Add workflows for CI, and for regenerating

Author: grahamc

.github/workflows/ci.yml

@@ -0,0 +1,29 @@
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  success:
+    name: Build
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: "write"
+      contents: "read"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.
+      - run: nix develop -c typos
+        if: success() || failure()
+      - run: nix develop -c ruff check
+        if: success() || failure()
+      - run: nix develop -c ruff format --diff
+        if: success() || failure()
+      - run: nix develop -c shellcheck ./tools/*.sh
+        if: success() || failure()
+      - name: Regenerate the README to make sure it is unchanged
+        run: nix develop -c ./tools/generate.sh
+        if: success() || failure()
+      - name: Assert no changes were made
+        run: git diff --exit-code
+        if: success() || failure()

.github/workflows/propose-release.yml

@@ -0,0 +1,32 @@
+on:
+  workflow_dispatch:
+    inputs:
+      reference-id:
+        type: string
+        required: true
+      version:
+        type: string
+        required: true
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  propose-release:
+    uses: DeterminateSystems/propose-release/.github/workflows/workflow.yml@main
+    permissions:
+      id-token: "write"
+      contents: "write"
+      pull-requests: write
+    with:
+      reference-id: ${{ inputs.reference-id }}
+      version: ${{ inputs.version }}
+      extra-commands-early: |
+        nix develop -c ./tools/update-state.sh "v$VERSION"
+        git diff || true
+        git commit -m "Update the state.json for v$VERSION" ./tools/state.json
+        nix develop -c ./tools/generate.sh
+        git commit -m "Update README.md and action.yml for v$VERSION" README.md action.yml
+        echo "Checking there is no remaining diff..."
+        git diff --exit-code

.github/workflows/release.yml

@@ -0,0 +1,34 @@
+on:
+  release:
+    types:
+      - released
+
+jobs:
+  PushLooseTag:
+    environment: production
+    permissions:
+      id-token: write
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Optionally tag a vMAJOR tag
+        id: check_tag
+        env:
+          VERSION: ${{ github.ref_name }}
+        run: |
+          if ! echo "$VERSION" | grep -q "^v[[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+$"; then
+              echo "version needs to be a version, in x.y.z format."
+              echo "Therefore, not pushing a v<short>"
+              exit 0
+          fi
+
+          shorttag=$(echo "$VERSION" | cut -d'.' -f1)
+          echo "shorttag=$shorttag" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@v4
+      - name: Create the short tag
+        env:
+          SHORTTAG: ${{ steps.check_tag.outputs.shorttag }}
+        run: |
+          git tag --force "$SHORTTAG"
+          git push --force origin "$SHORTTAG"