Add dry run mode to release-publish workflow

Defaults to dry_run=true. In dry run mode, artifacts are downloaded
and checksums verified, but nothing is published. All publish jobs
(GitHub release, Docker, downstream notifications) are skipped.

Co-authored-by: Isaac

Author: pietern

.github/workflows/release-publish.yml

@@ -11,9 +11,19 @@ on:
         description: 'Version tag to release (e.g. v0.296.0)'
         required: true
         type: string
+      dry_run:
+        description: 'Dry run: download and verify artifacts without publishing'
+        required: false
+        type: boolean
+        default: true
+
+env:
+  DRY_RUN: ${{ inputs.dry_run && 'true' || 'false' }}
 
 jobs:
-  create-github-release:
+  # Always runs. Downloads artifacts from the build run and verifies them.
+  # In non-dry-run mode, also creates the GitHub release.
+  prepare-release:
     runs-on:
       group: databricks-deco-testing-runner-group
       labels: ubuntu-latest-deco
@@ -30,10 +40,31 @@ jobs:
           run-id: ${{ inputs.build_run_id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: List artifacts
-        run: ls -lR dist/
+      - name: Download linux binaries
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-binaries-linux
+          path: release-binaries
+          run-id: ${{ inputs.build_run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: List downloaded artifacts
+        run: |
+          echo "=== Archives ==="
+          ls -lR dist/
+          echo ""
+          echo "=== Linux binaries ==="
+          ls -lR release-binaries/
+
+      - name: Verify checksums
+        run: |
+          echo "Verifying SHA256 checksums..."
+          cd dist
+          checksums_file=$(ls *SHA256SUMS* | head -1)
+          sha256sum -c "$checksums_file"
 
       - name: Create GitHub release
+        if: env.DRY_RUN == 'false'
         run: |
           gh release create "${{ inputs.tag }}" \
             --repo "${{ github.repository }}" \
@@ -45,8 +76,21 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Dry run summary
+        if: env.DRY_RUN == 'true'
+        run: |
+          echo "::notice::Dry run complete. Artifacts downloaded and verified successfully."
+          echo "::notice::To publish, re-run this workflow with dry_run=false."
+          echo ""
+          echo "Archives that would be published:"
+          ls dist/*.zip dist/*.tar.gz dist/*SHA256SUMS*
+          echo ""
+          echo "Linux binaries that would be used for Docker images:"
+          find release-binaries -name databricks -type f
+
   docker:
-    needs: create-github-release
+    if: ${{ !inputs.dry_run }}
+    needs: prepare-release
     runs-on:
       group: databricks-deco-testing-runner-group
       labels: ubuntu-latest-deco
@@ -68,9 +112,6 @@ jobs:
           run-id: ${{ inputs.build_run_id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: List downloaded binaries
-        run: ls -lR release-binaries/
-
       - name: Login to GHCR
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
@@ -136,7 +177,8 @@ jobs:
           docker manifest push "ghcr.io/databricks/cli:latest"
 
   create-setup-cli-release-pr:
-    needs: create-github-release
+    if: ${{ !inputs.dry_run }}
+    needs: prepare-release
     runs-on:
       group: databricks-deco-testing-runner-group
       labels: ubuntu-latest-deco
@@ -164,7 +206,8 @@ jobs:
             });
 
   create-homebrew-tap-release-pr:
-    needs: create-github-release
+    if: ${{ !inputs.dry_run }}
+    needs: prepare-release
     runs-on:
       group: databricks-deco-testing-runner-group
       labels: ubuntu-latest-deco
@@ -213,7 +256,8 @@ jobs:
             });
 
   create-vscode-extension-update-pr:
-    needs: create-github-release
+    if: ${{ !inputs.dry_run }}
+    needs: prepare-release
     runs-on:
       group: databricks-deco-testing-runner-group
       labels: ubuntu-latest-deco
@@ -241,7 +285,8 @@ jobs:
             });
 
   pypi-publish:
-    needs: create-github-release
+    if: ${{ !inputs.dry_run }}
+    needs: prepare-release
     runs-on:
       group: databricks-deco-testing-runner-group
       labels: ubuntu-latest-deco
@@ -271,7 +316,8 @@ jobs:
           packages-dir: python/dist
 
   publish-to-winget-pkgs:
-    needs: create-github-release
+    if: ${{ !inputs.dry_run }}
+    needs: prepare-release
     runs-on:
       group: databricks-deco-testing-runner-group
       labels: ubuntu-latest-deco