Add workflow to publish new version of immutable action on every release

[jeffwidman]

Adds a workflow that publishes a new version of the immutable action package for this action on every release.

[Nishnha]

I like the idea, but the publish immutable action repo specifically mentions it is not ready for use, so maybe we should hold off on this?

Publish Immutable Action
Important

This action is not ready for public use. It is part of an upcoming public roadmap item (see github/roadmap#592). Attempts to use this action to upload an OCI artifact will not work until this feature has been fully released to the public. Please do not attempt to use it until that time.

[jeffwidman]

I like the idea, but the publish immutable action repo specifically mentions it is not ready for use, so maybe we should hold off on this?

Good spot. However, we are part of the internal beta, and I pulled this directly from their migration instructions. I also requested a review from that team last night to sanity check that we're still on their paved path.

[Nishnha]

Nice! We should try this out by tagging a new release!

[jeffwidman]

Per @konradpabjan on internal slack:

A couple of months ago in actions/cache when we were releasing a new version, published wasn't running for all scenarios due to some edge case I'm having a hard time remembering so we switched to released and that has been working well
actions/cache#1557

Suggested change

	types: [published]
	types: [released]

However, I looked into this a bit, here's the docs:

• https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#release
• https://docs.github.com/en/webhooks/webhook-events-and-payloads?actionType=released#release
• https://docs.github.com/en/webhooks/webhook-events-and-payloads?actionType=published#release

The relevant bit is:

The prereleased type will not trigger for pre-releases published from draft releases, but the published type will trigger. If you want a workflow to run when stable and pre-releases publish, subscribe to published instead of released and prereleased.

So after reading that, I'm inclined to stick with published for now and re-evaluate if we encounter problems. We haven't had problems in Dependabot-core where we also use published:
https://github.com/dependabot/dependabot-core/blob/5b1bec9bf0e650af2ffd02e9dfcc2e885dd8a32b/.github/workflows/gems-release-to-rubygems.yml#L7

Although that may be because we simply don't use pre-release versions at all...

Anyway, I'm going to ship what we've got and leave this here as breadcrumbs for the future if we do run into problems.

[jeffwidman]

I just tagged a new release to check if this works:

• https://github.com/dependabot/fetch-metadata/releases/tag/v2.4.0

And indeed I see the new package release reflected here:

• https://github.com/dependabot/fetch-metadata/pkgs/container/fetch-metadata/412369741?tag=2.4.0

So it's working! 🎉