From 1443208ce3295984f7cb4e822e3e0f7581e13cbf Mon Sep 17 00:00:00 2001
From: gauron99 <fridrich.david19@gmail.com>
Date: Tue, 20 Oct 2026 09:38:55 +0200
Subject: [PATCH] ci: tag the api module with every release

api/ is a separate Go module (#257), and Go finds its versions by tags
with an api/ prefix. Nothing created those tags, so other projects such
as knative/func could only pin a commit of it.

The release workflow now tags api/vX.Y.Z on the commit it released, as
its last step. It runs for every release path: the release branch cut,
the weekly patch releases and tags pushed by hand. Being last, a failed
build leaves no api tag behind.

The api module is tagged even when api/ did not change. One version
number then names both the operator and the CRD types that match it;
prometheus-operator, Flux and cluster-api tag their api modules the
same way.

The step skips commits without api/go.mod (release branches before
release-0.4) and tags that already exist, so a re-run is safe.
---
 .github/workflows/release.yml | 21 +++++++++++++++++++++
 docs/release.md               |  6 ++++++
 2 files changed, 27 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bf796019..534bd30a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -187,3 +187,24 @@ jobs:
             --generate-notes \
             --latest=${{ steps.version.outputs.is_latest }} \
             func-operator.yaml
+
+      # api/ is a separate Go module, versioned by tags with an api/ prefix.
+      # Tag it on the same commit with every release, so other projects (e.g. knative/func)
+      # can use the CRD types that match this operator version.
+      - name: Tag api module
+        run: |
+          TAG="api/v${{ steps.version.outputs.full }}"
+
+          # Release branches before release-0.4 have no api module
+          if [ ! -f api/go.mod ]; then
+            echo "No api module at this commit, skipping"
+            exit 0
+          fi
+
+          if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then
+            echo "Tag $TAG already exists, skipping"
+            exit 0
+          fi
+
+          git tag "$TAG"
+          git push origin "$TAG"
diff --git a/docs/release.md b/docs/release.md
index 890cb0f2..68409688 100644
--- a/docs/release.md
+++ b/docs/release.md
@@ -43,6 +43,12 @@ For each tag, the `release` workflow:
 
 4. **Creates a GitHub release** with auto-generated release notes and the install manifest attached
 
+5. **Tags the `api` Go module** with `api/v{VERSION}` on the same commit, so other projects (e.g. knative/func) can import the CRD types that match this release:
+   ```bash
+   go get github.com/functions-dev/func-operator/api@v{VERSION}
+   ```
+   The tag is created for every release, even when `api/` did not change. It is skipped when the commit has no api module (release branches before `release-0.4`).
+
 ## Nightly Builds
 
 The `nightly-build` workflow runs daily at 00:00 UTC and pushes images from `main` tagged as `:main`.