Create a workflow to propose new releases (#1449)

* Create a propose-release workflow, and run the release-tags workflow on release

* update release docs

* Apply suggestions from code review

* Update the release process notes

* Update CONTRIBUTING.md

.github/workflows/propose-release.yml

@@ -0,0 +1,40 @@
+on:
+  workflow_dispatch:
+    inputs:
+      reference-id:
+        type: string
+        required: true
+      version:
+        type: string
+        required: true
+      nix-version:
+        type: string
+        required: true
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  propose-release:
+    uses: DeterminateSystems/propose-release/.github/workflows/workflow.yml@main
+    permissions:
+      id-token: "write"
+      contents: "write"
+      pull-requests: write
+    with:
+      reference-id: ${{ inputs.reference-id }}
+      version: ${{ inputs.version }}
+      extra-commands-early: |
+        for fname in $(find ./tests/fixtures -name '*.json'); do
+          cat "$fname" \
+            | jq '.version = $version' --arg version "$version" \
+            > "$fname.next"
+          mv "$fname.next" "$fname"
+          git add "$fname"
+        done
+        git commit -m "Update test fixtures with the new nix-installer version" || true
+
+        sed -i 's#https://flakehub.com/f/DeterminateSystems/nix/=.*";#https://flakehub.com/f/DeterminateSystems/nix/=${{ inputs.nix-version }}";#' ./flake.nix
+        git add flake.nix
+        git commit -m "Update Nix release to ${{ inputs.nix-version }}"

.github/workflows/release-tags.yml

@@ -4,9 +4,9 @@ concurrency:
   group: release
 
 on:
-  push:
-    tags:
-      - "v*.*.*"
+  release:
+    types:
+      - released
 
 permissions:
   contents: write # In order to upload artifacts to GitHub releases
@@ -31,6 +31,7 @@ jobs:
       cache-key: release-aarch64-darwin-artifacts-${{ github.sha }}
 
   release:
+    environment: production
     runs-on: ubuntu-latest
     needs:
       - build-x86_64-linux

CONTRIBUTING.md

@@ -346,10 +346,23 @@ You can also remove your `$HOME/nix-installer-wsl-tests-temp` folder whenever yo
 
 # Releases
 
+> [!NOTE]
+> The documentation below describes a process that used to be mostly manual, and is now driven externally.
+> The material below is generally kept up to date for documentation, manual releases, and external use purposes.
+> Determinate Systems employees, consult the internal release documentation for more details: https://www.notion.so/14553fe7e1dd809eb80affb37228a7c8.
+
 This package uses [Semantic Versioning](https://semver.org/). When determining the version number for a new release refer to Semantic Versioning for guidance. You can use the `check-semver` command alias from within the development environment to validate your changes don't break semver.
 
-To cut a release, run `./prepare-release.sh 0.0.1` inside `nix develop`.
-This script will:
+To cut a release, run the GitHub Actions workflow `propose-release.yml`.
+Specify these parameters:
+
+- reference-id: provide a fresh UUID
+- version: in the `X.Y.Z` format.
+  No leading `v`.
+- nix-version: The version of Nix to use in the flake.nix, in the format of `X.Y.Z`.
+  No leading `v`.
+
+This will:
 
 - Create a release branch from `main` (`git checkout -b release-v0.0.1`)
   - Release PRs should not contain any installer-related changes which require review
@@ -358,19 +371,16 @@ This script will:
   - `cargo update --aggressive`
   - `cargo outdated --ignore-external-rel --aggressive`
 - Update the versions in the fixture data in `test/fixtures/**/*.json`
+- Open a pull request, where the GitHub Actions will run these tests:
 
-Then you should:
-
-- Push the branch, create a PR ("Release v0.0.1").
-  This pull request will automatically run VM and container tests:
   - `nix flake check -L`
   - `nix build .#hydraJobs.container-test.all.x86_64-linux.all -L -j 6`
   - `nix build .#hydraJobs.vm-test.all.x86_64-linux.all -L -j 6`
-- Once the PR tests pass and it has been reviewed, merge it
-- Checkout the `main` branch and `git pull`
-- Prepare a draft release that creates the new tag on publish
-  - Create a changelog following the format of the last release
-- Undraft the release
+
+- Once the PR tests pass and it has been reviewed, merge it.
+
+- Create a release / new tag named `vX.Y.Z`
+  - Generate a changelog using the GitHub "make a changelog" button
 - CI will produce artifacts and upload them to the release
 - Once you are certain the release is good, `cargo publish` it
   - **Warning:** While you can re-release Github releases, it is not possible to do the same on `crates.io`