callable release, fix lint

.github/workflows/ci-docs-shim.yaml

@@ -15,4 +15,4 @@ jobs:
     with:
       flavor: ${{ matrix.flavor }}
       type: ${{ matrix.type }}
-    secrets: inherit # Inherits all secrets from the parent workflow.
+    secrets: inherit # Inherits all secrets from the parent workflow.

.github/workflows/release.yaml

@@ -0,0 +1,45 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+
+# Permissions for the GITHUB_TOKEN used by the workflow.
+permissions:
+  contents: read # Allows reading the content of the repository.
+  packages: read # Allows reading the content of the repository's packages.
+  id-token: write
+
+jobs:
+  tag-new-version:
+    permissions: write-all
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release-flag.outputs.release_created }}
+    steps:
+      - name: Create Release Tag
+        id: tag
+        uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3
+      - id: release-flag
+        run: echo "release_created=${{ steps.tag.outputs.release_created || false }}" >> "$GITHUB_OUTPUT"
+
+  publish:
+    permissions:
+      contents: read # Allows reading the content of the repository.
+      packages: write # Allows reading the content of the repository's packages.
+      id-token: write
+    needs: tag-new-version
+    if: ${{ needs.tag-new-version.outputs.release_created == 'true' }}
+    strategy:
+      matrix:
+        flavor: [upstream, registry1, unicorn]
+        architecture: [amd64, arm64]
+        exclude:
+          - flavor: registry1
+            architecture: arm64
+    uses: defenseunicorns/uds-common/.github/workflows/callable-publish.yaml@0780ed64a7b76920526046b8c3b8c7251a4bf2f0 # v1.0.0
+    with:
+      flavor: ${{ matrix.flavor }}
+      runsOn: ${{ matrix.architecture == 'arm64' && 'uds-swf-ubuntu-arm64-4-core' || 'uds-swf-ubuntu-big-boy-4-core' }}
+    secrets: inherit # Inherits all secrets from the parent workflow.