ci: Update release-please-action and drop upload-release-action (#6319)

Upgrading release-please-action to v4 requires some changes:
 - Move some settings from the action inputs to a manifest file (release-type, extra-files)
 - Rename default-branch to target-branch

Additionally:
 - There is an example in the new release-please-action docs that covers our exact use case for upload-release-action, but with the official GitHub CLI app.  So we drop upload-release-action and use the GitHub CLI instead.
 - There is an output in release-please-action that gives access to the patch version from semver.  We should use this instead of running endsWith() over tag_name.
 - Update mxschmitt/action-tmate@v3.6 => v3.17.  This is a trivial update on an action that I missed in my last audit.

.github/workflows/release-please.yaml

@@ -12,27 +12,27 @@ jobs:
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
+      patch: ${{ steps.release.outputs.patch }}
     steps:
       # Create/update release PR
-      - uses: google-github-actions/release-please-action@v3
+      - uses: google-github-actions/release-please-action@v4
         id: release
         with:
-          # Required input to specify the release type (node package).
-          release-type: node
           # Make sure we create the PR against the correct branch.
-          default-branch: ${{ github.ref_name }}
+          target-branch: ${{ github.ref_name }}
           # Use a special shaka-bot access token for releases.
           token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
-          # Update these additional files containing version numbers.
-          extra-files: lib/player.js
+          # See also settings in these files:
+          manifest-file: .release-please-manifest.json
+          config-file: .release-please-config.json
 
   # The jobs below are all conditional on a release having been created by
   # someone merging the release PR.  They all run in parallel.
 
   tag-main:
     runs-on: ubuntu-latest
     needs: release
-    if: needs.release.outputs.release_created && endsWith(needs.release.outputs.tag_name, '.0') == false
+    if: needs.release.outputs.release_created && needs.release.outputs.patch == '0'
     steps:
       - uses: actions/checkout@v4
         with:
@@ -113,14 +113,14 @@ jobs:
           fi
 
       - run: npm pack
-      - uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # 2.9.0
-        with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          tag: ${{ needs.release.outputs.tag_name }}
-          file: shaka-player-*.tgz
-          file_glob: true
-          overwrite: true
-          make_latest: false
+
+      - name: Attach to release
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+        run: |
+          gh release upload \
+              ${{ needs.release.outputs.tag_name }} shaka-player-*.tgz \
+              --clobber
 
   appspot:
     runs-on: ubuntu-latest
@@ -179,7 +179,7 @@ jobs:
   auto-branch:
     runs-on: ubuntu-latest
     needs: release
-    if: needs.release.outputs.release_created && endsWith(needs.release.outputs.tag_name, '.0')
+    if: needs.release.outputs.release_created && needs.release.outputs.patch == '0'
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/update-screenshots.yaml

@@ -83,7 +83,7 @@ jobs:
           git push "$REMOTE" HEAD:"$BRANCH"
 
       - name: Debug
-        uses: mxschmitt/action-tmate@v3.6
+        uses: mxschmitt/action-tmate@v3.17
         with:
           limit-access-to-actor: true
         if: failure()

.release-please-config.json

@@ -0,0 +1,13 @@
+{
+  "packages": {
+    ".": {
+      "include-component-in-tag": false,
+      "include-v-in-tag": true,
+      "component": "",
+      "release-type": "node",
+      "extra-files": [
+        "lib/player.js"
+      ]
+    }
+  }
+}

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "4.7.0"
+}