Improve release script reliability (ENG-1733)

cmd/mmdbinspect/records.go

@@ -60,7 +60,6 @@ func records(
 
 				var buildTime *time.Time
 				if includeBuildTime {
-					//nolint:gosec // not a security issue.
 					t := time.Unix(int64(reader.Metadata.BuildEpoch), 0).UTC()
 					buildTime = &t
 				}

dev-bin/release.sh

@@ -2,6 +2,36 @@
 
 set -eu -o pipefail
 
+# Pre-flight checks - verify all required tools are available and configured
+# before making any changes to the repository
+
+check_command() {
+    if ! command -v "$1" &>/dev/null; then
+        echo "Error: $1 is not installed or not in PATH"
+        exit 1
+    fi
+}
+
+# Verify gh CLI is authenticated
+if ! gh auth status &>/dev/null; then
+    echo "Error: gh CLI is not authenticated. Run 'gh auth login' first."
+    exit 1
+fi
+
+# Verify we can access this repository via gh
+if ! gh repo view --json name &>/dev/null; then
+    echo "Error: Cannot access repository via gh. Check your authentication and repository access."
+    exit 1
+fi
+
+# Verify git can connect to the remote (catches SSH key issues, etc.)
+if ! git ls-remote origin &>/dev/null; then
+    echo "Error: Cannot connect to git remote. Check your git credentials/SSH keys."
+    exit 1
+fi
+
+check_command go
+
 # Check that we're not on the main branch
 current_branch=$(git branch --show-current)
 if [ "$current_branch" = "main" ]; then
@@ -30,8 +60,8 @@ regex='
 '
 
 if [[ ! $changelog =~ $regex ]]; then
-      echo "Could not find date line in change log!"
-      exit 1
+    echo "Could not find date line in change log!"
+    exit 1
 fi
 
 version="${BASH_REMATCH[1]}"
@@ -55,7 +85,7 @@ echo "$version"
 echo $'\nRelease notes:'
 echo "$notes"
 
-read -e -p "Push to origin? " should_push
+read -r -e -p "Push to origin? (y/n) " should_push
 
 if [ "$should_push" != "y" ]; then
     echo "Aborting"