Embed cloudbuild.yaml in cmrel so releases need no checkout

[wallrj]

cmrel now carries its own Cloud Build configs, so a release manager only needs go install. No checkout of this repository is required, and there is nothing to keep in sync with the binary.

Why

The four commands that submit GCB jobs (stage, makestage, publish, bootstrap-pgp) read ./gcb/<cmd>/cloudbuild.yaml from the working directory. Since #334, publish also pins the GCB cmrel install to the commit the invoking binary was built from. So the binary and the checkout must match exactly, and nothing checks that they do. The two ways to get there today both have a trap:

Documented approach	What goes wrong
go install cmrel@<tag> plus git checkout <tag>	Two things to keep in sync. A stale checkout submits the wrong config, silently.
git checkout master and build from it	Go stamps the binary vcs.modified=true if git status shows anything, including untracked files. The pin then refuses to run.

This came out of the v1.21.2 release: cert-manager/cert-manager#9237 (comment)

What changes

• New package gcb at the repo root embeds the four cloudbuild.yaml files with go:embed.
• --cloudbuild defaults to empty, meaning the embedded config. Passing a path still works and logs a warning, so cmrel development against a modified YAML (for example Mint GitHub tokens for publish through octo-sts instead of a stored PAT #373) is unaffected.
• pkg/gcb.ParseBuild is split out of LoadBuild so both paths share the decoder.
• Two tests: every embedded config parses, and the publish config keeps the fail-closed _RELEASE_REPO_REF placeholder. make test now runs ./gcb.

The KMS-encrypted token blob in publish/cloudbuild.yaml is already public in this repository, so embedding it in the binary does not change what is exposed.

After this merges

The release process docs shrink to one line, with no clone step:

go install github.com/cert-manager/release/cmd/cmrel@master

@master resolves through the module proxy to a pseudo-version, which pkg/releaseref already accepts, so GCB installs that exact commit. I will open the website PR once this is in.

Evidence: untracked files break the build-from-checkout path

Built from a clean master checkout that had one untracked directory:

$ go build -o /tmp/cmrel ./cmd/cmrel && go version -m /tmp/cmrel | grep -E 'vcs\.(revision|modified)|^\s*mod'
	mod	github.com/cert-manager/release	v1.13.0+dirty
	build	vcs.revision=01727dcc9711d448985b9aaa129d875b323d6e74
	build	vcs.modified=true

pkg/releaseref.Resolve rejects that binary: https://github.com/cert-manager/release/blob/v1.13.0/pkg/releaseref/releaseref.go#L61-L66

Testing

$ make test
go test ./cmd/cmrel/cmd/...
ok  	github.com/cert-manager/release/cmd/cmrel/cmd	0.032s
go test ./gcb
ok  	github.com/cert-manager/release/gcb	0.015s
go test ./pkg/release
ok  	github.com/cert-manager/release/pkg/release	0.016s
go test ./pkg/release/helm
ok  	github.com/cert-manager/release/pkg/release/helm	0.007s
go test ./pkg/release/manifests
ok  	github.com/cert-manager/release/pkg/release/manifests	0.007s
go test ./pkg/sign
ok  	github.com/cert-manager/release/pkg/sign	0.022s

[Claude Fable 5.1]

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign maelvls for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment