github: Add release workflows

This change implements two workflows that together implement the release
process. The first workflow is manually triggered, takes a
human-specified semver version string, and creates an automated commit
that updates the version string in the required places, and then tags
the new commit. The second workflow is triggered on release semver tags,
and performs the build and creates the release.

Tested: no - these workflows are hard to test manually, and will likely
require trial+error on Github itself.

Bug: linear/CUS-332

.bazelrc

@@ -23,3 +23,7 @@ build:noninteractive --keep_going
 
 build:presubmit --config=noninteractive
 build:postsubmit --config=noninteractive
+
+build:release --config=noninteractive
+build:release --stamp
+build:release --compilation_mode opt

.github/workflows/release.yml

@@ -0,0 +1,23 @@
+name: "release"
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        type: string
+        description: Version of engflow_auth to release
+        required: true
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: release
+        run: |
+          infra/release.sh "${{ github.events.inputs.version }}"
+        env:
+          GH_TOKEN: ${{ github.token }}

BUILD

@@ -2,3 +2,12 @@ load("@gazelle//:def.bzl", "gazelle")
 # gazelle:prefix github.com/EngFlow/auth
 
 gazelle(name = "gazelle")
+
+filegroup(
+    name = "release_artifacts",
+    srcs = [
+        "//cmd/engflow_auth:engflow_auth_linux_x64",
+        "//cmd/engflow_auth:engflow_auth_macos_arm64",
+        "//cmd/engflow_auth:engflow_auth_windows_x64",
+    ],
+)

cmd/engflow_auth/BUILD

@@ -1,4 +1,5 @@
 load("@rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library", "go_test")
+load("//infra:visibility.bzl", "RELEASE_ARTIFACT")
 
 go_library(
     name = "engflow_auth_lib",
@@ -40,16 +41,19 @@ go_cross_binary(
     name = "engflow_auth_macos_arm64",
     platform = "@rules_go//go/toolchain:darwin_arm64_cgo",
     target = ":engflow_auth",
+    visibility = RELEASE_ARTIFACT,
 )
 
 go_cross_binary(
     name = "engflow_auth_windows_x64",
     platform = "@rules_go//go/toolchain:windows_amd64_cgo",
     target = ":engflow_auth",
+    visibility = RELEASE_ARTIFACT,
 )
 
 go_cross_binary(
     name = "engflow_auth_linux_x64",
     platform = "@rules_go//go/toolchain:linux_amd64_cgo",
     target = ":engflow_auth",
+    visibility = RELEASE_ARTIFACT,
 )

infra/release.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+
+set -euo pipefail
+
+readonly RELEASE_VERSION="$1"
+
+# Bump version in applicable files
+sed -i "s|version = \".+\",|version = \"${RELEASE_VERSION}\",|" MODULE.bazel
+
+# Commit and push, adding a tag
+git commit \
+    -a \
+    -m "release: Bump version to v${RELEASE_VERSION}"
+git tag \
+    -a \
+    "v${RELEASE_VERSION}" \
+    -m "Release v${RELEASE_VERSION}"
+git push \
+    --follow-tags
+
+# Build release artifacts
+bazel build \
+    --config=release \
+    -- \
+    //:release_artifacts
+
+# Create release
+gh release create \
+    "v${RELEASE_VERSION}" \
+    --generate-notes \
+    "bazel-out/k8-opt-ST-*/bin/cmd/engflow_auth/engflow_auth_linux_x64#engflow_auth (Linux, x64)" \
+    "bazel-out/k8-opt-ST-*/bin/cmd/engflow_auth/engflow_auth_macos_arm64#engflow_auth (macOS, arm64)" \
+    "bazel-out/k8-opt-ST-*/bin/cmd/engflow_auth/engflow_auth_windows_x64#engflow_auth (Windows, x64)"

infra/visibility.bzl

@@ -0,0 +1,5 @@
+"""Contains visibility constants to reduce duplication, increase BUILD file readability"""
+
+# Visibility used for artifacts that get released, which are defined by
+# filegroup(s) in the top-level BUILD file.
+RELEASE_ARTIFACT = ["//:__pkg__"]