REC-67: build release on Debian 11 (#49)

Switched to a Debian 11 worker image so that we link against a glibc
with a lower version.

Disabled remote execution for the release workflow because the currently
release binaries
are linked against a higher version of glibc and don't run on Debian 11.
Also some things
are not wired up correctly. We can turn this back on after the next
release.

Added a "dry run" mode to the release workflow so it's easier to check
if things are wired up
correctly in the future.

Bug: linear/REC-67

.github/workflows/release.yml

@@ -21,17 +21,27 @@ on:
         type: string
         description: Version of engflow_auth to release; must be a semver version string, starting with `v`
         required: true
+      dry_run:
+        type: boolean
+        description: "Dry run: if checked, all artifacts are built, but no release is created."
+        required: true
 
 permissions:
   contents: write
 
+env:
+  # Recommended here: https://github.com/bazelbuild/bazelisk/issues/88#issuecomment-625178467
+  BAZELISK_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  DRY_RUN: ${{ inputs.dry_run }}
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
 jobs:
   release:
     runs-on:
       - self-hosted
       - os=linux
       - arch=x64
-      - "engflow-container-image=docker://645088952840.dkr.ecr.eu-west-1.amazonaws.com/engflow-ci/debian12-dind-x64@sha256:763903935682de148b4e09fe1d7ef3bbc4ec829d59c3f41cb9519984639eaa06"
+      - "engflow-container-image=docker://645088952840.dkr.ecr.eu-west-1.amazonaws.com/engflow-ci/debian11-dind-x64@sha256:604855f1ecd6edad3f45f513ed0112b9e8e32589871133767a1a51944b07f487"
       - "engflow-pool=ci_sysbox_x64"
       - "engflow-runtime=sysbox-runc"
       - "engflow-runner-id=${{ github.repository_id }}_release_${{ github.run_id }}_${{ github.run_number }}_${{ github.run_attempt }}"
@@ -40,15 +50,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Log in
-        run: infra/login.sh
-
       - name: release
         if: success()
         run: |
           infra/release.sh "${{ inputs.version }}"
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-
-      - name: Log out
-        run: infra/logout.sh

infra/release.sh

@@ -85,8 +85,6 @@ echo "[START]  Building artifacts"
 BUILD_RELEASE_VERSION="${RELEASE_VERSION}" \
     bazel build \
     --config=release \
-    --config=engflow \
-    --config=remote_linux_x64 \
     -- \
     //:release_artifacts
 echo "[FINISH] Building artifacts"
@@ -125,6 +123,10 @@ cp \
 echo "[FINISH] Staging artifacts"
 
 # Create release
+if [[ "${DRY_RUN}" == true ]]; then
+  echo "[SKIP]   Creating release"
+  exit 0
+fi
 echo "[START]  Creating release"
 ${GH_CLI} release create \
     "${RELEASE_VERSION}" \