Update release workflow (#2552)

This updates the CLI release workflow. Releasing CLI itself (not
including downstream repos) now has three separate actions, each
requiring some level of manual approval.
1. Manually trigger the 'Create Release PR' action and the action will
create a PR that updates the changelog and version in `bufcli.go`.
2. Once the the first PR is merged, the second action is triggered. This
action builds and signs the new CLI and creates a draft release.
3. Once the draft release is published (approved), the third action is
triggered and creates a go-back-to-development PR that updates the
version and changelog.

This also removes third party actions in the release workflow.

.github/workflows/back-to-development.yaml

@@ -0,0 +1,28 @@
+name: Go back to Development
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+env:
+  APP_ID: 251311
+jobs:
+  post-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository code
+        uses: actions/checkout@v4
+      - name: Get GitHub app token
+        uses: actions/create-github-app-token@v1
+        id: app_token
+        with:
+          app-id: ${{ env.APP_ID }}
+          private-key: ${{ secrets.TOKEN_EXCHANGE_GH_APP_PRIVATE_KEY }}
+      - name: Set up Git name and email
+        run: |
+          git config user.name "${{ github.actor }}"
+          git config user.email "${{ github.actor }}@users.noreply.github.com"
+      - name: Create PR back to development
+        run: bash ./make/buf/scripts/gobacktodevelopment.bash
+        env:
+          GH_TOKEN: ${{ steps.app_token.outputs.token }}
+          WEBHOOK_URL: ${{ secrets.SLACK_RELEASE_NOTIFICATION_WEBHOOK }}

.github/workflows/build-and-draft-release.yaml

@@ -0,0 +1,41 @@
+name: Build and Draft Release
+on:
+  pull_request:
+    types: [closed]
+  workflow_dispatch:
+    inputs:
+      version:
+        type: string
+        description: The released version without 'v'. For example, 1.0.0.
+jobs:
+  draft_release:
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release')) }}
+    steps:
+      - name: Set VERSION variable
+        # The head ref looks like release/v1.0.0, and we need to trim the string up to the `/v`.
+        run: |
+          VERSION="${{ github.event.inputs.version || github.head_ref}}"
+          echo "VERSION=${VERSION##*/v}" >> $GITHUB_ENV
+      - name: Checkout repository code
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: "1.21.x"
+      - name: Set up Git name and email
+        run: |
+          git config user.name "${{ github.actor }}"
+          git config user.email "${{ github.actor }}@users.noreply.github.com"
+      - name: Build assets and draft release
+        run: bash ./make/buf/scripts/draftrelease.bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          WEBHOOK_URL: ${{ secrets.SLACK_RELEASE_NOTIFICATION_WEBHOOK }}
+          RELEASE_MINISIGN_PRIVATE_KEY: ${{secrets.RELEASE_MINISIGN_PRIVATE_KEY}}
+          RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD: ${{secrets.RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD}}
+      - name: Unset keys
+        if: ${{ always() }}
+        run: |
+          unset RELEASE_MINISIGN_PRIVATE_KEY
+          unset RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD

.github/workflows/create-release-pr.yaml

@@ -0,0 +1,31 @@
+name: Create Release PR
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        type: string
+        description: The released version without 'v'. For example, 1.0.0.
+env:
+  APP_ID: 251311
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository code
+        uses: actions/checkout@v4
+      - name: Get GitHub app token
+        uses: actions/create-github-app-token@v1
+        id: app_token
+        with:
+          app-id: ${{ env.APP_ID }}
+          private-key: ${{ secrets.TOKEN_EXCHANGE_GH_APP_PRIVATE_KEY }}
+      - name: Set up Git name and email
+        run: |
+          git config user.name "${{ github.actor }}"
+          git config user.email "${{ github.actor }}@users.noreply.github.com"
+      - name: Create release PR
+        run: bash ./make/buf/scripts/createreleasepr.bash
+        env:
+          GH_TOKEN: ${{ steps.app_token.outputs.token }}
+          VERSION: ${{ github.event.inputs.version }}
+          WEBHOOK_URL: ${{ secrets.SLACK_RELEASE_NOTIFICATION_WEBHOOK }}