ci: run zizmor again to remove action-gh-release and pin almalinux image (#2203)

Run zizmor again. Replaces action-gh-release with just `gh release` and pins the image version for almalinux. Also a driveby fix for docs regarding permissions.

.github/ci/release_notes.md

@@ -0,0 +1,17 @@
+<!-- Write summary here -->
+
+---
+
+## Bug Fixes
+
+## Features
+
+## Changes
+
+## Other
+
+## Internal Changes
+
+## New Contributors
+
+---

.github/workflows/build_releases.yml

@@ -548,7 +548,7 @@ jobs:
   build-rpm:
     name: "Build .rpm software packages"
     runs-on: ubuntu-24.04
-    container: ghcr.io/clementtsang/almalinux-8
+    container: ghcr.io/clementtsang/almalinux-8:sha-00d3dee
     timeout-minutes: 12
     strategy:
       fail-fast: false

.github/workflows/deployment.yml

@@ -129,34 +129,8 @@ jobs:
           echo "Generated $(ls ./release | wc -l) files:"
           du -h -d 0 ./release/*
 
-      - name: Create release and add release files
-        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # 2.0.8
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          prerelease: false
-          tag_name: ${{ env.RELEASE_VERSION }}
-          draft: true
-          fail_on_unmatched_files: true
-          name: ${{ env.RELEASE_VERSION }} Release
-          body: |
-            <!-- Write summary here -->
-
-            ---
-
-            ## Bug Fixes
-              
-            ## Features
-              
-            ## Changes
-
-            ## Other
-
-            ## Internal Changes
-
-            ## New Contributors
-
-            ---
-
-            **Full Changelog:**
-          files: |
-            ./release/*
+      - name: Create release with files
+        run: |
+          gh release create "${RELEASE_VERSION}" ./release/* --title "${RELEASE_VERSION} Release" --notes-file ./.github/ci/release_notes.md --draft --generate-notes --fail-on-no-commits
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/docs.yml

@@ -1,4 +1,4 @@
-# Workflow to deploy nightly mkdocs documentation.
+# Workflow to deploy mkdocs documentation.
 
 name: docs
 
@@ -39,7 +39,8 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-          persist-credentials: false
+          # This is required due to mike needing to push.
+          persist-credentials: true
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:

.github/workflows/nightly.yml

@@ -135,18 +135,12 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       # As a workaround to immutable releases, we create it as a draft first, then manually publish it after.
-      - name: Add all release files and create nightly release if not mock
-        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # 2.0.8
+      - name: Create nightly release with files if not mock
         if: github.event.inputs.isMock != 'true'
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          prerelease: true
-          tag_name: ${{ env.TAG_NAME }}
-          draft: true
-          fail_on_unmatched_files: true
-          name: ${{ env.RELEASE_NAME }}
-          files: |
-            ./release/*
+        run: |
+          gh release create "${TAG_NAME}" ./release/* --title "${RELEASE_NAME}" --draft --prerelease
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish the draft release
         if: github.event.inputs.isMock != 'true'