release: add protected release workflow

Author: OgeonX-Ai

.github/workflows/release.yml

@@ -0,0 +1,34 @@
+name: release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Semantic version tag such as v1.0.0
+        required: true
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate version
+        run: |
+          python - <<'PY'
+          import os, re
+          version = os.environ['VERSION']
+          if not re.fullmatch(r'v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?', version):
+              raise SystemExit('Invalid version: ' + version)
+          print(version)
+          PY
+        env:
+          VERSION: ${{ inputs.version }}
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ inputs.version }}
+        run: gh release create "$VERSION" --title "$VERSION" --generate-notes