ci(release): automate signed release tags and release notes

.github/workflows/release-create-tag.yml

@@ -0,0 +1,31 @@
+name: release-create-tag
+run-name: Release v${{ inputs.version }} from ${{ github.ref_name }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version to release, for example 28.0.1
+        required: true
+
+permissions: {}
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    environment: release-signing
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          token: ${{ secrets.RELEASE_TOKEN }}
+      - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        with:
+          gpg_private_key: ${{ secrets.RELEASE_TAG_GPG_KEY }}
+          passphrase: ${{ secrets.RELEASE_TAG_GPG_PASSPHRASE }}
+          git_user_signingkey: true
+      - env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          git tag -s -m "v$VERSION" "v$VERSION"
+          git push origin tag "v$VERSION"

.github/workflows/release-tag-version.yml

@@ -4,8 +4,7 @@ on:
   push:
     tags:
       - "v[0-9]*"
-      - "!v[0-9]*-rc*"
-      - "!v[0-9]*-dev"
+      - "!v[0-9]*-*"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -73,12 +72,20 @@ jobs:
         uses: dev-hanz-ops/install-gh-cli-action@6089bdde54118ad7ca3d22053eb2d69387fd2779 # v0.3.0
         with:
           gh-cli-version: 2.39.1
+      - id: range
+        run: |
+          previous=$(git tag --list --sort=-v:refname | grep -xE 'v[0-9]+\.[0-9]+\.[0-9]+' | grep -A1 -xF "$GITHUB_REF_NAME" | tail -1) # highest stable version below this one
+          echo "range=$previous..$GITHUB_SHA" >> "$GITHUB_OUTPUT" # a sha, not HEAD, so git-cliff fetches PR labels of this branch
+      - uses: orhun/git-cliff-action@a9a95522b26fe6403f7bb24031f21fb573d0f5ff # v4.9.1
+        with:
+          github_token: ${{ secrets.RELEASE_TOKEN }}
+          args: --github-repo ${{ github.repository }} --tag ${{ github.ref_name }} ${{ steps.range.outputs.range }}
       - name: create github release
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           TAG: ${{ github.ref_name }}
         run: |
-          gh release create "$TAG" --title "$TAG" --notes-from-tag dist/release/*
+          gh release create "$TAG" --title "$TAG" --notes-file git-cliff/CHANGELOG.md dist/release/*
 
   container:
     runs-on: namespace-profile-gitea-release-docker