Intent to implement: release automation for Anubis

[Xe]

Hey all,

Given that I still have limited time to work on this project, I want to remove one of the biggest pain points in Anubis that requires me to do the SRE trifecta of likelihood to accidentally cause issues: releasing new versions of the program. One of the main reasons that it takes me so long to build up the courage to release a new version of Anubis is that doing so requires me to:

• Take manual action
• Deal with GPG by hand
• Manually sign and upload release assets

This is a highly manual process that is bound to have problems at some point, and rather than waiting for that to happen I want to take proactive action and prevent them from happening in the first place. In my ideal world, releasing a new version of Anubis should be as easy as pressing a single "tag new version" button which would run over some final smoke tests and then automate the entire release process, including:

• Generating the release notes by grabbing the [Unreleased] section of the CHANGELOG
• Building the docker images (dep on chore: set up docker buildx bake #862) and pushing them as the new release number
• Building the native packages and bundling them in the release
• Tagging the next release number as determined by conventional commits (dep on Adopt Conventional Commits #316)
• Signing all relevant assets
• Pushing them to GitHub

I am publishing this as an intent to implement because some members of the community have expressed anxiety over this and I want to know what parts of this could be objectionable before I start working on this in earnest.

Any interactions with GPG will be done on a dedicated mac mini that is only used for doing signing for Techaro packages.

For an example of this flow, TecharoHQ/yeet uses semantic-release to automatically publish new versions of yeet every time one of the following happens:

1. A maintainer hits the run workflow button on the Cut release workflow
2. A pull request with the footer Release-status: cut gets merged into main.

Does anyone have any objections to doing this and/or have any guidance on how best to secure things like GPG keys in the process?