add direct GitHub OIDC release recording to registry API

[gontzess]

Why

The connector registry API replaces the per-connector Lambda release recording pipeline. During dual-write migration, each release records to both the legacy Lambda path and the registry API. The registry API authenticates CI via GitHub OIDC with per-connector isolation through the repository claim.

What this changes

record-release Go command (cmd/record-release/main.go): Type-safe transformation from the merged manifest (protojson) to the registry API RecordRelease request format. Maps asset fields (href to downloadUrl, signatureHref to signatureUrl, etc.), extracts image refs, reads optional docs/connector.mdx, and POSTs with Bearer auth. Handles 200 (success) and 409 (already exists) as non-error for dual-write compatibility.

release.yaml workflow changes: Adds record-registry-api as a separate job that runs after both legacy recording jobs complete (record-connector-registry + record-lambda-registry). Uses the merged manifest output from the dist recording job. Steps:

1. Checkout connector repo and workflows repo
2. Detect documentation presence
3. Get GitHub OIDC token with connector-registry audience
4. Fetch release notes from GitHub release body
5. Run record-release with manifest, metadata, and OIDC token

Fields sent to the registry API:

Field	Source
org	GitHub context
name	GitHub context
version	GitHub context (tag)
repositoryUrl	GitHub context
commitSha	GitHub context
workflowRunId	GitHub context
assets	goreleaser binaries, windows MSI, checksums
images	container images (GHCR, ECR Public, Lambda ARM64)
config_schema	connector repo config_schema.json
capabilities	connector repo baton_capabilities.json
documentation	connector repo docs/connector.mdx
changelog	GitHub release body
signature_url	cosign manifest signing
certificate_url	cosign manifest signing

Bug fix: record-connector-registry job condition now checks goreleaser-docker result. Previously a failed docker build still triggered the manifest upload and S3 sync with incomplete artifacts (missing container images). Docker must now succeed or be skipped.

Testing

test release v0.1.120-test.7 on baton-github-test validated the full pipeline 3/11

┌───────────────┬───────────────────────────────────────────────┐
│     Field     │                    Result                     │
├───────────────┼───────────────────────────────────────────────┤
│ documentation │ 17,956 chars (full connector.mdx)             │
├───────────────┼───────────────────────────────────────────────┤
│ changelog     │ 371 chars (GitHub release body)               │
├───────────────┼───────────────────────────────────────────────┤
│ configSchema  │ 5,487 chars (valid JSON with fields)          │
├───────────────┼───────────────────────────────────────────────┤
│ capabilities  │ 4,645 chars (valid JSON with @type preserved) │
├───────────────┼───────────────────────────────────────────────┤
│ assets        │ 7 platforms                                   │
├───────────────┼───────────────────────────────────────────────┤
│ images        │ ecrPublic + ghcr                              │
├───────────────┼───────────────────────────────────────────────┤
│ repositoryUrl │ correct                                       │
├───────────────┼───────────────────────────────────────────────┤
│ commitSha     │ correct                                       │
└───────────────┴───────────────────────────────────────────────┘

All jobs succeeded: record-connector-registry (legacy dist), record-lambda-registry (legacy lambda), record-registry-api (new path), verify-release

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• .github/workflows/release.yaml is excluded by none and included by none
• cmd/record-release/main.go is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 829ec1b8-730e-4f5d-a8b8-f121b1827248

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch gontzess/ce332-workflow-token-exchange

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[jugonzalez12]

nit: you had the status codes right here in the switch statement :)

[gontzess]

Nice catch thank you