Add release workflow

Author: sklarsa

.github/workflows/build-release.yml

@@ -0,0 +1,51 @@
+name: Build and Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag name'
+        required: true
+        type: string
+
+defaults:
+  run:
+    shell: 'bash -Eeuo pipefail -x {0}'
+
+jobs:
+  build-release:
+    name: Build and Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends binfmt-support qemu-user-static
+
+      - name: Build binaries
+        run: ./build.sh
+
+      - name: Test binaries
+        run: |
+          ./test.sh gosu-amd64
+          ./test.sh gosu-i386
+          ./test.sh --debian gosu-amd64
+          ./test.sh --debian gosu-i386
+
+      - name: Run govulncheck
+        run: |
+          for gosu in gosu-*; do
+            ./govulncheck-with-excludes.sh -mode=binary "$gosu"
+          done
+
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ inputs.tag }}
+          name: ${{ inputs.tag }}
+          generate_release_notes: true
+          files: |
+            gosu-*
+            SHA256SUMS