refactor: consolidate release pipeline with draft-first pattern (#124)

## What

Collapse the three separate release workflows (release.yaml, release-image.yaml, release-discussion.yaml) into a single release.yaml reusable workflow using a draft-first pattern: create draft, push tags, build artifacts (optional GoReleaser, optional Docker image), create discussion, then publish. Preserve the legacy release-image.yaml and release-discussion.yaml as stubs that fail with migration instructions.

## Why

The three workflows were always chained and shared data flow, so callers had to wire up three workflow calls and reason about ordering themselves. The draft-first sequence supports repositories with immutable releases enabled by ensuring every artifact and attestation lands before the release becomes visible.

## Notes

- Breaking: callers of release-image.yaml / release-discussion.yaml hit a deprecation error with migration instructions.
- Breaking: update-major-tag input removed; the major tag is always pushed in create_release.
- publish defaults to true and is backwards compatible, but release-drafter always creates a draft first and publish_release handles the final flip.
- publish_release uses always() with per-job result checks so it runs when optional jobs are skipped but blocks on any failure.
- GoReleaser config is validated via yq to require release.disable: true, avoiding conflict with the draft.
- Attestation steps probe repo visibility via the GitHub API and warn on private repos instead of failing cryptically.
- release_discussion always spins up a runner when a tag is created and skips at the step level if secrets are missing (job-level if: cannot read secrets).
- publish_release uses -F draft=false (capital F) to send a boolean rather than a string.

Signed-off-by: jmeridth <jmeridth@gmail.com>

Author: jmeridth

.github/workflows/release-discussion.yaml

@@ -1,5 +1,5 @@
 ---
-name: "Release Discussion"
+name: "Release Discussion (Deprecated)"
 on:
   workflow_call:
     inputs:
@@ -16,37 +16,17 @@ on:
         required: true
       discussion-category-id:
         required: true
-permissions:
-  contents: read
+
+permissions: {}
+
 jobs:
-  create_discussion:
+  deprecated:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      discussions: write
-    env:
-      DISCUSSION_REPOSITORY_ID: ${{ secrets.discussion-repository-id }}
-      DISCUSSION_CATEGORY_ID: ${{ secrets.discussion-category-id }}
+    permissions: {}
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: audit
-      - name: Check for Discussion Repository ID
-        if: ${{ env.DISCUSSION_REPOSITORY_ID  == '' }}
+      - name: Deprecation notice
         run: |
-          echo "discussion-repository-id secret is not set"
+          echo "::error::This workflow (release-discussion.yaml) has been deprecated and consolidated into release.yaml."
+          echo "::error::Migrate to the consolidated release workflow by setting the 'discussion-category-id' and 'discussion-repository-id' secrets on release.yaml instead."
+          echo "::error::See migration guide: https://github.com/github-community-projects/ospo-reusable-workflows/blob/main/docs/release-discussion.md"
           exit 1
-      - name: Check for Discussion Category ID
-        if: ${{ env.DISCUSSION_CATEGORY_ID == '' }}
-        run: |
-          echo "discussion-category-id secret is not set"
-          exit 1
-      - name: Create an Announcement Discussion for Release
-        uses: abirismyname/create-discussion@c2b7c825241769dda523865ae444a879f6bbd0e0
-        with:
-          title: ${{ inputs.full-tag }}
-          body: ${{ inputs.body }}
-          repository-id: ${{ env.DISCUSSION_REPOSITORY_ID }}
-          category-id: ${{ env.DISCUSSION_CATEGORY_ID }}
-          github-token: ${{ secrets.github-token }}

.github/workflows/release-image.yaml

@@ -1,5 +1,5 @@
 ---
-name: "Release Image"
+name: "Release Image (Deprecated)"
 on:
   workflow_call:
     inputs:
@@ -25,56 +25,17 @@ on:
         required: true
       image-registry-password:
         required: true
-permissions:
-  contents: read
+
+permissions: {}
+
 jobs:
-  create_action_images:
+  deprecated:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
-    env:
-      IMAGE_REGISTRY: ${{ secrets.image-registry }}
-      IMAGE_REGISTRY_USERNAME: ${{ secrets.image-registry-username }}
-      IMAGE_REGISTRY_PASSWORD: ${{ secrets.image-registry-password }}
+    permissions: {}
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
-      - name: Log in to the Container registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
-        with:
-          registry: ${{ env.IMAGE_REGISTRY }}
-          username: ${{ env.IMAGE_REGISTRY_USERNAME }}
-          password: ${{ env.IMAGE_REGISTRY_PASSWORD}}
-      - name: Push Docker Image
-        if: ${{ success() }}
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
-        id: push
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: |
-            ${{ env.IMAGE_REGISTRY }}/${{ inputs.image-name }}:latest
-            ${{ env.IMAGE_REGISTRY }}/${{ inputs.image-name }}:${{ inputs.full-tag }}
-            ${{ env.IMAGE_REGISTRY }}/${{ inputs.image-name }}:${{ inputs.short-tag }}
-          platforms: linux/amd64,linux/arm64
-          provenance: false
-          sbom: false
-      - name: Generate artifact attestation
-        if: ${{ inputs.create-attestation }}
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
-        with:
-          subject-name: ${{ env.IMAGE_REGISTRY }}/${{ inputs.image-name}}
-          subject-digest: ${{ steps.push.outputs.digest }}
-          push-to-registry: true
-          github-token: ${{ secrets.github-token }}
+      - name: Deprecation notice
+        run: |
+          echo "::error::This workflow (release-image.yaml) has been deprecated and consolidated into release.yaml."
+          echo "::error::Migrate to the consolidated release workflow by setting the 'image-name' input on release.yaml instead."
+          echo "::error::See migration guide: https://github.com/github-community-projects/ospo-reusable-workflows/blob/main/docs/release-image.md"
+          exit 1