Add Figma Bazel release workflow

[alexeagle]

What

Adds .github/workflows/figma-release.yml — a manually-triggered (workflow_dispatch) GitHub Actions workflow that builds Figma's Bazel fork from source and publishes a GitHub release with binaries named per Bazelisk's conventions.

Motivation: we periodically cut our own Bazel builds from fork branches like 8.6.0-figma (cf. https://github.com/aspect-forks/bazel/releases). This automates that with GHA instead of building locally by hand.

How it works

Lives on the default branch (master) so it appears under Actions → Figma Bazel Release → Run workflow. It builds whatever ref you give it, so the file never needs editing between releases.

Single input — ref (the fork branch, by convention <upstream-version>-figma, e.g. 8.6.0-figma). Everything else is computed by a fast setup job, so there is no hand-typed version string to get wrong:

• upstream base = ref with -figma... stripped (validated x.y.z); used as the host Bazel via USE_BAZEL_VERSION. The job also asserts ref descends from the upstream <base> tag, so a branch mislabeled 8.6.0-figma but really cut from 8.5.0 fails fast.
• fork build counter = max(existing <base>-figma.N) + 1 — re-cuts can't collide with or skip a prior number; first build is .1.
• embed label / tag = <base>-figma.<counter> (e.g. 8.6.0-figma.2).

The resolved commit SHA is pinned once in setup and checked out by every build leg + the release job, so all platforms build an identical tree and the release targets that exact commit.

Build: //src:bazel + //src:bazel_nojdk with -c opt --stamp --embed_label … --incompatible_strict_action_env=true on ubuntu-22.04, ubuntu-22.04-arm, macos-14. Uploads bazel-<label>-<os>-<arch> and bazel_nojdk-<label>-<os>-<arch> (+ .sha256), then gh release create <embed_label>.

Release notes auto-document drift: upstream base tag, stacked-commit list (git log upstream-<base>..HEAD, or "None yet"), cross-fork compare link, and the Bazelisk usage snippet.

Consuming a release

export USE_BAZEL_VERSION=figma/8.6.0-figma.2   # or: echo 'figma/8.6.0-figma.2' > .bazelversion

Bazelisk resolves this to github.com/figma/bazel/releases/download/8.6.0-figma.2/bazel-8.6.0-figma.2-<os>-<arch>.

Notes / risks

• ubuntu-22.04-arm (GitHub-hosted ARM Linux) is free on public repos; if this repo is private, ARM larger-runners must be enabled or that leg fails.
• First build is a full Bazel self-build per platform (slow) — timeout set to 120 min.
• Actions are SHA-pinned to match this repo's existing convention.
• Not yet exercised end-to-end — the 8.6.0-figma branch is currently identical to upstream 8.6.0 (zero drift), so the first run produces a vanilla 8.6.0 build labeled 8.6.0-figma.1.

🤖 Generated with Claude Code