feat: add release workflow (#18)

.github/workflows/release.yml

@@ -0,0 +1,71 @@
+name: 'release'
+on:
+  push:
+    tags:
+      - 'v*'
+
+env:
+  # .goreleaser.docker.yaml reads CONTAINER_REGISTRY
+  CONTAINER_REGISTRY: 'us-docker.pkg.dev/abcxyz-artifacts/docker-images'
+  WIF_PROVIDER: 'projects/126237785368/locations/global/workloadIdentityPools/github-automation/providers/jvs-plugin-github-p'
+  WIF_SERVICE_ACCOUNT: 'github-automation-bot@gha-jvs-plugin-github-p-43c8b5.iam.gserviceaccount.com'
+
+# Don't cancel in progress since we don't want to have half-baked release.
+concurrency: '${{ github.workflow }}-${{ github.head_ref || github.ref }}-release'
+
+jobs:
+  ci:
+    uses: 'abcxyz/jvs-plugin-github/.github/workflows/ci.yml@main' # ratchet:exclude
+
+  image-release:
+    # Run CI before the release
+    needs: ['ci']
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+    steps:
+      - uses: 'docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18' # ratchet:docker/setup-qemu-action@v2
+      - uses: 'actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8' # ratchet:actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - uses: 'actions/setup-go@c4a742cab115ed795e34d4513e2cf7d472deb55f' # ratchet:actions/setup-go@v3
+        with:
+          go-version: '1.21'
+      - id: 'auth'
+        name: 'Authenticate to Google Cloud'
+        uses: 'google-github-actions/auth@c4799db9111fba4461e9f9da8732e5057b394f72' # ratchet:google-github-actions/auth@v0
+        with:
+          workload_identity_provider: '${{ env.WIF_PROVIDER }}'
+          service_account: '${{ env.WIF_SERVICE_ACCOUNT }}'
+          token_format: 'access_token'
+      - name: 'Authenticate to Artifact Registry'
+        uses: 'docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a' # ratchet:docker/login-action@v2
+        with:
+          username: 'oauth2accesstoken'
+          password: '${{ steps.auth.outputs.access_token }}'
+          registry: 'us-docker.pkg.dev'
+      - uses: 'goreleaser/goreleaser-action@b508e2e3ef3b19d4e4146d4f8fb3ba9db644a757' # ratchet:goreleaser/goreleaser-action@v3
+        with:
+          version: 'v1.16.1' # Manually pinned
+          args: 'release -f .goreleaser.docker.yaml --clean'
+
+  github-release:
+    needs: ['image-release']
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      packages: 'write'
+    steps:
+      - uses: 'actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8' # ratchet:actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - uses: 'actions/setup-go@c4a742cab115ed795e34d4513e2cf7d472deb55f' # ratchet:actions/setup-go@v3
+        with:
+          go-version: '1.21'
+      - uses: 'goreleaser/goreleaser-action@b508e2e3ef3b19d4e4146d4f8fb3ba9db644a757' # ratchet:goreleaser/goreleaser-action@v3
+        with:
+          version: 'v1.16.1' # Manually pinned
+          args: 'release --clean'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'