Release daily when Go code or dependencies change

Fixes merged right after the Friday run waited a week for a release,
and Renovate held CVE fixes for 3 days unless Dependabot flagged them.
Release daily instead, but only when the binaries change, and let
Renovate check OSV so CVE fixes skip the release-age wait.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: carole-lavillonniere

.github/workflows/build.yml

@@ -6,7 +6,7 @@ on:
     tags: v*.*
   pull_request:
     branches: [ localstack ]
-  # Callable by weekly-release.yml; publishes a release when `version` is set.
+  # Callable by daily-release.yml; publishes a release when `version` is set.
   workflow_call:
     inputs:
       version:

.github/workflows/weekly-release.yml .github/workflows/daily-release.yml.github/workflows/weekly-release.yml renamed to .github/workflows/daily-release.yml

@@ -1,11 +1,11 @@
-# Weekly auto-release: patch-bumps and publishes if there are new commits on localstack.
-name: Weekly Release
+# Daily auto-release: patch-bumps and publishes if Go code or dependencies changed on localstack.
+name: Daily Release
 
 on:
   schedule:
-    # Fridays 06:00 UTC. The release is a pre-release until localstack-pro validates and promotes it,
+    # Daily 06:00 UTC, ahead of localstack-pro's 07:00 bump run. The release is a pre-release until localstack-pro validates and promotes it,
     # which is what gates the downstream lambda-images bump.
-    - cron: '0 6 * * 5'
+    - cron: '0 6 * * *'
   workflow_dispatch:
     inputs:
       dryRun:
@@ -43,14 +43,15 @@ jobs:
           if [ -z "$latest" ]; then
             echo "::error::No published vX.Y.Z release found to bump from." && exit 1
           fi
-          count=$(git rev-list "${latest}..HEAD" --count)
+          # Only changes that end up in the binaries; CI or docs commits alone do not cut a release.
+          count=$(git rev-list "${latest}..HEAD" --count -- go.mod go.sum '*.go' Makefile)
           ver=${latest#v}
           IFS=. read -r major minor patch <<< "$ver"
           next="v${major}.${minor}.$((patch + 1))"
           should_release=true
           if [ "$count" = "0" ]; then
             should_release=false
-            echo "No new commits since $latest; nothing to release."
+            echo "No Go code or dependency changes since $latest; nothing to release."
           fi
           if [ "${{ inputs.dryRun }}" = "true" ]; then
             should_release=false
@@ -60,7 +61,7 @@ jobs:
             echo "next=$next"
             echo "should_release=$should_release"
           } >> "$GITHUB_OUTPUT"
-          echo "Latest release: $latest | new commits since: $count | next: $next | release: $should_release"
+          echo "Latest release: $latest | relevant commits since: $count | next: $next | release: $should_release"
 
   release:
     needs: version
@@ -75,7 +76,7 @@ jobs:
       prerelease: true
 
   notify:
-    name: Report a broken weekly release
+    name: Report a broken daily release
     if: always() && (needs.version.result == 'failure' || needs.release.result == 'failure')
     runs-on: ubuntu-latest
     needs:
@@ -95,7 +96,7 @@ jobs:
       - name: "Send Message"
         uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         env:
-          MESSAGE: '_*Weekly RIE release failed*_ :turtle-headache::broken_heart:\n\nNo new pre-release was published, so CVE remediation is stalled until this is fixed. Investigate the failed workflow run <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|here> :mag_right:'
+          MESSAGE: '_*Daily RIE release failed*_ :turtle-headache::broken_heart:\n\nNo new pre-release was published, so CVE remediation is stalled until this is fixed. Investigate the failed workflow run <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|here> :mag_right:'
         with:
           webhook: ${{ secrets.COSY_WEBHOOK_URL }}
           webhook-type: incoming-webhook

README-LOCALSTACK.md

@@ -45,31 +45,32 @@ Releases are cut from the `localstack` branch (not `main`/`develop`, which mirro
 The resulting binaries are consumed by localstack-pro via `LAMBDA_INIT_RELEASE_VERSION=<tag>` and
 by lambda-images.
 
-### Weekly auto-release
+### Daily auto-release
 
-[`weekly-release.yml`](./.github/workflows/weekly-release.yml) runs every Friday at 06:00 UTC. If
-`localstack` has new commits since the highest existing release, it patch-bumps the version and calls
+[`daily-release.yml`](./.github/workflows/daily-release.yml) runs every day at 06:00 UTC. If
+`localstack` has new commits touching `go.mod`, `go.sum`, `*.go` or the `Makefile` since the highest
+existing release, it patch-bumps the version and calls
 `build.yml` to run the tests, build the binaries, push the tag, and publish the release. Together with
 Renovate automerge, this is what carries dependency and CVE fixes downstream without manual work.
 
 The release is published as a **pre-release**, and only reaches consumers once it has been validated:
 
-1. `weekly-release.yml` publishes `vX.Y.Z`, marked as a pre-release.
+1. `daily-release.yml` publishes `vX.Y.Z`, marked as a pre-release.
 2. localstack-pro opens a PR bumping `LAMBDA_RUNTIME_DEFAULT_VERSION` to that version; its CI is the
    quality gate.
 3. On merge, localstack-pro flips the same release to a full release through the GitHub API — no new
    tag and no rebuild, so the binaries that were validated are the binaries that ship.
 4. lambda-images ignores pre-releases, so Renovate only opens a bump PR there after the promotion.
 
-Run it manually via the **Weekly Release** workflow (`workflow_dispatch`); `dryRun` reports the next
+Run it manually via the **Daily Release** workflow (`workflow_dispatch`); `dryRun` reports the next
 version without releasing. A failed run posts to Slack.
 
 ### Manual release
 
-Most releases come from the weekly auto-release above. Cut one by hand only when you need:
+Most releases come from the daily auto-release above. Cut one by hand only when you need:
 
-- a **minor or major** version bump (the weekly release only bumps the patch version), or
-- an **urgent fix** that can't wait for the next Friday run.
+- a **minor or major** version bump (the daily release only bumps the patch version), or
+- an **urgent fix** that can't wait for the next daily run.
 
 Pushing a version tag on `localstack` triggers [`build.yml`](./.github/workflows/build.yml), which
 runs the tests, builds the binaries (`make compile-lambda-linux-all`), and publishes a GitHub release
@@ -86,13 +87,13 @@ with auto-generated release notes and the `bin/*` binaries attached.
    ```
 
 > ⚠️ A manual release is published as a **full release** right away. It skips the localstack-pro
-> validation that gates weekly releases, so lambda-images picks it up immediately. To keep the gate,
+> validation that gates daily releases, so lambda-images picks it up immediately. To keep the gate,
 > mark it as a pre-release once it's published and let localstack-pro promote it:
 > ```bash
 > gh release edit v0.4.0 --prerelease
 > ```
 
-The next weekly run patch-bumps from the highest `vX.Y.Z` release, so after `v0.4.0` it releases
+The next daily run patch-bumps from the highest `vX.Y.Z` release, so after `v0.4.0` it releases
 `v0.4.1`.
 
 > The `.github/workflows/release.yml` ("Release") workflow is **legacy** and is not used for

renovate.json

@@ -8,6 +8,7 @@
   "automergeStrategy": "squash",
   "minimumReleaseAge": "3 days",
   "internalChecksFilter": "strict",
+  "osvVulnerabilityAlerts": true,
   "packageRules": [
     {
       "matchManagers": ["gomod"],