Add release workflow

.ci/scripts/release.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+set -eu -o pipefail
+
+BRANCH=$(git branch --show-current)
+
+if ! [[ "${BRANCH}" =~ ^RELEASE-[0-9]+\.[0-9]+$ ]]
+then
+  echo ERROR: This is not a release branch!
+  exit 1
+fi
+
+NEW_VERSION="$(bump-my-version show new_version --increment release)"
+echo "Release ${NEW_VERSION}"
+
+if ! [[ "RELEASE-${NEW_VERSION}" == "${BRANCH}"* ]]
+then
+  echo ERROR: Version does not match release branch
+  exit 1
+fi
+
+bump-my-version bump release --commit --message "Release {new_version}" --tag --tag-name "v{new_version}" --tag-message "Release {new_version}"
+bump-my-version bump patch --commit
+
+git push origin "${BRANCH}" "v${NEW_VERSION}"

.github/workflows/release.yml

@@ -0,0 +1,30 @@
+---
+name: "Tag Release"
+
+on:
+  workflow_dispatch:
+
+jobs:
+  release:
+    name: "Release"
+    runs-on: "ubuntu-latest"
+    steps:
+      - uses: "actions/checkout@v4"
+        with:
+          token: "${{ secrets.RELEASE_TOKEN }}"
+      - name: "Set up Python"
+        uses: "actions/setup-python@v5"
+        with:
+          python-version: "3.13"
+      - name: "Install dependencies"
+        run: |
+          python -m pip install --upgrade pip
+          pip install bump-my-version~=0.29.0
+      - name: "Setup git"
+        run: |
+          git config user.name pulpbot
+          git config user.email [email protected]
+      - name: "Release"
+        run: |
+          .ci/scripts/release.sh
+...