chore: skip github release and use gpg signed tag flow (#347)

* chore: skip github release and use gpg signed tag flow

* chore: point reusable workflows to openfga/.github

* chore: add least-privilege top-level permissions to pr-title workflow

Author: SoulPancake

.github/workflows/main.yaml

@@ -154,4 +154,4 @@ jobs:
     needs: [publish-maven-central, publish-github-packages]
     permissions:
       contents: write
-    uses: openfga/sdk-generator/.github/workflows/undraft-release.yml@main
+    uses: openfga/.github/.github/workflows/undraft-release.yml@main

.github/workflows/pr-title-check.yml

@@ -6,9 +6,12 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   pr-title-check:
     permissions:
       pull-requests: read
-    uses: openfga/sdk-generator/.github/workflows/pr-title-check.yml@main
+    uses: openfga/.github/.github/workflows/pr-title-check.yml@main
 

.github/workflows/release-please.yml

@@ -36,7 +36,7 @@ jobs:
     if: |
       github.event_name == 'workflow_dispatch' ||
       startsWith(github.event.head_commit.message, 'release:')
-    uses: openfga/sdk-generator/.github/workflows/release-please.yml@main
+    uses: openfga/.github/.github/workflows/release-please.yml@main
     with:
       trigger-event:   ${{ github.event_name }}
       bump-type:       ${{ inputs.bump-type || 'auto' }}

release-please-config.json

@@ -2,8 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
   "release-type": "simple",
   "pull-request-title-pattern": "release: v${version}",
-  "draft": true,
-  "force-tag-creation": true,
+  "skip-github-release": true,
   "packages": {
     ".": {
       "package-name": "",