feat: Add tag creation workflow (#24)

This tag is used to control which commit a rollout of required workflows
points at.

Author: jalseth

.github/minty.yaml

@@ -0,0 +1,18 @@
+version: 'minty.abcxyz.dev/v2'
+
+rule:
+  if: |-
+    assertion.iss == issuers.github &&
+    assertion.repository_owner_id == '198259824' &&
+    assertion.repository_id == '1238099503'
+
+scope:
+  create-tag:
+    rule:
+      if: |-
+        assertion.ref == 'refs/heads/main' &&
+        assertion.event_name == 'workflow_dispatch'
+    repositories:
+      - 'workflows'
+    permissions:
+      contents: 'write'

.github/workflows/create_tag.yml

@@ -0,0 +1,87 @@
+name: 'Create Tag'
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: 'The name of the tag to create (e.g., v1.0.0)'
+        required: true
+        type: 'string'
+      tag_commit:
+        description: 'The commit SHA, branch, or tag to place the tag on'
+        required: true
+        type: 'string'
+
+permissions:
+  contents: 'read'
+  id-token: 'write'
+
+jobs:
+  create-tag:
+    runs-on: 'ubuntu-latest'
+    steps:
+      - id: 'auth'
+        name: 'Authenticate to Google Cloud'
+        uses: 'google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f' # ratchet:google-github-actions/auth@v2
+        with:
+          create_credentials_file: false
+          export_environment_variables: false
+          workload_identity_provider: '${{ vars.TOKEN_MINTER_WIF_PROVIDER }}'
+          service_account: '${{ vars.TOKEN_MINTER_WIF_SERVICE_ACCOUNT }}'
+          token_format: 'id_token'
+          id_token_audience: '${{ vars.TOKEN_MINTER_SERVICE_AUDIENCE }}'
+          id_token_include_email: true
+
+      - name: 'Mint Token'
+        id: 'mint-token'
+        uses: 'abcxyz/github-token-minter/.github/actions/minty@6ec95c40b5f558c0848997fcb27ccb06e31e7172' # ratchet:abcxyz/github-token-minter/.github/actions/minty@main
+        with:
+          id_token: '${{ steps.auth.outputs.id_token }}'
+          service_url: '${{ vars.TOKEN_MINTER_SERVICE_URL }}'
+          requested_permissions: |-
+            {
+              "scope": "create-tag",
+              "repositories": ["${{ github.event.repository.name }}"],
+              "permissions": {
+                "contents": "write"
+              }
+            }
+
+      - name: 'Create Tag'
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7
+        env:
+          TAG_NAME: '${{ inputs.tag_name }}'
+          TAG_COMMIT: '${{ inputs.tag_commit }}'
+        with:
+          github-token: '${{ steps.mint-token.outputs.token }}'
+          script: |
+            const tagName = process.env.TAG_NAME;
+            const tagCommit = process.env.TAG_COMMIT;
+
+            // Resolve the commitish to a full SHA
+            let resolvedSha;
+            try {
+              const commit = await github.rest.repos.getCommit({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: tagCommit,
+              });
+              resolvedSha = commit.data.sha;
+              core.info(`Resolved "${tagCommit}" to SHA: ${resolvedSha}`);
+            } catch (err) {
+              core.setFailed(`Failed to resolve commitish "${tagCommit}": ${err.message}`);
+              return;
+            }
+
+            // Create the tag reference
+            try {
+              await github.rest.git.createRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `refs/tags/${tagName}`,
+                sha: resolvedSha,
+              });
+              core.info(`Successfully created tag ${tagName} on commit ${resolvedSha}`);
+            } catch (err) {
+              core.setFailed(`Failed to create tag ${tagName}: ${err.message}`);
+            }