github: Add release workflows

This change implements two workflows that together implement the release
process. The first workflow is manually triggered, takes a
human-specified semver version string, and creates an automated commit
that updates the version string in the required places, and then tags
the new commit. The second workflow is triggered on release semver tags,
and performs the build and creates the release.

Tested: no - these workflows are hard to test manually, and will likely
require trial+error on Github itself.

Bug: linear/CUS-332

.bazelrc

@@ -25,3 +25,7 @@ build:noninteractive --keep_going
 
 build:presubmit --config=noninteractive
 build:postsubmit --config=noninteractive
+
+build:release --config=noninteractive
+build:release --stamp
+build:release --compilation_mode opt

.github/workflows/release.yml

@@ -0,0 +1,36 @@
+name: "release"
+
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  build-all:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: run all tests
+        run: |
+          bazel test --config=postsubmit //...
+      - name: build release artifacts
+        run: |
+          bazel build \
+            --config=release \
+            -- \
+            //:release_artifacts
+      - name: create release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          make_latest: true
+          # Due to how bazel transitions work, artifacts are shotgunned across
+          # multiple bazel-out subdirectories; these globs should grab binaries
+          # but hopefully not match any duplicates in runfiles trees.
+          files: |
+            bazel-out/k8-opt-ST-*/cmd/engflow_auth/engflow_auth_linux_x64
+            bazel-out/k8-opt-ST-*/cmd/engflow_auth/engflow_auth_macos_arm64
+            bazel-out/k8-opt-ST-*/cmd/engflow_auth/engflow_auth_windows_x64
+          # Since the above matching can be fragile, fail aggressively if the
+          # file globbing above isn't accurate.
+          fail_on_unmatched_files: true

.github/workflows/start_release.yml

@@ -0,0 +1,27 @@
+name: "start_release"
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        type: string
+        description: Version of engflow_auth to release
+        required: true
+
+jobs:
+  release-prep:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: update MODULE.bazel version
+        run: |
+          sed -i 's|version = ".+",|version = "${{ github.event.inputs.version }}",|' MODULE.bazel
+      # TODO(CUS-332): This won't trigger the `release` workflow until we pass a
+      # github PAT (hopefully associated with a bot user):
+      # https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file#commits-made-by-this-action-do-not-trigger-new-workflow-runs
+      - name: commit and tag
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: "release: Bump version string to ${{ github.event.inputs.version }}"
+          branch: main
+          tagging_message: v${{ github.event.inputs.version }}

BUILD

@@ -2,3 +2,12 @@ load("@gazelle//:def.bzl", "gazelle")
 # gazelle:prefix github.com/EngFlow/auth
 
 gazelle(name = "gazelle")
+
+filegroup(
+    name = "release_artifacts",
+    srcs = [
+        "//cmd/engflow_auth:engflow_auth_linux_x64",
+        "//cmd/engflow_auth:engflow_auth_macos_arm64",
+        "//cmd/engflow_auth:engflow_auth_windows_x64",
+    ],
+)

cmd/engflow_auth/BUILD

@@ -1,4 +1,5 @@
 load("@rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library", "go_test")
+load("//infra:visibility.bzl", "RELEASE_ARTIFACT")
 
 go_library(
     name = "engflow_auth_lib",
@@ -40,16 +41,19 @@ go_cross_binary(
     name = "engflow_auth_macos_arm64",
     platform = "@rules_go//go/toolchain:darwin_arm64_cgo",
     target = ":engflow_auth",
+    visibility = RELEASE_ARTIFACT,
 )
 
 go_cross_binary(
     name = "engflow_auth_windows_x64",
     platform = "@rules_go//go/toolchain:windows_amd64_cgo",
     target = ":engflow_auth",
+    visibility = RELEASE_ARTIFACT,
 )
 
 go_cross_binary(
     name = "engflow_auth_linux_x64",
     platform = "@rules_go//go/toolchain:linux_amd64_cgo",
     target = ":engflow_auth",
+    visibility = RELEASE_ARTIFACT,
 )

infra/visibility.bzl

@@ -0,0 +1,5 @@
+"""Contains visibility constants to reduce duplication, increase BUILD file readability"""
+
+# Visibility used for artifacts that get released, which are defined by
+# filegroup(s) in the top-level BUILD file.
+RELEASE_ARTIFACT = ["//:__pkg__"]