Revamp deploy pipeline to be stateless

[inlined]

Overview

Rewrites the internal deploy pipeline to be stateless so that we don't need to commit to master in releases which improves security.

As of this change, you must include a relnote line even if it is "none". Relnotes can include explicit PR numbers or will use the current PR for tracking. Multiple relnotes can be in a single PR (for example, this one will name all the relnotes previously in CHANGELOG to prime the pump).

After this, you may also run the publisher script directly instead of remembering a cloud build enqueue command. The script will detect it is on your local machine, validate arguments, and then enqueue itself in the cloud build job to run in a trusted environment.

Testing

Will test with a prerelease and then real release of a RC minor. Would like to not be submitting to cloud build et. al. until review though.

Release Notes

(Copied from the now removed CHANGELOG to work with commit-based relnotes)

relnote: fix: Remove false warning when using Expression in cors option (#1802)
relnote: feat: Add requiresRole developer API for declarative security support and automatic Manifest extraction (#1908)
relnote: Validate literal timeoutSeconds values per v2 trigger type (0-540s for events, 0-3600s for HTTPS/callable, 0-1800s for task queues, 0-7s for identity functions) so misconfigured values fail at function-definition or manifest-extraction time instead of at deploy time. (#1877)
relnote: feat: Add requiresAPI function to allow declaring Google Cloud API dependencies in code. (#1900)
relnote: fix(v1): Call onInit for schedule.onRun functions (#1801)
relnote: feat: Add support to declare lifecycle hooks in functions. (#1915)
relnote: fix(cors): Fix issue using Params to set CORS allowed hosts (#1903)
relnote: fix(v2): Fix event data unpacking for auth event triggers (#1923)
relnote: feat: Add "v2/lifecycle" and "lifecycle" import paths for lifecycle hooks (#1926)

[gemini-code-assist]

Code Review

This pull request refactors the release pipeline by rewriting scripts/publish.sh into a polymorphic release manager supporting both local orchestrator and Cloud Build worker modes, updating the Cloud Build configuration, and adding a release notes section to the pull request template. Feedback on these changes highlights a critical filename mismatch in the Cloud Build step, a potential script crash under set -e when a commit lacks a PR suffix, and formatting issues with multi-line release notes, alongside a minor terminology inconsistency in the pull request template.

[inlined]

Note that this PR's timing was quite interesting and revealed that the script doesn't handle removing reverted changes' relnotes. I can add that now or in the future if it comes up.

Edit: Why not just add it now. Gemini can do this much easier than I can

[ajperel]

Was it intentional to remove the executable bit from publish.sh?

Did a quick review but I know so little about Github workflows it's not a substantial one. I hope Joe's giving you great feedback.

[inlined]

Done with a pass. Here's what changelog.sh prints on this branch:

- fix: Remove false warning when using Expression in cors option (#1802)
- feat: Add requiresRole developer API for declarative security support and automatic Manifest extraction (#1908)
- Validate literal `timeoutSeconds` values per v2 trigger type (0-540s for events, 0-3600s for HTTPS/callable, 0-1800s for task queues, 0-7s for identity functions) so misconfigured values fail at function-definition or manifest-extraction time instead of at deploy time. (#1877)
- feat: Add requiresAPI function to allow declaring Google Cloud API dependencies in code. (#1900)
- fix(v1): Call onInit for schedule.onRun functions (#1801)
- feat: Add support to declare lifecycle hooks in functions. (#1915)
- fix(cors): Fix issue using Params to set CORS allowed hosts (#1903)

[inlined]

Andy thought Joe's approval was enough, but he doesn't have write access. Bypassed rules and merged given that Andy had intended to defer to Joe and that it's well after hours.

[ajperel]

Confirming that was all true... sorry for not explicitly approving.