address second review pass on v2 CI scaffolding

- check-release-mode.sh: split the cleanup checkout so a missing go.work.sum can no longer abort the whole revert and leave modules/*/go.mod dirty (git checkout treats multi-pathspec atomically).
- v2-release.yml: validate the version input looks like v2.x before pushing immutable tags; drop a stray whitespace line in the ORDER array.
- runbook: point step 4 at check-no-replaces.sh instead of a single-line grep that misses block-form replaces.

Author: james00012

.github/workflows/v2-release.yml

@@ -74,14 +74,18 @@ jobs:
         run: |
           set -e
 
+          if [[ ! "$VERSION" =~ ^v2\.[0-9] ]]; then
+            echo "::error::version '$VERSION' must look like v2.<minor>.<patch>[-suffix] (e.g. v2.0.0-beta.1)"
+            exit 1
+          fi
+
           # Same order as docs/v2-release-runbook.md.
           ORDER=(
             modules/core
             modules/ssh modules/httphelper modules/dnshelper
             modules/docker modules/packer modules/database modules/opa
             modules/aws modules/azure modules/gcp modules/k8s modules/helm
             modules/terraform modules/terragrunt modules/teststructure
-           
           )
 
           for path in "${ORDER[@]}"; do

docs/v2-release-runbook.md

@@ -47,8 +47,9 @@ build is validated continuously without committing the pin or needing tags.
 3. Set every internal `require` to the exact version being tagged, then DROP all
    internal `replace` directives. Do not run `go work sync` against the unpinned
    tree.
-4. CI guard: `grep -nH '^replace github.com/gruntwork-io/terratest' modules/*/go.mod`
-   must return zero before tagging.
+4. CI guard: run `bash scripts/check-no-replaces.sh`; it must pass before tagging.
+   It catches both single-line and block-form `replace ( ... )` directives, which
+   a plain `grep '^replace'` would miss.
 5. Move `test/` to its own module here too if not already done, and pin it the
    same way (it is test-only, so committed `replace`s are acceptable for it).
 

scripts/check-release-mode.sh

@@ -22,7 +22,11 @@ if ! ls modules/*/go.mod >/dev/null 2>&1; then
 fi
 
 cleanup() {
-  git checkout -- modules/ go.work.sum >/dev/null 2>&1 || true
+  # Revert each path independently. `git checkout -- a b` aborts entirely if any
+  # pathspec matches no tracked file, so a missing go.work.sum would otherwise
+  # leave the rewritten modules/*/go.mod files dirty.
+  git checkout -- modules/ >/dev/null 2>&1 || true
+  git checkout -- go.work.sum >/dev/null 2>&1 || true
   git status --porcelain 2>/dev/null | awk '/^\?\?.*modules\/.*\/go\.sum$/{print $2}' | xargs -r rm -f
   [ -n "${TMP:-}" ] && rm -rf "$TMP"
 }