ci: gate releases on the acceptance suite via a reusable workflow

.github/workflows/acceptance.yml

@@ -0,0 +1,61 @@
+name: Acceptance Tests
+
+# Reusable workflow: runs the acceptance suite (sliced) + telemetry acceptance
+# tests. Called by test-acceptance.yml on pull requests and by release.yml as a
+# gate before publishing. Callers pass secrets via `secrets: inherit`.
+on:
+  workflow_call:
+
+jobs:
+  acceptance:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - slice: "0"
+            api_key_secret: HOOKDECK_CLI_TESTING_API_KEY
+            tags: "basic connection source mcp listen project_use connection_list connection_upsert connection_error_hints connection_oauth_aws connection_update"
+          - slice: "1"
+            api_key_secret: HOOKDECK_CLI_TESTING_API_KEY_2
+            tags: "request event"
+          - slice: "2"
+            api_key_secret: HOOKDECK_CLI_TESTING_API_KEY_3
+            tags: "attempt metrics issue transformation destination gateway"
+    runs-on: ubuntu-latest
+    env:
+      ACCEPTANCE_SLICE: ${{ matrix.slice }}
+      HOOKDECK_CLI_TESTING_API_KEY: ${{ secrets[matrix.api_key_secret] }}
+      HOOKDECK_CLI_TELEMETRY_DISABLED: "1"
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: "1.24.9"
+
+      - name: Run Go Acceptance Tests (slice ${{ matrix.slice }})
+        run: go test -tags="${{ matrix.tags }}" ./test/acceptance/... -v -timeout 12m
+
+  # Telemetry proxy tests require the real telemetry header; matrix jobs set
+  # HOOKDECK_CLI_TELEMETRY_DISABLED=1. This job runs -tags=telemetry with
+  # HOOKDECK_CLI_TELEMETRY_DISABLED=0 so telemetry is on even if the repo sets a global opt-out.
+  acceptance-telemetry:
+    runs-on: ubuntu-latest
+    env:
+      ACCEPTANCE_SLICE: "0"
+      HOOKDECK_CLI_TESTING_API_KEY: ${{ secrets.HOOKDECK_CLI_TESTING_API_KEY }}
+      # Explicitly allow telemetry: repo/org env may set HOOKDECK_CLI_TELEMETRY_DISABLED=1 globally.
+      HOOKDECK_CLI_TELEMETRY_DISABLED: "0"
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: "1.24.9"
+
+      - name: Run telemetry acceptance tests
+        run: go test -tags=telemetry ./test/acceptance/... -v -timeout 12m

.github/workflows/release.yml

@@ -6,7 +6,15 @@ on:
       - "v*"
 
 jobs:
+  # Gate: the release only proceeds if the acceptance suite passes on the tagged
+  # commit. On a transient failure, use "Re-run failed jobs" — builds and the npm
+  # publish only run once acceptance is green, so no re-tag is needed.
+  acceptance:
+    uses: ./.github/workflows/acceptance.yml
+    secrets: inherit
+
   build-mac:
+    needs: [acceptance]
     runs-on: macos-latest
     steps:
       - name: Code checkout
@@ -26,6 +34,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN }}
 
   build-linux:
+    needs: [acceptance]
     runs-on: ubuntu-latest
     env:
       # https://goreleaser.com/customization/docker_manifest/
@@ -57,6 +66,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN }}
 
   build-windows:
+    needs: [acceptance]
     runs-on: windows-latest
     steps:
       - name: Code checkout

.github/workflows/test-acceptance.yml

@@ -8,54 +8,5 @@ on:
 
 jobs:
   acceptance:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - slice: "0"
-            api_key_secret: HOOKDECK_CLI_TESTING_API_KEY
-            tags: "basic connection source mcp listen project_use connection_list connection_upsert connection_error_hints connection_oauth_aws connection_update"
-          - slice: "1"
-            api_key_secret: HOOKDECK_CLI_TESTING_API_KEY_2
-            tags: "request event"
-          - slice: "2"
-            api_key_secret: HOOKDECK_CLI_TESTING_API_KEY_3
-            tags: "attempt metrics issue transformation destination gateway"
-    runs-on: ubuntu-latest
-    env:
-      ACCEPTANCE_SLICE: ${{ matrix.slice }}
-      HOOKDECK_CLI_TESTING_API_KEY: ${{ secrets[matrix.api_key_secret] }}
-      HOOKDECK_CLI_TELEMETRY_DISABLED: "1"
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v3
-
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: "1.24.9"
-
-      - name: Run Go Acceptance Tests (slice ${{ matrix.slice }})
-        run: go test -tags="${{ matrix.tags }}" ./test/acceptance/... -v -timeout 12m
-
-  # Telemetry proxy tests require the real telemetry header; matrix jobs set
-  # HOOKDECK_CLI_TELEMETRY_DISABLED=1. This job runs -tags=telemetry with
-  # HOOKDECK_CLI_TELEMETRY_DISABLED=0 so telemetry is on even if the repo sets a global opt-out.
-  acceptance-telemetry:
-    runs-on: ubuntu-latest
-    env:
-      ACCEPTANCE_SLICE: "0"
-      HOOKDECK_CLI_TESTING_API_KEY: ${{ secrets.HOOKDECK_CLI_TESTING_API_KEY }}
-      # Explicitly allow telemetry: repo/org env may set HOOKDECK_CLI_TELEMETRY_DISABLED=1 globally.
-      HOOKDECK_CLI_TELEMETRY_DISABLED: "0"
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v3
-
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: "1.24.9"
-
-      - name: Run telemetry acceptance tests
-        run: go test -tags=telemetry ./test/acceptance/... -v -timeout 12m
+    uses: ./.github/workflows/acceptance.yml
+    secrets: inherit