.github: prepare releases with annotated tags

.github/workflows/prepare-release.yml

@@ -0,0 +1,86 @@
+name: Prepare release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Release version, e.g. 2026.02-1.1.2"
+        required: true
+        type: string
+      target:
+        description: "Branch, tag, or commit to release"
+        required: true
+        default: main
+        type: string
+
+permissions:
+  contents: write
+
+concurrency:
+  group: prepare-release
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout release target
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.target }}
+          fetch-depth: 0
+
+      - name: Validate release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          if [[ ! "$VERSION" =~ ^20[0-9]{2}\.[0-9]{2}-[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Invalid release version: $VERSION"
+            exit 1
+          fi
+
+          if git rev-parse --verify --quiet "refs/tags/$VERSION"; then
+            echo "Tag already exists: $VERSION"
+            exit 1
+          fi
+
+          if gh release view "$VERSION" >/dev/null 2>&1; then
+            echo "Release already exists: $VERSION"
+            exit 1
+          fi
+
+      - name: Create annotated tag
+        env:
+          ACTOR: ${{ github.actor }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email \
+            "41898282+github-actions[bot]@users.noreply.github.com"
+
+          git tag -a "$VERSION" \
+            -m "Release $VERSION (requested by @$ACTOR)"
+          test "$(git cat-file -t "$VERSION")" = tag
+          git push origin "refs/tags/$VERSION"
+
+      - name: Create draft release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          gh release create "$VERSION" \
+            --draft \
+            --generate-notes \
+            --title "$VERSION" \
+            --verify-tag
+
+      - name: Add summary
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          echo "## Release $VERSION prepared" >> "$GITHUB_STEP_SUMMARY"
+          echo >> "$GITHUB_STEP_SUMMARY"
+          echo "Review and publish the draft release to start the release builds." \
+            >> "$GITHUB_STEP_SUMMARY"

.github/workflows/top-level.yml

@@ -16,7 +16,35 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  validate-release-tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout release tag
+        if: ${{ github.event_name == 'release' }}
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Require an annotated release tag
+        if: ${{ github.event_name == 'release' }}
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          object_type="$(git cat-file -t "refs/tags/$TAG")"
+          if [ "$object_type" != tag ]; then
+            echo "Release tag $TAG must be annotated; found $object_type"
+            echo "Create and push the tag before publishing the release:"
+            echo "  git tag -a $TAG -m \"Release $TAG\" <commit>"
+            echo "  git push origin $TAG"
+            echo "Then select the existing tag in the GitHub Release UI."
+            exit 1
+          fi
+
   build-buildroot:
+    needs: validate-release-tag
     strategy:
       fail-fast: false
       matrix:
@@ -44,6 +72,7 @@ jobs:
       contents: write
 
   build-mkosi-fedora:
+    needs: validate-release-tag
     uses: ./.github/workflows/fedora.yml
     permissions:
       contents: write