Add release automation

[bryevdv]

[codex]

@philippjfr I have not looked at this in the slightest yet. It's easier for me to evaluate the diffs on GH, so I went ahead and pushed this PR to look over later today/tomorrow. But if you have any thoughts about the shape of this automation please chime in.

Edit:

If we go with this, noting required repo config:

Required one-time release configuration

This PR adds the release workflow, but its repository and registry trust settings must be configured separately. After merging this PR—and before pushing the first release tag—a repository administrator should:

• Create a GitHub environment named release:
  • Require approval from release maintainers.
  • Preferably prevent self-review.
  • Restrict deployments to release tags such as *.*.*.
  • Add the environment secret ANACONDA_API_TOKEN, scoped for uploads to the bokeh Anaconda channel.
• Add an active GitHub tag ruleset for release tags, restricting tag creation, modification, and deletion to release maintainers.
• Configure PyPI Trusted Publishing for ipywidgets_bokeh:
  • Owner: bokeh
  • Repository: ipywidgets_bokeh
  • Workflow: release.yml
  • Environment: release
• Configure npm Trusted Publishing for @bokeh/ipywidgets_bokeh using the same repository, workflow, and environment, with npm publish explicitly allowed.

The repository’s read-only default Actions permission can remain unchanged. PyPI and npm use OIDC, so no long-lived PyPI or npm tokens should be added to GitHub.

Do not push a release tag until all configuration above is complete, since registry publication is not transactional.

[philippjfr]

Looks good to me, should we just merge and give it a shot?

[bryevdv]

Sure I'll merge now and set up the repo and try releasing later tonight.