Fix plugin.json version field to match release tag

[Copilot]

plugin.json has always shipped with "version": "1.0.0" regardless of the actual release tag, making programmatic version verification impossible.

Changes

• .goreleaser.yml: Add a before.hooks entry that rewrites the version field in plugin.json using the goreleaser {{ .Version }} template before archiving:

  before:
    hooks:
      - "sed -i.bak 's/\"version\": \".*\"/\"version\": \"{{ .Version }}\"/' plugin.json && rm -f plugin.json.bak"

  Uses sed -i.bak (works on both GNU sed/Linux and BSD sed/macOS).

• plugin.json: Replace the stale "version": "1.0.0" with "version": "0.0.0-dev" to clearly signal this is a source-level placeholder replaced at release time.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>plugin.json version field does not match release version</issue_title>
<issue_description>## Summary

The plugin.json included in the v0.3.0 release tarball has "version": "1.0.0" instead of "version": "0.3.0":

{
    "name": "workflow-plugin-authz",
    "version": "1.0.0",
    ...
}

This was also the case in v0.2.0 — the manifest has always said 1.0.0 regardless of the actual release tag.

Impact

• Consumers cannot programmatically verify they have the correct plugin version
• wfctl plugin list (if/when implemented) would report the wrong version
• Contradicts the Go module version (v0.3.0) and the GitHub release tag

Suggested Fix

Update plugin.json to reflect the actual version, either:

1. Manual: Update "version" in plugin.json before each release
2. Automated: Use goreleaser's templating to inject the tag version into plugin.json during the release build:

# .goreleaser.yml
before:
  hooks:
    - cmd: sed -i 's/"version": ".*"/"version": "{{ .Version }}"/' plugin.json

Option 2 ensures the manifest always matches the release tag without manual steps.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes plugin.json version field does not match release version #16

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[Copilot]

Pull request overview

Updates the packaged plugin manifest so plugin.json’s version matches the Git tag/release version, enabling accurate programmatic version verification.

Changes:

• Add a GoReleaser before.hooks command to rewrite plugin.json’s version field to {{ .Version }} prior to archiving.
• Update plugin.json to use a source-level placeholder version (0.0.0-dev) intended to be replaced during release builds.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.goreleaser.yml	Adds a pre-build hook to patch the manifest version at release time.
plugin.json	Replaces the hardcoded version with a dev placeholder to be overridden by GoReleaser.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The before.hooks command rewrites plugin.json in-place and does not restore it afterward. Running GoReleaser locally (or in CI retries) will leave the working tree dirty and, if the release fails mid-run, the repo may be left with a modified plugin.json. Consider writing the versioned manifest to a separate file (e.g., under dist/) and archiving that, or add a follow-up step to restore plugin.json from the backup once artifacts are produced (if supported by your GoReleaser version).

[intel352]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Done in 5619833. Added after.hooks to restore plugin.json from a backup taken at the start of before.hooks:

• before.hooks: first copies plugin.json to plugin.json.orig, then injects the release version
• after.hooks: moves plugin.json.orig back to plugin.json, leaving the working tree clean after a successful release