Add release and publish GHA workflows

These are copied from the govuk-cli repo, so have already been tested

Author: samsimpson1

.github/workflows/publish.yaml

@@ -0,0 +1,28 @@
+name: Publish Versioned Release
+on:
+  workflow_dispatch:
+  workflow_call:
+    secrets:
+      GOVUK_CI_GITHUB_API_TOKEN:
+        required: true
+        description: "GitHub token with permissions to publish to the Homebrew tap"
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: main
+          fetch-depth: 0
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+      - uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7.2.1
+        with:
+          version: "2.15.4"
+          args: release --clean
+        env:
+          GITHUB_PAT_HOMEBREW: ${{ secrets.GOVUK_CI_GITHUB_API_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yaml

@@ -0,0 +1,36 @@
+name: Create Versioned Release
+on:
+  workflow_dispatch:
+    inputs:
+      level:
+        description: 'The semver level of the release'
+        required: true
+        default: 'patch'
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: main
+          fetch-depth: 0
+      - run: |
+          NEW_VERSION=$(scripts/calculate-semver.sh "${{ github.event.inputs.level }}")
+          echo "Calculated new version: $NEW_VERSION"
+          git tag "$NEW_VERSION"
+          echo "Pushing new tag: $NEW_VERSION"
+          git push --tags
+  publish:
+    uses: ./.github/workflows/publish.yaml
+    needs: release
+    permissions:
+      contents: write
+    secrets:
+      GOVUK_CI_GITHUB_API_TOKEN: ${{ secrets.GOVUK_CI_GITHUB_API_TOKEN }}

.gitignore

@@ -4,4 +4,5 @@
 # or operating system, you probably want to add a global ignore instead:
 #   git config --global core.excludesfile ~/.gitignore_global
 /dist
-/bin
+/bin
+/crds

scripts/calculate-semver.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ $# -lt 1 ]; then
+    echo "usage: $(basename "$0") <major|minor|patch>" >&2
+    exit 1
+fi
+
+level=$1
+
+current=$(git tag --list 'v*.*.*' --sort=-v:refname | head -n1)
+current=${current:-v0.0.0}
+
+IFS=. read -r major minor patch <<<"${current#v}"
+
+case $level in
+    major) next="$((major + 1)).0.0" ;;
+    minor) next="${major}.$((minor + 1)).0" ;;
+    patch) next="${major}.${minor}.$((patch + 1))" ;;
+    *)
+        echo "error: unknown level '$level' (expected major, minor, or patch)" >&2
+        exit 1
+        ;;
+esac
+
+echo "v${next}"