feat: automate ci/cd for otto

.github/workflows/otto-commitlint.yml

@@ -0,0 +1,16 @@
+name: Otto Conventional Commits
+
+on:
+  pull_request_target:
+    paths:
+      - "otto/**"
+    types: [opened, edited, synchronize, reopened]
+
+jobs:
+  semantic-pull-request:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/otto-goreleaser.yml

@@ -0,0 +1,119 @@
+name: Otto GoReleaser
+
+on:
+  workflow_run:
+    workflows: ["Release Management"]
+    types:
+      - completed
+    branches:
+      - main
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  release-otto:
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # Check if we need to run the release for Otto
+      - name: Download workflow artifact
+        uses: actions/github-script@v7
+        id: download-artifact
+        with:
+          script: |
+            const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: ${{ github.event.workflow_run.id }}
+            });
+            
+            const matchArtifact = artifacts.data.artifacts.find(artifact => {
+              return artifact.name === "release-please-outputs"
+            });
+            
+            if (!matchArtifact) {
+              console.log('No release-please-outputs artifact found');
+              return false;
+            }
+            
+            const download = await github.rest.actions.downloadArtifact({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              artifact_id: matchArtifact.id,
+              archive_format: 'zip'
+            });
+            
+            const fs = require('fs');
+            fs.writeFileSync('release-please-outputs.zip', Buffer.from(download.data));
+            
+            console.log('Downloaded artifact');
+            return true;
+      
+      - name: Unzip artifact
+        if: steps.download-artifact.outputs.result == 'true'
+        run: unzip release-please-outputs.zip
+
+      - name: Read release information
+        id: release-info
+        if: steps.download-artifact.outputs.result == 'true'
+        run: |
+          if [ -f "otto--release_created" ]; then
+            RELEASE_CREATED=$(cat otto--release_created)
+            echo "otto_release_created=${RELEASE_CREATED}" >> $GITHUB_OUTPUT
+            if [ "${RELEASE_CREATED}" == "true" ] && [ -f "otto--tag_name" ]; then
+              TAG_NAME=$(cat otto--tag_name)
+              echo "otto_tag_name=${TAG_NAME}" >> $GITHUB_OUTPUT
+            fi
+          fi
+      
+      # Only run the rest of the job if Otto was released
+      - name: Set up Go
+        if: steps.release-info.outputs.otto_release_created == 'true'
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: ./otto/go.mod
+          cache: true
+
+      - name: Set up QEMU
+        if: steps.release-info.outputs.otto_release_created == 'true'
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        if: steps.release-info.outputs.otto_release_created == 'true'
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Container Registry
+        if: steps.release-info.outputs.otto_release_created == 'true'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Install cosign for artifact signing
+      - name: Install cosign
+        if: steps.release-info.outputs.otto_release_created == 'true'
+        uses: sigstore/[email protected]
+        with:
+          cosign-release: 'v2.2.2'
+
+      - name: Run GoReleaser
+        if: steps.release-info.outputs.otto_release_created == 'true'
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser
+          version: latest
+          args: release --clean
+          workdir: ./otto
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # These secrets need to be set in the repository settings
+          COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}

.github/workflows/release-management.yml

@@ -0,0 +1,52 @@
+name: Release Management
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run Release Please
+        uses: googleapis/release-please-action@v4
+        id: release
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+          release-type: go
+          monorepo-tags: true
+
+      # Save output variables as artifacts to be used by the GoReleaser workflow
+      - name: Save release outputs
+        if: ${{ steps.release.outputs.releases_created }}
+        run: |
+          # Save all the release-please outputs to files
+          echo "${{ steps.release.outputs.releases_created }}" > releases_created
+          echo "${{ steps.release.outputs.paths_released }}" > paths_released
+          
+          # Save Otto-specific outputs
+          echo "${{ steps.release.outputs['otto--release_created'] }}" > otto--release_created
+          echo "${{ steps.release.outputs['otto--tag_name'] }}" > otto--tag_name
+          
+      - name: Upload release outputs
+        if: ${{ steps.release.outputs.releases_created }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-please-outputs
+          path: |
+            releases_created
+            paths_released
+            otto--*
+            
+    outputs:
+      releases_created: ${{ steps.release.outputs.releases_created }}
+      paths_released: ${{ steps.release.outputs.paths_released }}
+      otto_release_created: ${{ steps.release.outputs['otto--release_created'] }}
+      otto_tag_name: ${{ steps.release.outputs['otto--tag_name'] }}

.github/workflows/test.yml

@@ -4,11 +4,13 @@ on:
   push:
     branches: [main]
     paths:
-      - "otto/**"
+      - 'otto/**'
+      - '.github/workflows/test.yml'
   pull_request:
     branches: [main]
     paths:
-      - "otto/**"
+      - 'otto/**'
+      - '.github/workflows/test.yml'
 
 jobs:
   test:
@@ -42,15 +44,47 @@ jobs:
         working-directory: ./otto
 
     steps:
-      - uses: actions/checkout@v4
+     - uses: actions/checkout@v4
 
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: 1.24.x
+     - name: Set up Go
+       uses: actions/setup-go@v5
+       with:
+         go-version: 1.24.x
 
-      - name: Run linter
-        uses: golangci/golangci-lint-action@v7
-        with:
-          version: latest
-          working-directory: otto
+     - name: Run linter
+       uses: golangci/golangci-lint-action@v7
+       with:
+         version: latest
+         working-directory: otto
+  build:
+    name: Build Check
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./otto
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: 1.24.x
+        cache: true
+        cache-dependency-path: otto/go.sum
+
+    - name: Build binary
+      run: make build
+
+    - name: Check GoReleaser config
+      uses: goreleaser/goreleaser-action@v6
+      with:
+        version: latest
+        args: check
+        workdir: ./otto
+
+    - name: Test Docker build
+      uses: goreleaser/goreleaser-action@v6
+      with:
+        version: latest
+        args: build --snapshot --clean --single-target
+        workdir: ./otto

.gitignore

@@ -1,4 +1,5 @@
 otto/config.yaml
 otto/secrets.yaml
 otto/.env
-otto/*.pem
+otto/dist
+.DS_Store

.release-please-config.json

@@ -0,0 +1,17 @@
+{
+  "packages": {
+    "otto": {
+      "release-type": "go",
+      "component": "otto",
+      "changelog-path": "CHANGELOG.md",
+      "bump-minor-pre-major": true,
+      "bump-patch-for-minor-pre-major": true,
+      "draft": false,
+      "prerelease": false,
+      "include-v-in-tag": true,
+      "pull-request-title-pattern": "chore${scope}: release${component} ${version}",
+      "tag-separator": "/"
+    }
+  },
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json"
+}

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  "otto": "0.1.0"
+}

CLAUDE.md

@@ -26,6 +26,17 @@ cd otto && make build
 cd otto && make lint
 ```
 
+## Release Process
+
+This repository uses [release-please-action](https://github.com/googleapis/release-please-action) to automate versioning and release management based on [Conventional Commits](https://www.conventionalcommits.org/).
+
+- Commit messages must follow the Conventional Commits specification
+- Use `fix:` prefixes for bug fixes (patch version bump)
+- Use `feat:` prefixes for new features (minor version bump)
+- Use `feat!:` or `fix!:` for breaking changes (major version bump)
+- Releases are created automatically when release PRs are merged
+- Each project in the monorepo has its own versioning lifecycle
+
 ## General Guidelines
 
 - Create code and configs following the standards in each project's directory