Switch to GR's tagging workflow

.github/workflows/dotnet.yaml

@@ -111,19 +111,6 @@ jobs:
         # Verify that there is exactly one ApiSurface.*.nupkg in the artifact that would be NuGet published
         run: if [[ $(find . -maxdepth 1 -name 'ApiSurface.*.nupkg' -printf c | wc -c) -ne "1" ]]; then exit 1; fi
 
-  github-tag-and-release-dry-run:
-    runs-on: ubuntu-latest
-    needs: [expected-pack]
-    steps:
-      - uses: actions/checkout@v4
-      - name: Download NuGet artifact
-        uses: actions/download-artifact@v4
-      - name: Tag and release packages
-        env:
-          GITHUB_TOKEN: "mock-token"
-          DRY_RUN: "1"
-        run: bash .github/workflows/tag.sh
-
   all-required-checks-complete:
     needs: [check-format, build, expected-pack, analyze-code, github-tag-and-release-dry-run]
     if: ${{ always() }}
@@ -162,24 +149,59 @@ jobs:
           nuget-key: ${{ secrets.NUGET_API_KEY }}
           nupkg-dir: downloaded
 
+  github-tag-and-release-dry-run:
+    runs-on: ubuntu-latest
+    needs: [expected-pack]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Download NuGet artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: nuget-package
+      - name: Compute package path
+        id: compute-path
+        run: |
+          find . -maxdepth 1 -type f -name 'ApiSurface.*.nupkg' -exec sh -c 'echo "output=$(basename "$1")" >> $GITHUB_OUTPUT' shell {} \;
+      - name: Compute tag name
+        id: compute-tag
+        env:
+          NUPKG_PATH: ${{ steps.compute-path.outputs.output }}
+        run: echo "output=$(basename "$NUPKG_PATH" .nupkg)" >> $GITHUB_OUTPUT
+      - name: Tag and release
+        uses: G-Research/common-actions/github-release@19d7281a0f9f83e13c78f99a610dbc80fc59ba3b
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          target-commitish: ${{ github.sha }}
+          tag: ${{ steps.compute-tag.outputs.output }}
+          binary-contents: ${{ steps.compute-path.outputs.output }}
+          dry-run: true
+
   github-tag-and-release:
     runs-on: ubuntu-latest
     if: ${{ !github.event.repository.fork && github.ref == 'refs/heads/main' }}
     needs: [all-required-checks-complete]
     environment: release
+    permissions:
+      contents: write
     steps:
-      - name: Generate app token
-        id: app-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
       - uses: actions/checkout@v4
-        with:
-          token: ${{ steps.app-token.outputs.token }}
       - name: Download NuGet artifact
         uses: actions/download-artifact@v4
-      - name: Tag and release packages
+        with:
+          name: nuget-package
+      - name: Compute package path
+        id: compute-path
+        run: |
+          find . -maxdepth 1 -type f -name 'ApiSurface.*.nupkg' -exec sh -c 'echo "output=$(basename "$1")" >> $GITHUB_OUTPUT' shell {} \;
+      - name: Compute tag name
+        id: compute-tag
         env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: bash .github/workflows/tag.sh
+          NUPKG_PATH: ${{ steps.compute-path.outputs.output }}
+        run: echo "output=$(basename "$NUPKG_PATH" .nupkg)" >> $GITHUB_OUTPUT
+      - name: Tag and release
+        uses: G-Research/common-actions/github-release@19d7281a0f9f83e13c78f99a610dbc80fc59ba3b
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          target-commitish: ${{ github.sha }}
+          tag: ${{ steps.compute-tag.outputs.output }}
+          binary-contents: ${{ steps.compute-path.outputs.output }}