Add reusable GitHub release plumbing

[Ben Hillis (benhillis)]

Adds the reusable release-publication primitives needed by the standalone OpenVMM source release described in #4150.

• makes release notes and existing-release handling explicit
• allows callers to require validation/attestation side effects before publication
• distinguishes a missing release from gh authentication or server failures
• adds a reusable actions/attest@v4 Flowey node
• preserves the existing VmgsTool draft, TODO notes, and skip-existing behavior

This is independent of the build identity work in #4162 and does not yet add the OpenVMM publication workflow.

[Copilot]

Pull request overview

Adds reusable Flowey primitives for publishing GitHub releases and generating GitHub build provenance attestations, intended to support the upcoming standalone OpenVMM source release workflow.

Changes:

• Extend publish_gh_release with explicit release-notes handling, configurable existing-release behavior, and prerequisite side-effects before publication.
• Update the VmgsTool GH release job to supply explicit release notes and “skip if exists” behavior.
• Add a reusable actions/attest@v4 Flowey node for build provenance attestation.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
flowey/flowey_lib_hvlite/src/_jobs/publish_vmgstool_gh_release.rs	Supplies explicit release notes and existing-release handling for the VmgsTool release job.
flowey/flowey_lib_common/src/publish_gh_release.rs	Adds reusable GH release publication parameters (notes, on-existing behavior, prerequisites) and improves “release missing vs auth/server failure” handling.
flowey/flowey_lib_common/src/lib.rs	Exposes the new attestation module from flowey_lib_common.
flowey/flowey_lib_common/src/attest_build_provenance.rs	Introduces a reusable GitHub Actions attestation node using actions/attest@v4.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

flowey/flowey_lib_common/src/attest_build_provenance.rs:37

• actions/attest@v4’s upstream README lists artifact-metadata: write as a required permission for normal usage. This node currently requests contents: read (and does not request artifact-metadata at all), which can cause the generated workflow to fail at runtime with an insufficient-permissions error when creating attestation storage records.

Consider extending GhPermission to include artifact-metadata and requesting it here (or otherwise ensuring callers can grant it) so the node’s emitted step is self-sufficient.

            ctx.emit_gh_step("Attest release artifacts", "actions/attest@v4")
                .with("subject-path", subject_paths)
                .requires_permission(GhPermission::Contents, GhPermissionValue::Read)
                .requires_permission(GhPermission::IdToken, GhPermissionValue::Write)
                .requires_permission(GhPermission::Attestations, GhPermissionValue::Write)

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

flowey/flowey_lib_common/src/attest_build_provenance.rs:34

• actions/attest is referenced via a floating major tag (actions/attest@v4). Elsewhere in this repo, GitHub Actions are pinned to immutable SHAs (e.g. actions/setup-node@49933e… in flowey_lib_common/src/install_nodejs.rs and actions/checkout@… in workflows) to reduce supply-chain risk. Consider pinning actions/attest to a specific commit SHA (with an inline comment indicating the corresponding version) and updating it intentionally when bumping versions.

        let attested = if matches!(ctx.backend(), FlowBackend::Github) {
            ctx.emit_gh_step("Attest release artifacts", "actions/attest@v4")
                .with("subject-path", subject_paths)

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.