vars

---
 .github/workflows/release.yml | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1245ab0e6..6dc985e6b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -60,11 +60,6 @@ jobs:
             ./scripts/release/publish.sh
           fi
       - name: Commit changes and tag
-        env:
-          # temporary ENV VARs for input; this is only because workflow_dispatch
-          # actions can only run on main for some reason
-          LD_RELEASE_VERSION: 2.14.0
-          DRY_RUN: true
         run: |
           ./scripts/release/commit-and-tag.sh
       - name: Create Github release