feat: add pre-release support via PR label

Author: sechmann

.github/workflows/build.yaml

@@ -1,7 +1,7 @@
 name: Nais CLI
 on:
   pull_request:
-    types: [opened, reopened, synchronize]
+    types: [opened, reopened, synchronize, labeled]
   push:
     branches: [main]
     paths-ignore: ["**.md"]
@@ -10,6 +10,8 @@ concurrency:
   cancel-in-progress: true
 permissions:
   contents: read
+env:
+  PRE_RELEASE: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'pre-release') && 'true' || 'false' }}
 jobs:
   release-info:
     runs-on: ubuntu-latest
@@ -19,6 +21,7 @@ jobs:
     outputs:
       version: ${{ steps.release-info.outputs.version }}
       changelog: ${{ steps.release-info.outputs.changelog }}
+      pre_release: ${{ steps.release-info.outputs.pre_release }}
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
@@ -29,6 +32,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           IS_FORK: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+          PRE_RELEASE: ${{ env.PRE_RELEASE }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
   checks:
     strategy:
       matrix:
@@ -97,7 +102,13 @@ jobs:
   release-github:
     permissions:
       contents: write
-    if: github.ref == 'refs/heads/main' && needs.release-info.outputs.changelog != '' && needs.release-info.outputs.version != ''
+    if: >-
+      needs.release-info.outputs.changelog != '' &&
+      needs.release-info.outputs.version != '' &&
+      (
+        (github.ref == 'refs/heads/main' && github.actor != 'dependabot[bot]') ||
+        needs.release-info.outputs.pre_release == 'true'
+      )
     runs-on: ubuntu-latest
     needs: [release-info, branch-protection-checkpoint]
     steps:
@@ -115,17 +126,20 @@ jobs:
         id: release
         with:
           tag_name: v${{ needs.release-info.outputs.version }}
+          target_commitish: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
           body: ${{ needs.release-info.outputs.changelog }}
-          prerelease: false
+          prerelease: ${{ env.PRE_RELEASE == 'true' }}
           files: ./release_artifacts/*
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - env:
+      - if: env.PRE_RELEASE != 'true'
+        env:
           VERSION: ${{ needs.release-info.outputs.version }}
         run: |
           echo '${{ steps.release.outputs.assets }}' > assets.json
           mise run ci:prepare-template-vars ./release_artifacts/checksums.txt ./assets.json -v > template.vars
-      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # ratchet:actions/upload-artifact@v5
+      - if: env.PRE_RELEASE != 'true'
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # ratchet:actions/upload-artifact@v5
         with:
           name: template-vars
           path: ./template.vars
@@ -134,8 +148,8 @@ jobs:
           echo "## :rocket: Release v${{ needs.release-info.outputs.version }}" >> $GITHUB_STEP_SUMMARY
           echo "A new release is available over at https://github.com/${{ github.repository }}/releases/tag/v${{ needs.release-info.outputs.version }}." >> $GITHUB_STEP_SUMMARY
   release-gar:
-    if: github.ref == 'refs/heads/main'
-    needs: [release-github]
+    if: github.ref == 'refs/heads/main' && needs.release-info.outputs.pre_release != 'true'
+    needs: [release-info, release-github]
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -160,8 +174,8 @@ jobs:
           gcloud --project nais-io artifacts apt upload nais-ppa --quiet --source nais-cli_arm64.deb --location europe-north1
           gcloud --project nais-io artifacts apt upload nais-ppa --quiet --source nais-cli_amd64.deb --location europe-north1
   release-external-repos:
-    if: github.ref == 'refs/heads/main'
-    needs: [release-github]
+    if: github.ref == 'refs/heads/main' && needs.release-info.outputs.pre_release != 'true'
+    needs: [release-info, release-github]
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false

mise/tasks/ci/release-info.sh

@@ -52,8 +52,13 @@ main() {
 		return
 	fi
 
+	if [[ "${PRE_RELEASE:-}" == "true" && -n "${PR_NUMBER:-}" ]]; then
+		version="${version}-rc.${PR_NUMBER}"
+	fi
+
 	output "changelog" "$changelog"
 	output "version" "$version"
+	output "pre_release" "${PRE_RELEASE:-false}"
 }
 
 output() {