Add workflow to publish new version of immutable action on every release (#623)

Adds a workflow that publishes a new version of the immutable action package
for this action on every release.

Co-authored-by: Nish Sinha <nishnha@github.com>

.github/workflows/release-bump-version.yml

@@ -89,4 +89,4 @@ jobs:
           echo "    > https://github.com/${{ github.repository }}/releases/tag/untagged-XXXXXX" >> $GITHUB_STEP_SUMMARY
           echo "    # Use the generated URL to review/edit the release notes." >> $GITHUB_STEP_SUMMARY
           echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          echo "Once the release is tagged, another GitHub Action workflow automatically moves the floating \`v2\` tag to point at this release." >> $GITHUB_STEP_SUMMARY
+          echo "Once the release is tagged, another GitHub Action workflow automatically publishes the new version of the immutable action package for this release." >> $GITHUB_STEP_SUMMARY

.github/workflows/release-move-tracking-tag.yml

@@ -1,3 +1,11 @@
+# TODO: This GitHub Action was migrated to Immutable Actions, which resolves versions from packages
+# rather than from git tags. So theoretically floating this tracking tag isn't necessary.
+# However, Immutable Actions are still in beta, and currently (May 8, 2025) only hosted runners
+# are resolving immutable actions from packages. Self-hosted runners are still pulling from git tags.
+# So we still need to float this tracking tag. Once Immutable Actions is fully GA'd, then _all_ runners
+# should be resolving from the immutable actions packages, and then we should delete both
+# this workflow AND the `v1`/`v2` git tags.
+
 name: Release - Move Tracking Tag
 
 on:

.github/workflows/release-publish-package.yml

@@ -0,0 +1,27 @@
+name: "Publish Immutable Action Version"
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+  
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Publish
+        id: publish
+        uses: actions/publish-immutable-action@0.0.3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      
+      - name: Set summary
+        run: |
+          echo ":rocket: Successfully published a new version of the immutable action package pointing at release: ${{ github.event.release.name }}" >> $GITHUB_STEP_SUMMARY

README.md

@@ -205,7 +205,7 @@ jobs:
   1. Run the action to generate a version bump PR.
   2. Merge the PR.
   3. Tag that merge commit as a new release using the format `v1.2.3`. The job summary contains a URL pre-populated with the correct version for the title and tag.
-  4. Once the release is tagged, another GitHub Action workflow automatically moves the `v2` tracking tag to point to the new version.
+  4. Once the release is tagged, another GitHub Action workflow automatically publishes the new version of the immutable action package for this release.
 
 </p>
 </details>