ci: adopt org-infra reusable release workflows

[sonupreetam]

Summary

Replace inline preflight and GoReleaser jobs with org-infra reusable workflow callers (reusable_release_preflight.yml + reusable_release_goreleaser.yml @ v0.7.1).

Changes

release.yml

• Preflight: Replaced ~130 lines of inline validation logic with a single reusable workflow call
• GoReleaser: Replaced ~40 lines of inline GoReleaser setup with a single reusable workflow call
• New inputs: Added skip_semver_check, skip_ci_checks, skip_unreleased_check for debugging
• CI checks: Explicitly specified via ci_checks: '["Build and Test"]'
• check-signing-secrets: New job since the reusable preflight doesn't output has_signing_secrets
• sign-macos: Stays inline (unchanged), now uses needs.preflight.outputs.tag instead of inputs.tag

.goreleaser.yaml

• Added release.extra_files to upload generated Homebrew cask as a release asset (previously done by the inline release job's gh release upload step)

Key improvements over inline implementation

Feature	Inline (before)	Reusable (after)
Re-run after partial failure	Smart but inline	Standardized smart detection from org-infra
Semver ordering	sort -V (breaks on pre-releases)	Python semver library (spec-compliant)
CI check names	Hardcoded in bash	Configurable ci_checks JSON array input
Skip controls	None	3 skip inputs for debugging
Tag creation	git tag -a + git push	GitHub API (annotated tags)

Part of unbound-force/unbound-force#428

[yvonnedevlinrh]

Review Summary

Verdict: APPROVE — CI passes, SHA pin verified, permissions correctly scoped.

Findings

MEDIUM

1. CHANGELOG Go version claim without corresponding change — The "Security" subsection states "Go bumped to 1.25.12 for crypto/tls vulnerability fix" but go.mod/go.sum are not in the changed file list for this PR. If the bump landed in a prior commit on this branch, the entry is accurate but potentially misleading about scope. Worth clarifying.

2. Token-in-URL pattern in sign-macos (pre-existing carry-over) — The Homebrew tap clone constructs a URL embedding the token via shell expansion (https://x-access-token:${HOMEBREW_TAP_GITHUB_TOKEN}@github.com/...). If the step produces verbose output (set -x, git remote -v), the token could leak to runner logs. Consider migrating to git config url.insteadOf or gh CLI token injection. Not introduced by this PR — carried over from the previous inline implementation.

LOW

• Deletion of .opencode/agents/reviewer-testing.md is not mentioned in the PR description or CHANGELOG.
• Minor header comment style inconsistency between ci.yml (# --) and release.yml (# =======).
• awk SHA-patching script in sign-macos is fragile if the cask format changes (mitigated by existing grep -q integrity check).
• Workflow-level concurrency group was removed; concurrent workflow_dispatch invocations are guarded by the reusable preflight's tag-uniqueness check but lack admission-level deduplication.

Verified

• Reusable workflow SHA 0c784711926c9864f027ec565fd7c06a382d80f8 confirmed against complytime/org-infra tag v0.7.1
• Workflow-level permissions: {} enforces least privilege; per-job permissions correctly scoped
• Three skip_* boolean inputs default to false, passed through to reusable workflow — no injection vector
• agentkit_test.go improvements convert ignored errors to t.Fatalf and strengthen overwrite assertions
• Spec-first, branching convention, and documentation gate requirements satisfied

Review generated by /uf.review-pr (AI-assisted).