Add release script and GHA

[maxdml]

• Add a script that creates a tag, bump the minor version, push the tag and creates/push a release branch.
• Major versions upgrade are not automatic -- but will work if we provide the new version as an input to the GHA
• Patches are not covered
• There is a mandatory gating to the action (YES!!!)

I tested manually the "clean and up to date local main" requirement, the YES!!! gating, minor version bumps (including from a valid semver -alpha, major version bumps)

[maxdml]

Give some leeway to this test

[Copilot]

Pull Request Overview

This PR introduces an automated release management system with both a Go script and GitHub Actions workflow to standardize the release process.

• Adds a release automation script that handles version bumping, tag creation, and branch management
• Creates a GitHub Actions workflow with mandatory confirmation gating for release creation
• Updates security scanning to focus on the dbos/ directory and fixes a test assertion

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
make_release.go	New release automation script that handles semver version bumping, tag/branch creation, and GitHub releases
.github/workflows/new-release.yml	GitHub Actions workflow for automated releases with manual confirmation
.github/workflows/security.yml	Scopes security scans to dbos/ directory only
dbos/admin_server_test.go	Changes test assertion from exact equality to less-than-or-equal comparison

Comments suppressed due to low confidence (1)

make_release.go:200

• The Tagger signature is missing an Email field, which may cause issues when creating tags. Consider adding a valid email address.

		},

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[kraftp]

Is there any notion of preview releases in Go?

[maxdml]

Is there any notion of preview releases in Go?

No, releases, and specifically "latest", are based on (semver) tags. semver supports -alpha, -beta and so on.

You can also go get a specific commit and/or branch.

In our tests we do go get @main to get what we call "preview" in TS/Python

[kraftp]

This looks reasonable--the same as our Python versioning script as far as I can tell.

[maxdml]

This looks reasonable--the same as our Python versioning script as far as I can tell.

One difference is that we reset the patch version when bumping a minor version -- I don't think the python version does that?

[maxdml]

Also for pre-releases, I think the convention in semver is v1.3.0-rc.1