fix: Proper release workflow

.github/workflows/helm-chart-release.yaml

@@ -2,14 +2,41 @@ name: Release Helm Charts
 
 on:
   workflow_dispatch: # Trigger manually
+  workflow_call:
+    inputs:
+      checkout-tag:
+        description: 'Whether to check out a tag'
+        required: false
+        type: boolean
+        default: false
+
+      ref-to-checkout:
+        description: 'Ref of branch/tag from which to execute workflow'
+        required: true
+        type: string
   push:
     branches:
       - main
     paths:
       - 'charts/**'
 
 jobs:
+  determine-ref:
+    runs-on: ubuntu-latest
+    outputs:
+      ref: ${{ steps.determine-ref.outputs.ref }}
+    steps:
+      - name: Determine ref to check out
+        id: determine-ref
+        run: |
+          if [[ "${{ inputs.checkout-tag }}" == "false" ]]; then
+            echo "ref=${{ github.ref }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "ref=${{ inputs.ref-to-checkout }}" >> "$GITHUB_OUTPUT"
+          fi
+
   get-helm-charts-versions-irs:
+    needs: determine-ref
     outputs:
       latest_version: ${{ steps.step1.outputs.latest_version }}
       current_version: ${{ steps.step2.outputs.current_version }}
@@ -21,6 +48,8 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          fetch-tags: 'true'
+          ref: ${{ needs.determine-ref.outputs.ref }}
 
       - name: Get helm charts latest tag version
         id: step1
@@ -36,7 +65,7 @@ jobs:
           echo "Exported $chartVersion helm charts version"
 
   release:
-    needs: "get-helm-charts-versions-irs"
+    needs: [get-helm-charts-versions-irs, determine-ref]
     if: needs.get-helm-charts-versions-irs.outputs.latest_version != needs.get-helm-charts-versions-irs.outputs.current_version
     # depending on default permission settings for your org (contents being read-only or read-write for workloads), you will have to add permissions
     # see: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
@@ -48,6 +77,8 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          fetch-tags: 'true'
+          ref: ${{ needs.determine-ref.outputs.ref }}
 
       - name: Configure Git
         run: |

.github/workflows/irs-build.yml

@@ -2,6 +2,19 @@ name: IRS build
 
 on:
   workflow_dispatch: # Trigger manually
+  workflow_call:
+    inputs:
+      checkout-tag:
+        description: 'Whether to check out a tag'
+        required: false
+        type: boolean
+        default: false
+
+      ref-to-checkout:
+        description: 'Ref of branch/tag from which to execute workflow'
+        required: true
+        type: string
+
   pull_request:
     paths-ignore:
       - '**/*.md'
@@ -19,6 +32,20 @@ on:
       - '**'
 
 jobs:
+  determine-ref:
+    runs-on: ubuntu-latest
+    outputs:
+      ref: ${{ steps.determine-ref.outputs.ref }}
+    steps:
+      - name: Determine ref to check out
+        id: determine-ref
+        run: |
+          if [[ "${{ inputs.checkout-tag }}" == "false" ]]; then
+            echo "ref=${{ github.ref }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "ref=${{ inputs.ref-to-checkout }}" >> "$GITHUB_OUTPUT"
+          fi
+
   init:
     runs-on: ubuntu-latest
     outputs:
@@ -34,9 +61,13 @@ jobs:
 
   build:
     runs-on: ubuntu-latest
+    needs: determine-ref
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          fetch-tags: 'true'
+          ref: ${{ needs.determine-ref.outputs.ref }}
 
       - name: Set up JDK 17
         uses: actions/setup-java@v4
@@ -56,7 +87,7 @@ jobs:
           mvn clean verify --batch-mode
 
   analyze_with_Sonar:
-    needs: [init]
+    needs: [init, determine-ref]
     # No need to run if we cannot use the sonar token
     if: >-
       needs.init.outputs.sonar_configured == 'true'
@@ -67,6 +98,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of sonar analysis
+          fetch-tags: 'true'
+          ref: ${{ needs.determine-ref.outputs.ref }}
 
       - name: Set up JDK 17
         uses: actions/setup-java@v4
@@ -99,7 +132,7 @@ jobs:
           -Dcheckstyle.skip -Dpmd.skip=true
 
   build_images:
-    needs: [init]
+    needs: [init, determine-ref]
     strategy:
       matrix:
         image:
@@ -109,6 +142,9 @@ jobs:
       image-tag: ${{ steps.version.outputs.image_tag }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-tags: 'true'
+          ref: ${{ needs.determine-ref.outputs.ref }}
 
       - name: Build image to make sure Dockerfile is valid
         run: |