Bump releaseo to v0.0.3 and preserve original release actor through workflow chain (#3560)

* Preserve original release actor through workflow chain

Add steps to preserve the GitHub actor who triggered the
release workflow, passing it through to downstream workflows like
docs-website updates.

Changes:
- create-release-tag.yml: Extract Release-Triggered-By git trailer
  from commit and embed in release body as HTML comment
- releaser.yml: Add extract-release-actor job to parse release body
  and pass actor to update-docs-website and Slack notifications

* Bump releaseo to v0.0.3

---------

Signed-off-by: Dan Barr <6922515+danbarr@users.noreply.github.com>
Co-authored-by: Dan Barr <6922515+danbarr@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: danbarr

.github/workflows/create-release-pr.yml

@@ -42,7 +42,7 @@ jobs:
 
       - name: Create Release PR
         id: release
-        uses: stacklok/releaseo@add86e3cc417a4442ecef272dc79b46c2eb63246 # v0.0.2
+        uses: stacklok/releaseo@b7022753f832cac36a9e07769a679a7c1ca72fe2 # v0.0.3
         with:
           releaseo_version: v0.0.1
           bump_type: ${{ inputs.bump_type }}

.github/workflows/create-release-tag.yml

@@ -96,6 +96,21 @@ jobs:
             exit 1
           fi
 
+      - name: Extract release triggering actor
+        id: actor
+        run: |
+          # Extract the Release-Triggered-By trailer from the commit
+          # This trailer is added by releaseo to preserve the original workflow triggerer
+          TRIGGERED_BY=$(git log -1 --format='%(trailers:key=Release-Triggered-By,valueonly)' | tr -d '[:space:]')
+
+          if [ -n "$TRIGGERED_BY" ]; then
+            echo "✅ Found release triggering actor: $TRIGGERED_BY"
+            echo "triggered_by=$TRIGGERED_BY" >> $GITHUB_OUTPUT
+          else
+            echo "⚠️ No Release-Triggered-By trailer found in commit"
+            echo "triggered_by=" >> $GITHUB_OUTPUT
+          fi
+
       - name: Check if tag exists
         id: check-tag
         run: |
@@ -112,6 +127,8 @@ jobs:
         if: steps.check-tag.outputs.exists == 'false'
         run: |
           TAG="v${{ steps.version.outputs.version }}"
+          TRIGGERED_BY="${{ steps.actor.outputs.triggered_by }}"
+
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git tag -a "$TAG" -m "Release $TAG"
@@ -120,9 +137,17 @@ jobs:
 
           # Create GitHub Release (triggers releaser.yml via release event)
           # Note: Must use PAT (GH_TOKEN) because GITHUB_TOKEN cannot trigger other workflows
-          gh release create "$TAG" \
-            --title "Release $TAG" \
-            --generate-notes
+          # Include actor metadata as HTML comment if available (parsed by releaser.yml)
+          if [ -n "$TRIGGERED_BY" ]; then
+            gh release create "$TAG" \
+              --title "Release $TAG" \
+              --generate-notes \
+              --notes "<!-- Release-Triggered-By: $TRIGGERED_BY -->"
+          else
+            gh release create "$TAG" \
+              --title "Release $TAG" \
+              --generate-notes
+          fi
           echo "Created GitHub Release: $TAG"
         env:
           GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}

.github/workflows/releaser.yml

@@ -187,14 +187,41 @@ jobs:
       id-token: write
     uses: ./.github/workflows/helm-publish.yml
 
+  extract-release-actor:
+    name: Extract Release Actor
+    runs-on: ubuntu-slim
+    outputs:
+      triggered_by: ${{ steps.extract.outputs.triggered_by }}
+    permissions:
+      contents: read
+    steps:
+      - name: Extract actor from release body
+        id: extract
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Fetch the release body and extract the Release-Triggered-By metadata
+          RELEASE_BODY=$(gh release view "${{ github.ref_name }}" --repo "${{ github.repository }}" --json body --jq '.body')
+
+          # Extract username from HTML comment: <!-- Release-Triggered-By: username -->
+          TRIGGERED_BY=$(echo "$RELEASE_BODY" | grep -oP '(?<=<!-- Release-Triggered-By: )[^[:space:]]+(?= -->)' || true)
+
+          if [ -n "$TRIGGERED_BY" ]; then
+            echo "Found release triggering actor: $TRIGGERED_BY"
+            echo "triggered_by=$TRIGGERED_BY" >> $GITHUB_OUTPUT
+          else
+            echo "No Release-Triggered-By metadata found, falling back to github.actor"
+            echo "triggered_by=${{ github.actor }}" >> $GITHUB_OUTPUT
+          fi
+
   update-docs-website:
     name: Trigger Docs Update
-    needs: [ publish-helm ]
+    needs: [ publish-helm, extract-release-actor ]
     permissions: {}
     uses: ./.github/workflows/update-docs-website.yml
     with:
       version: ${{ github.ref_name }}
-      assign_to: ${{ github.actor }}
+      assign_to: ${{ needs.extract-release-actor.outputs.triggered_by }}
     secrets:
       DOCS_REPO_DISPATCH_TOKEN: ${{ secrets.DOCS_REPO_DISPATCH_TOKEN }}
 
@@ -259,6 +286,7 @@ jobs:
       - image-build-and-push
       - update-docs-website
       - publish-helm
+      - extract-release-actor
     if: ${{ failure() }}
     runs-on: ubuntu-slim
     permissions: {}
@@ -288,7 +316,7 @@ jobs:
                     },
                     {
                       "type": "mrkdwn",
-                      "text": "*Triggered by:*\n${{ github.actor }}"
+                      "text": "*Triggered by:*\n${{ needs.extract-release-actor.outputs.triggered_by || github.actor }}"
                     }
                   ]
                 },