From 272202ab7aa5347cc1c24149838ac812233fda8e Mon Sep 17 00:00:00 2001
From: Marcin Owsiany <porridge@redhat.com>
Date: Tue, 10 Mar 2026 09:54:06 +0100
Subject: [PATCH 1/5] feat(setup-envtest): Auto-create git tags for the
 submodule

---
 .github/workflows/tag-setup-envtest.yaml | 26 ++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/tag-setup-envtest.yaml

diff --git a/.github/workflows/tag-setup-envtest.yaml b/.github/workflows/tag-setup-envtest.yaml
new file mode 100644
index 0000000000..7eaabf6bbd
--- /dev/null
+++ b/.github/workflows/tag-setup-envtest.yaml
@@ -0,0 +1,26 @@
+name: Tag setup-envtest
+
+on:
+  push:
+    tags:
+      - '*' # Triggers on all tags, but the action skips non-semver ones.
+
+jobs:
+  create-mangled-tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # Required to create a new tag via API
+      
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Create mapped tag
+        id: map-tag
+        uses: stackrox/clone-tag@v1 
+        with:
+          prefix: 'tools/setup-envtest/'
+          
+      - name: Report result
+        if: steps.map-tag.outputs.skipped == 'false'
+        run: echo "Successfully generated tag ${{ steps.map-tag.outputs.new-tag }}"

From 4c7ec2cb1018d8cb83642721edc574cc87372178 Mon Sep 17 00:00:00 2001
From: Marcin Owsiany <porridge@redhat.com>
Date: Tue, 10 Mar 2026 10:19:06 +0100
Subject: [PATCH 2/5] chore: inline the action

---
 .github/workflows/tag-setup-envtest.yaml | 47 +++++++++++++++++++-----
 1 file changed, 38 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/tag-setup-envtest.yaml b/.github/workflows/tag-setup-envtest.yaml
index 7eaabf6bbd..52efba04c2 100644
--- a/.github/workflows/tag-setup-envtest.yaml
+++ b/.github/workflows/tag-setup-envtest.yaml
@@ -3,7 +3,7 @@ name: Tag setup-envtest
 on:
   push:
     tags:
-      - '*' # Triggers on all tags, but the action skips non-semver ones.
+      - 'v*' # Code below does further filtering.
 
 jobs:
   create-mangled-tag:
@@ -15,12 +15,41 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Create mapped tag
-        id: map-tag
-        uses: stackrox/clone-tag@v1 
-        with:
-          prefix: 'tools/setup-envtest/'
+      - name: Validate and Create Tag
+        id: copy-tag
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          PREFIX="tools/setup-envtest/"
+    
+          if [[ "${{ github.ref_type }}" != "tag" ]]; then
+            echo "Current ref is not a tag. Skipping."
+            exit 0
+          fi
+          
+          ORIGINAL_TAG="${GITHUB_REF#refs/tags/}"
+          REGEX="^v?(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$"
           
-      - name: Report result
-        if: steps.map-tag.outputs.skipped == 'false'
-        run: echo "Successfully generated tag ${{ steps.map-tag.outputs.new-tag }}"
+          if [[ ! "$ORIGINAL_TAG" =~ $REGEX ]]; then
+            echo "Original tag '$ORIGINAL_TAG' does not match expression '$REGEX', skipping."
+            exit 0
+          fi
+    
+          echo "skipped=false" >> $GITHUB_OUTPUT
+          NEW_TAG="${PREFIX}${ORIGINAL_TAG}"
+    
+          echo "Original tag '$ORIGINAL_TAG' matches expression '$REGEX'."
+          echo "Creating new tag: '$NEW_TAG' at SHA: ${{ github.sha }}"
+        
+          gh api \
+            --method POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            '/repos/${{ github.repository }}/git/refs' \
+            -f ref="refs/tags/$NEW_TAG" \
+            -f sha="${{ github.sha }}"
+          echo
+          echo "Successfully created $NEW_TAG"

From bb0efac44d92003e9d5fdd071efbef7ee95688b2 Mon Sep 17 00:00:00 2001
From: Marcin Owsiany <porridge@redhat.com>
Date: Wed, 25 Mar 2026 10:16:29 +0100
Subject: [PATCH 3/5] address review comments

