[1.0.x → main] Prepare branch for the pinned-commit release builder (#5273)

[thunder-automation-bot]

Automated forward-port of #5273 from 1.0.x to main.

Original PR: #5273
Commits cherry-picked: 1
Source branch: 1.0.x
Target branch: main

---

Purpose

The release builder is being reworked so a release can be built and verified from any branch (#4981). It pins the source branch to a single immutable commit and checks that same commit out in every job, which means the files it reads at release time come from the branch being released rather than from the branch the workflow was dispatched from.

The files in this PR are read that way, so they have to be correct here before a release can be cut from this branch. This PR brings them in ahead of the workflow change on main.

The integration test action also fixes a live bug on this branch. It checks out a ref of its own, which replaces $GITHUB_WORKSPACE in the middle of the job and discards whatever the caller had checked out. On this branch the release builder checks out RELEASE_BRANCH and the action then reverts the workspace to the dispatched ref, so the integration suite can run against different sources than the ones the distribution under test was built from.

Approach

Removed the actions/checkout step from .github/actions/run-integration-tests. Composite actions resolve out of $GITHUB_WORKSPACE, so a checkout inside one can silently swap the tree the rest of the job runs against. All three callers on this branch (pr-builder.yml, postgres-tests.yml and release-builder.yml) already check out the sources themselves before invoking the action, so nothing changes on the calling side.

Added a guard so the action skips its artifact download when the caller has already staged a distribution in target/dist.

Added .github/docker/Dockerfile.release, which assembles the container image by unzipping the already published Linux archives instead of recompiling the product inside docker buildx. Extraction happens on $BUILDPLATFORM to avoid QEMU emulation, and the two deployment.yaml edits are applied to the packaged file rather than to the source tree.

The root Dockerfile is functionally unchanged and still builds from source for make docker-build*. It gains a comment naming the release Dockerfile, because the two share a runtime stage that has to be kept in sync.

Related Issues

• Review and rework the release builder pipeline #4981

Related PRs

• N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
  • Ran Vale and fixed all errors and warnings
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[github-actions]

👋 @Osara-B @rajithacharith please review this forward-port of #5273 to main.

⚠️ Merge conflicts detected during cherry-pick.
The branch was pushed with unresolved conflict markers committed.
Please resolve the conflicts on this branch and mark the PR ready for review before merging.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}