Create truss RC packages through GHA

[ndeepak-baseten]

🚀 What

Add a workflow to trigger an RC release from GHA. This packages code already pushed into the branch in the distribution, ensuring package security and integrity. Also allows traceability.

Inputs:

• branch name
• desired rc version (looked up from pyproject.toml and uv.lock)

Other features:

• Can be run by a set of allowlisted users.
• Validates version for x.y.zrcN schema.
• Validates expected rc is consistent in uv.lock and pyproject.toml
• Allows one run at a time

💻 How

Add new GHA workflow. Mostly follows our post-commit workflow, but leaves out the git tag and release steps.

🔬 Testing

Individual steps work. Validated regex separately. Can test wofkflow after merge.

[ndeepak-baseten]

Mainly for security reasons. Can follow any prior best practice if available.

[ndeepak-baseten]

Alternatively, I could add one more conditional to "Main - post-commit" to jump straight to package publishing. However, this workflow also runs validations for rc versions. Not heavily opinionated.