Add a GitHub Actions workflow for releases.

Triggering off a pushed tag, it creates the corresponding release, then
downloads the source code archives and uploads them as release assets
using Sigstore for signature. Someday, it will be convenient to switch
to using SLSA for signature and provenance, but that day is not today.

Yours truly has been wanting to automate away this dance for years. In
light of CVE-2024-3094, now seemed like a really good time to do that.

Change-Id: I0972ae5dcae7193ef457e23553a7dbe22adbfb1c
Reviewed-on: https://code-review.googlesource.com/c/re2/+/62970
Reviewed-by: Ash Liu <almquist@google.com>
Reviewed-by: Paul Wankadia <junyer@google.com>

.github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..18ee6da
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,38 @@
+name: Release
+on:
+  push:
+    tags: ['**']
+permissions:
+  contents: read
+jobs:
+  create:
+    permissions:
+      # Required to create the release
+      # and upload the release assets.
+      contents: write
+      # Required for Sigstore signing.
+      id-token: write
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4.1.1
+      - run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --generate-notes --latest --verify-tag \
+            --repo "${GITHUB_REPOSITORY}"
+          gh release download "${GITHUB_REF_NAME}" \
+            --archive tar.gz \
+            --repo "${GITHUB_REPOSITORY}"
+          gh release download "${GITHUB_REF_NAME}" \
+            --archive zip \
+            --repo "${GITHUB_REPOSITORY}"
+        shell: bash
+      - uses: sigstore/gh-action-sigstore-python@v2.1.1
+        with:
+          inputs: *.tar.gz *.zip
+      - run: |
+          gh release upload "${GITHUB_REF_NAME}" \
+            *.tar.gz *.zip *.sigstore \
+            --repo "${GITHUB_REPOSITORY}"
+        shell: bash