---
 .github/workflows/tag-setup-envtest.yaml | 36 ++-------------------
 hack/tag-setup-envtest.sh                | 41 ++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 34 deletions(-)
 create mode 100755 hack/tag-setup-envtest.sh

diff --git a/.github/workflows/tag-setup-envtest.yaml b/.github/workflows/tag-setup-envtest.yaml
index 52efba04c2..af99182e77 100644
--- a/.github/workflows/tag-setup-envtest.yaml
+++ b/.github/workflows/tag-setup-envtest.yaml
@@ -3,7 +3,7 @@ name: Tag setup-envtest
 on:
   push:
     tags:
-      - 'v*' # Code below does further filtering.
+      - 'v[0-9]+.[0-9]+.[0-9]+*'
 
 jobs:
   create-mangled-tag:
@@ -20,36 +20,4 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-
-          PREFIX="tools/setup-envtest/"
-    
-          if [[ "${{ github.ref_type }}" != "tag" ]]; then
-            echo "Current ref is not a tag. Skipping."
-            exit 0
-          fi
-          
-          ORIGINAL_TAG="${GITHUB_REF#refs/tags/}"
-          REGEX="^v?(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$"
-          
-          if [[ ! "$ORIGINAL_TAG" =~ $REGEX ]]; then
-            echo "Original tag '$ORIGINAL_TAG' does not match expression '$REGEX', skipping."
-            exit 0
-          fi
-    
-          echo "skipped=false" >> $GITHUB_OUTPUT
-          NEW_TAG="${PREFIX}${ORIGINAL_TAG}"
-    
-          echo "Original tag '$ORIGINAL_TAG' matches expression '$REGEX'."
-          echo "Creating new tag: '$NEW_TAG' at SHA: ${{ github.sha }}"
-        
-          gh api \
-            --method POST \
-            -H "Accept: application/vnd.github+json" \
-            -H "X-GitHub-Api-Version: 2022-11-28" \
-            '/repos/${{ github.repository }}/git/refs' \
-            -f ref="refs/tags/$NEW_TAG" \
-            -f sha="${{ github.sha }}"
-          echo
-          echo "Successfully created $NEW_TAG"
+        run: ./hack/tag-setup-envtest.sh
diff --git a/hack/tag-setup-envtest.sh b/hack/tag-setup-envtest.sh
new file mode 100755
index 0000000000..528e84aa54
--- /dev/null
+++ b/hack/tag-setup-envtest.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+#  Copyright 2026 The Kubernetes Authors.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+set -euo pipefail
+
+readonly PREFIX="${1:-tools/setup-envtest/}"
+readonly REF="${2:-${GITHUB_REF}}"
+readonly SHA="${3:-${GITHUB_SHA}}"
+readonly REPO="${4:-${GITHUB_REPOSITORY}}"
+
+ORIGINAL_TAG="${REF#refs/tags/}"
+NEW_TAG="${PREFIX}${ORIGINAL_TAG}"
+if git show-ref --verify --quiet "refs/tags/${NEW_TAG}"; then
+  echo "Tag ${NEW_TAG} already exists, nothing to do."
+  exit 0
+fi
+
+echo "Creating new tag: '${NEW_TAG}' at SHA: ${SHA}"
+
+gh api \
+  --method POST \
+  -H "Accept: application/vnd.github+json" \
+  -H "X-GitHub-Api-Version: 2022-11-28" \
+  "/repos/${REPO}/git/refs" \
+  -f ref="refs/tags/${NEW_TAG}" \
+  -f sha="${SHA}"
+echo
+echo "Successfully created ${NEW_TAG}"

From b5f001367aa6202055eff282c28e90f9c5595c90 Mon Sep 17 00:00:00 2001
From: Marcin Owsiany <porridge@redhat.com>
Date: Wed, 25 Mar 2026 10:20:16 +0100
Subject: [PATCH 4/5] bump actions/checkout to be consistent

---
 .github/workflows/tag-setup-envtest.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/tag-setup-envtest.yaml b/.github/workflows/tag-setup-envtest.yaml
index af99182e77..22d0e86605 100644
--- a/.github/workflows/tag-setup-envtest.yaml
+++ b/.github/workflows/tag-setup-envtest.yaml
@@ -13,7 +13,7 @@ jobs:
       
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
 
       - name: Validate and Create Tag
         id: copy-tag

From bd4c9c6cb25cc236de4f2ace29c9e78a2a898f00 Mon Sep 17 00:00:00 2001
From: Marcin Owsiany <porridge@redhat.com>
Date: Wed, 25 Mar 2026 10:23:56 +0100
Subject: [PATCH 5/5] fetch tags

---
 .github/workflows/tag-setup-envtest.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/tag-setup-envtest.yaml b/.github/workflows/tag-setup-envtest.yaml
index 22d0e86605..29643eb19f 100644
--- a/.github/workflows/tag-setup-envtest.yaml
+++ b/.github/workflows/tag-setup-envtest.yaml
@@ -14,6 +14,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+        with:
+          fetch-tags: true
 
       - name: Validate and Create Tag
         id: copy-tag