From 5ad934b5d22234807b1c5517150516d5574121a2 Mon Sep 17 00:00:00 2001
From: Patryk Bujna <patryk.bujna@apius.pl>
Date: Mon, 20 Jul 2026 14:43:04 +0200
Subject: [PATCH] Pass splunkbase_app_id to reusable release workflow

Wires this app into the gated Splunkbase publish added in slice #6 (ADR-0006):
- Forward splunkbase_app_id: ${{ vars.SPLUNKBASE_APP_ID }} to the reusable
  release workflow. The SPLUNKBASE_APP_ID repo variable is already provisioned
  (=9192); if it were unset the reusable workflow would skip the publish.
- Keep `secrets: inherit` so SPLUNK_USER/SPLUNK_PASS reach the publish job;
  they are scoped to the `splunkbase` Environment, whose required reviewer is
  the manual approval gate.

No behaviour change to packaging, AppInspect, or the GitHub Release.
---
 .github/workflows/release.yml | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ae5bc01..554cac3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,10 +1,15 @@
 name: release
 
-# Caller for the shared release/publish workflow (ADR-0004 / ADR-0005).
+# Caller for the shared release/publish workflow (ADR-0004 / ADR-0005 / ADR-0006).
 # Triggered by pushing a vX.Y.Z tag (on the merged "Release vX.Y.Z" commit).
 # Packages the app at the tag version, runs AppInspect (base blocking, cloud
-# advisory by default), and publishes a GitHub Release. Splunkbase upload is
-# out of scope (slice #6).
+# advisory by default), publishes a GitHub Release, and then publishes to
+# Splunkbase behind the `splunkbase` Environment approval gate (slice #6).
+#
+# splunkbase_app_id comes from the SPLUNKBASE_APP_ID repo variable; when it is
+# unset the shared workflow skips the Splunkbase publish (first publish is
+# manual). SPLUNK_USER/SPLUNK_PASS reach the reusable workflow via
+# `secrets: inherit` and are scoped to the `splunkbase` Environment for publish.
 on:
   push:
     tags:
@@ -33,4 +38,8 @@ jobs:
     with:
       app_id: apius_lang_entropy
       version: ${{ needs.version.outputs.version }}
+      # Splunkbase listing id (repo variable). Empty -> Splunkbase publish is
+      # skipped by the reusable workflow; the manual approval gate lives in the
+      # `splunkbase` Environment.
+      splunkbase_app_id: ${{ vars.SPLUNKBASE_APP_ID }}
     secrets: inherit