Build and release workflows with tooling

[tgraupne]

This PR contains updated to our GitHUb Actions Workflows in preparation of the release of our terraform provider.
Example executions of the release-workflow triggered by pushing a tag can be found here:

https://github.com/bitwarden/terraform-provider-bitwarden-sm/actions/runs/10579959606

We followed hashicorps documentation about the manual release preparation:
https://developer.hashicorp.com/terraform/registry/providers/publishing#manually-preparing-a-release

The following things are still open:

we need to setup a signing key in order to sign the hashes of our binaries
we need to decide if we can use large hosted runners in GitHub Actions in order to provide a native ubuntu environment to build arm64 binaries

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[github-actions]

Checkmarx One – Scan Summary & Details – e6c04e46-eff5-467a-9814-9be4002c166e

New Issues (1)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2024-45339	Go-github.com/golang/glog-v1.2.3	Vulnerable Package

[withinfocus]

BRE will really be the official reviewers here and can work on that final setup, but I saw a few things.

[tgraupne]

Hi @withinfocus, thanks a lot for your feedback. I hope I was able to address all the remarks you made. There is just open follow-up question from my side regarding the the check-run step in the release workflow.

[withinfocus]

Besides the optimization of the secrets-related steps in the workflows, I think I am good with this and BRE should get in for their review.

[michalchecinski]

Closed and re-opened the PR to fire a new workflow linter. @tgraupne, please also fix the things indicated by it: https://github.com/bitwarden/terraform-provider-bitwarden-sm/actions/runs/12908630218/job/35994555617?pr=21

[tgraupne]

Hi @michalchecinski, I tried to incorporate all of your feedback and I create a little miro board showing the implemented GitHub Actions workflows. With that, I am trying to make sure that there are nor misunderstandings in the process we'd like to implement together. I am looking forward to your feedback.

Bitwarden Release Process.pdf

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[withinfocus]

I don't want to hold anything up for merging. Can iterate if needed later and BRE really owns these flows.