feat: add config_schema and capabilities to record-release

Read config_schema.json and baton_capabilities.json from the connector
repo checkout and send them in the RecordRelease API call. These files
are generated by CI and committed to each connector repo.

Also reorder job dependencies so record-connector-registry waits for
record-lambda-registry to complete, ensuring the registry API recording
has the full picture before firing.

Author: gontzess

.github/workflows/release.yaml

@@ -908,11 +908,12 @@ jobs:
           done < "$DIGEST_FILE"
 
   record-connector-registry:
-    # require binaries to succeed; windows (msi) and docker (images/lambda) may be skipped based on inputs
+    # require binaries to succeed; windows, docker, and lambda recording may be skipped based on inputs
     # each optional job must succeed if it ran — a failure means incomplete release artifacts
+    # waits for record-lambda-registry so the registry API recording has the full picture (config_schema, capabilities)
     # see: https://docs.github.com/en/actions/using-jobs/using-conditions-to-control-job-execution
-    if: ${{ !cancelled() && needs.goreleaser-binaries.result == 'success' && (needs.goreleaser-windows.result == 'success' || needs.goreleaser-windows.result == 'skipped') && (needs.goreleaser-docker.result == 'success' || needs.goreleaser-docker.result == 'skipped') }}
-    needs: [determine-workflows-ref, goreleaser-binaries, goreleaser-windows, goreleaser-docker]
+    if: ${{ !cancelled() && needs.goreleaser-binaries.result == 'success' && (needs.goreleaser-windows.result == 'success' || needs.goreleaser-windows.result == 'skipped') && (needs.goreleaser-docker.result == 'success' || needs.goreleaser-docker.result == 'skipped') && (needs.record-lambda-registry.result == 'success' || needs.record-lambda-registry.result == 'skipped') }}
+    needs: [determine-workflows-ref, goreleaser-binaries, goreleaser-windows, goreleaser-docker, record-lambda-registry]
     permissions:
       id-token: write
       contents: read
@@ -1235,6 +1236,16 @@ jobs:
             CHANGELOG_FLAG="-changelog /tmp/changelog.md"
           fi
 
+          CONFIG_SCHEMA_FLAG=""
+          if [ -f "../_connector/config_schema.json" ]; then
+            CONFIG_SCHEMA_FLAG="-config-schema ../_connector/config_schema.json"
+          fi
+
+          CAPABILITIES_FLAG=""
+          if [ -f "../_connector/baton_capabilities.json" ]; then
+            CAPABILITIES_FLAG="-capabilities ../_connector/baton_capabilities.json"
+          fi
+
           go run ./cmd/record-release \
             -manifest _output/manifest.json \
             -org "${{ github.event.repository.owner.login }}" \
@@ -1245,7 +1256,9 @@ jobs:
             -workflow-run-id "${{ github.run_id }}" \
             -registry-url "https://dist.conductorone.com" \
             $DOCS_FLAG \
-            $CHANGELOG_FLAG
+            $CHANGELOG_FLAG \
+            $CONFIG_SCHEMA_FLAG \
+            $CAPABILITIES_FLAG
 
   record-lambda-registry:
     if: inputs.lambda == true

cmd/record-release/main.go

@@ -27,6 +27,8 @@ type RecordReleaseRequest struct {
 	WorkflowRunID  string                   `json:"workflowRunId"`
 	Documentation  string                   `json:"documentation,omitempty"`
 	Changelog      string                   `json:"changelog,omitempty"`
+	ConfigSchema   string                   `json:"configSchema,omitempty"`
+	Capabilities   json.RawMessage          `json:"capabilities,omitempty"`
 	SignatureURL   string                   `json:"signatureUrl,omitempty"`
 	CertificateURL string                   `json:"certificateUrl,omitempty"`
 	Assets         map[string]*ReleaseAsset `json:"assets,omitempty"`
@@ -76,9 +78,11 @@ func main() {
 		repositoryURL string
 		commitSha     string
 		workflowRunID string
-		registryURL   string
-		changelogPath string
-		token         string
+		registryURL      string
+		changelogPath    string
+		configSchemaPath string
+		capabilitiesPath string
+		token            string
 	)
 
 	flag.StringVar(&manifestPath, "manifest", "", "Path to merged manifest.json file (required)")
@@ -91,6 +95,8 @@ func main() {
 	flag.StringVar(&workflowRunID, "workflow-run-id", "", "GitHub Actions workflow run ID (required)")
 	flag.StringVar(&registryURL, "registry-url", "", "Registry API base URL (required)")
 	flag.StringVar(&changelogPath, "changelog", "", "Path to a file containing release notes (optional)")
+	flag.StringVar(&configSchemaPath, "config-schema", "", "Path to config_schema.json file (optional)")
+	flag.StringVar(&capabilitiesPath, "capabilities", "", "Path to baton_capabilities.json file (optional)")
 	flag.StringVar(&token, "token", "", "Bearer token (or set REGISTRY_API_TOKEN env var)")
 	flag.Parse()
 
@@ -175,7 +181,29 @@ func main() {
 		}
 	}
 
-		// Transform manifest assets: href->downloadUrl, signatureHref->signatureUrl, etc.
+	// Read optional config_schema.json (committed to connector repo by CI)
+	var configSchema string
+	if configSchemaPath != "" {
+		data, err := os.ReadFile(configSchemaPath)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "record-release: warning: could not read config-schema file: %v\n", err)
+		} else {
+			configSchema = string(data)
+		}
+	}
+
+	// Read optional baton_capabilities.json (committed to connector repo by CI)
+	var capabilities json.RawMessage
+	if capabilitiesPath != "" {
+		data, err := os.ReadFile(capabilitiesPath)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "record-release: warning: could not read capabilities file: %v\n", err)
+		} else {
+			capabilities = data
+		}
+	}
+
+	// Transform manifest assets: href->downloadUrl, signatureHref->signatureUrl, etc.
 	assets := make(map[string]*ReleaseAsset)
 	for platform, asset := range manifest.GetAssets() {
 		assets[platform] = &ReleaseAsset{
@@ -211,6 +239,8 @@ func main() {
 		WorkflowRunID:  workflowRunID,
 		Documentation:  documentation,
 		Changelog:      changelog,
+		ConfigSchema:   configSchema,
+		Capabilities:   capabilities,
 		SignatureURL:   manifest.GetSignatureHref(),
 		CertificateURL: manifest.GetCertificateHref(),
 		Assets:         assets,