DEVOPS-728 Add autobuild on "publish release"

[jsfillman]

Updates Actions to use the following process:

Pt 1: Feature > Develop

1. Create feature branch for new release.
2. Once changes are complete, create a PR to merge feature > develop.
3. GHA will automatically build an image called sample_service-develop with the tag of :pr-#.
4. If all checks pass, test image in ci environment.
5. Once confirmed in ci, merge the PR.
6. After merge, the image will be tagged as sample_service-develop:latest.

Pt 2: Develop > Master

1. Once ready to start a release, submit a PR from develop > master.
2. GHA will automatically build an image called sample_service with the tag of :pr-#.
3. Optionally test the sample_service:pr-# image in ci.
4. If all checks pass, merge the PR to master.

Pt 3: Release

1. Create a new Release and enter a new semantic version.
2. Optionally, use the "Auto-generate release notes" feature to pull in all related PRs notes etc.
3. Publish release.
4. An image is automatically built, called sample_service with a both the semantic version tag, as well as latest.
5. Test this image in next
6. If everything looks good, deploy to production.
7. ...
8. Profit!

[jsfillman]

Did you create the develop branch? The developers are not using one and don't plan to use one.

Yes I created the branch, as this is a best practice we're trying to promote across the org.

More importantly, it's what makes it easy to have a ghcr.io/kbase/sample_service-develop:latest that can be used for testing in CI before any changes to master.

This branch is also critical to the proposed full continuous delivery to CI we'd talked earlier today.

Does releasing images this way mean that you can release arbitrary releases and they will be tagged with those names, instead of semantic versioning? I think we should only be building images on tags from master using semantic versioning.

Nope. The SemVer checks I built out today fix this, and are now in this PR.

Also it seems to me that you can release "1.2.3" but then in the tag put "1.0.4" and the docker image won't match up with the tag in github. So should the trigger be on the release or the tag?

After going over the release process today, I think we confirmed this isn't an issue, given the way release is tied to a specific tag.

---

Note: For all automation to work without any loopholes/edge cases, we'll want to:

1. Keep master as the default branch.
2. Add branch restrictions to both develop & master.
3. Ensure the following options are enabled in the branch rules:

[bio-boris]

I wonder if this will be confusing if we don't also push it to latest.. Latest will forever be on an old version? @jsfillman

[bio-boris]

Is this for autobuild or something else? Does this need to be here?