ci: use draft releases to support immutable GitHub releases

Author: keelerm84

.github/workflows/publish.yml

@@ -25,8 +25,9 @@ jobs:
     permissions:
       id-token: write
       contents: write # Needed in this case to write github pages.
+      attestations: write
     outputs:
-      gem-hash: ${{ steps.publish.outputs.gem-hash}}
+      gem-hash: ${{ steps.publish.outputs.gem-hash }}
     steps:
       - uses: actions/checkout@v4
 
@@ -56,14 +57,13 @@ jobs:
         with:
           token: ${{secrets.GITHUB_TOKEN}}
 
-  release-provenance:
-    needs: [ 'build-publish' ]
-    permissions:
-      actions: read
-      id-token: write
-      contents: write
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
-    with:
-      base64-subjects: "${{ needs.build-publish.outputs.gem-hash }}"
-      upload-assets: ${{ !inputs.dry_run }}
-      upload-tag-name: ${{ needs.release-package.outputs.upload-tag-name }}
+      - name: Generate checksums file
+        env:
+          HASHES: ${{ steps.publish.outputs.gem-hash }}
+        run: |
+          echo "$HASHES" | base64 -d > checksums.txt
+
+      - name: Attest build provenance
+        uses: actions/attest@v4
+        with:
+          subject-checksums: checksums.txt

.github/workflows/release-please.yml

@@ -18,11 +18,53 @@ jobs:
     steps:
       - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4
         id: release
-  
-  release-sdk:
+
+  create-tag:
     needs: release-please
     if: ${{ needs.release-please.outputs.release-created == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create release tag
+        env:
+          TAG_NAME: ${{ needs.release-please.outputs.tag-name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if gh api "repos/${{ github.repository }}/git/ref/tags/${TAG_NAME}" >/dev/null 2>&1; then
+            echo "Tag ${TAG_NAME} already exists, skipping creation."
+          else
+            echo "Creating tag ${TAG_NAME}."
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git tag "${TAG_NAME}"
+            git push origin "${TAG_NAME}"
+          fi
+
+  release-sdk:
+    needs: ['release-please', 'create-tag']
+    if: ${{ needs.release-please.outputs.release-created == 'true' }}
     uses: ./.github/workflows/publish.yml
     with:
       dry_run: false
       tag_name: ${{ needs.release-please.outputs.tag-name }}
+
+  publish-release:
+    needs: ['release-please', 'release-sdk']
+    if: ${{ needs.release-please.outputs.release-created == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ needs.release-please.outputs.tag-name }}
+        run: >
+          gh release edit "$TAG_NAME"
+          --repo ${{ github.repository }}
+          --draft=false

release-please-config.json

@@ -2,6 +2,7 @@
   "packages": {
     ".": {
       "release-type": "ruby",
+      "draft": true,
       "bump-minor-pre-major": true,
       "versioning": "default",
       "include-component-in-tag": false,