Merge branch 'release' into temporal-cloud

.github/CODEOWNERS

@@ -13,5 +13,5 @@ LICENSE @newrelic/developer-enablement
 /.config/ @newrelic/developer-enablement
 
 # product/content ownership
-/dashboards/ @seemantk
-/quickstarts/ @seemantk @rahulbasu-nr
+/dashboards/
+/quickstarts/

.github/actions/build-validate-artifact/action.yml

@@ -0,0 +1,25 @@
+name: Build and Validate Artifact
+description: Reusable action to build and validate the component artifact
+inputs:
+  output-artifact:
+    description: 'If provided, the action will output the artifact to the build directory'
+    required: false
+
+runs:
+  using: composite
+  steps:
+    - name: Add data source ids to schema
+      shell: bash
+      run: |
+        cd utils && yarn add-datasource-ids
+
+    - name: Build & Validate Artifact
+      shell: bash
+      id: build-validate-artifact
+      run: |
+        cd utils && yarn build-validate-quickstart-artifact ${{ inputs.output-artifact && '--output-artifact' || '' }}
+
+    - name: Debugging output
+      shell: bash
+      if: ${{ runner.debug }}
+      run: ls -la utils/build

.github/actions/bump-version-tag/action.yml

@@ -0,0 +1,16 @@
+name: Bump version tag
+description: Bumps the version tag based on the latest version
+outputs:
+  tag:
+    description: The new tag prefixed with `v`
+    value: ${{ steps.versions.outputs.v-version }}
+runs:
+  using: composite
+  steps:
+    - name: Get next version
+      uses: reecetech/version-increment@a5d65984a6c6e8bbc30ece69d53d96e40736f24c
+      id: versions
+      with:
+        scheme: semver
+        increment: minor
+        use_api: true

.github/pull_request_template.md

@@ -26,3 +26,4 @@ _The owners of this repo are not experts in the subject matter of the quickstart
 ### Alerts
 
 - [ ] Did you check that your alerts actually work?
+- [ ] Are you trying to create standalone alerts? Standalone alerts are deprecated. They should only be included in quickstarts.

.github/workflows/pr-checks.yml

@@ -0,0 +1,32 @@
+name: PR Validation
+
+on:
+  pull_request:
+
+jobs:
+  validate:
+    name: Validate Artifact
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          ref: ${{ github.sha }}
+      - name: Setup workspace
+        uses: "./.github/actions/bootstrap"
+      - name: Validate PR Artifact
+        uses: "./.github/actions/build-validate-artifact"
+  validate-quickstart-ids:
+    name: Validate Quickstart IDs
+    runs-on: ubuntu-latest
+    if: ${{ github.base_ref == 'main' && github.head_ref == 'release' }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          ref: ${{ github.sha }}
+      - name: Setup workspace
+        uses: "./.github/actions/bootstrap"
+      - name: Validate Quickstart IDs
+        run: |
+          cd utils && yarn validate-quickstart-ids

.github/workflows/release.yml

@@ -4,13 +4,27 @@ on:
   push:
     branches:
       - main
+    tags:
+      - 'v*'
 
 env:
   THIRD_PARTY_GIT_AUTHOR_EMAIL: opensource+bot@newrelic.com
   THIRD_PARTY_GIT_AUTHOR_NAME: nr-opensource-bot
 
+defaults:
+  run:
+    shell: bash
+    working-directory: ./utils
+
+permissions:
+  id-token: write # Required for attestation
+  attestations: write # Required for attestation
+  contents: write
+
 jobs:
   generate-third-party-notices:
+    # Don't run this if it's a tag push
+    if: ${{ startsWith(github.ref, 'refs/heads') }}
     runs-on: ubuntu-latest
     steps:
       # Checkout fetch-depth: 2 because there's a check to see if package.json
@@ -24,13 +38,11 @@ jobs:
         uses: "./.github/actions/bootstrap"
 
       - name: Install OSS CLI
-        working-directory: ./utils
         run: |
           yarn global add @newrelic/newrelic-oss-cli
 
       - name: Generate Third Party Notices
         id: generate-notices
-        working-directory: ./utils
         run: |
           if [ ! -f "third_party_manifest.json" ]; then
             echo "::error::third_party_manifest.json is missing. Must generate using the newrelic-oss-cli."
@@ -55,3 +67,34 @@ jobs:
           else
             echo "No change in package.json, not regenerating third-party notices"
           fi
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          ref: ${{ github.ref }}
+      - name: Setup workspace
+        uses: "./.github/actions/bootstrap"
+      - name: Validate and generate artifact
+        uses: "./.github/actions/build-validate-artifact"
+        with:
+          output-artifact: 'true'
+      - name: Attest artifact
+        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c
+        with:
+          subject-path: utils/build/*
+      - name: Create new release tag
+        # Only run if this is a branch push (we'll need a new tag)
+        if: ${{ startsWith(github.ref, 'refs/heads') }}
+        id: version
+        uses: "./.github/actions/bump-version-tag"
+      - name: Create release
+        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191
+        with:
+          files: utils/build/*
+          fail_on_unmatched_files: true
+          make_latest: true
+          # If we have a tag output from the previous step, use that as the tag
+          # name, otherwise use the current ref which should be the tag.
+          tag_name: ${{ steps.version.outputs.tag || github.ref }}