feat(release): migrate Wright lifecycle to release-plz

.github/workflows/release-plz.yml

@@ -0,0 +1,148 @@
+name: Release-plz
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [closed]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  release-pr:
+    name: Maintain release PR
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    concurrency:
+      group: release-plz-pr-${{ github.ref }}
+      cancel-in-progress: false
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: true
+          token: ${{ github.token }}
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+
+      - name: Run release-plz release-pr
+        id: release-plz
+        uses: >-
+          MarcoIeni/release-plz-action@476794ede164c5137bfc3a1dc6ed3675275690f9
+        with:
+          command: release-pr
+          version: "0.3.125"
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ github.token }}
+
+      - name: Synchronize checked-in release metadata
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ steps.release-plz.outputs.pr }}
+        run: |
+          set -euo pipefail
+          pr_number="$(jq -r '.number // empty' <<<"${PR}")"
+          if [[ -z "${pr_number}" ]]; then
+            echo 'release-plz did not create or update a release PR.'
+            exit 0
+          fi
+
+          gh pr checkout "${pr_number}"
+          version="$(cargo metadata --locked --no-deps --format-version 1 | \
+            python3 -c 'import json, sys; print(next(p["version"] for p in json.load(sys.stdin)["packages"] if p["name"] == "wright-cli"))')"
+          python3 scripts/update-dist-manifests.py --version "${version}"
+          python3 scripts/verify-dist.py
+
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add Cargo.toml Cargo.lock dist
+          git diff --cached --check
+          if git diff --cached --quiet; then
+            echo "release metadata already synchronized for ${version}"
+            exit 0
+          fi
+          git commit -m "chore(release): synchronize distribution metadata"
+          git push
+
+  release:
+    name: Publish staged release
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.base.ref == 'main' &&
+      startsWith(github.event.pull_request.head.ref, 'release-plz-') &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write
+      pull-requests: read
+    concurrency:
+      group: release-plz-release-${{ github.event.pull_request.base.ref }}
+      cancel-in-progress: false
+    outputs:
+      releases_created: ${{ steps.release-plz.outputs.releases_created }}
+      release_tag: ${{ steps.release-identity.outputs.tag }}
+    steps:
+      - name: Checkout merged release
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+          token: ${{ github.token }}
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+
+      - name: Run release-plz release
+        id: release-plz
+        uses: >-
+          MarcoIeni/release-plz-action@476794ede164c5137bfc3a1dc6ed3675275690f
+        with:
+          command: release
+          version: "0.3.125"
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ github.token }}
+
+      - name: Export release identity
+        id: release-identity
+        if: steps.release-plz.outputs.releases_created == 'true'
+        env:
+          RELEASES: ${{ steps.release-plz.outputs.releases }}
+        run: |
+          set -euo pipefail
+          tag="$(jq -r '.[] | select(.package_name == "wright-cli") | .tag' \
+            <<<"${RELEASES}")"
+          [[ -n "${tag}" ]] || {
+            echo 'release-plz did not return the wright-cli release tag.' >&2
+            exit 1
+          }
+          echo "tag=${tag}" >>"${GITHUB_OUTPUT}"
+
+  release-artifacts:
+    name: Build and publish release artifacts
+    needs: release
+    if: needs.release.outputs.releases_created == 'true'
+    uses: ./.github/workflows/release.yml
+    with:
+      ref: ${{ github.event.pull_request.merge_commit_sha }}
+      tag: ${{ needs.release.outputs.release_tag }}
+      commit: ${{ github.event.pull_request.merge_commit_sha }}
+    secrets: inherit
+    permissions:
+      contents: write
+      id-token: write
+      packages: write