Add new release procedure for Rizin with manual tagging and release creation.

[Rot127]

Your checklist for this pull request

• I've read the guidelines for contributing to this repository
• I made sure to follow the project's coding style
• I've documented or updated the documentation of every function and struct this PR changes. If not so I've explained why.
• I've added tests that prove my fix is effective or that my feature works (if possible)
• I've updated the rizin book with the relevant information (if needed)

Detailed description

Github releases doesn't seem to work reliably. So this adds the manual release process.

Still missing:

• Add a script to download the packages and source code to attach to the release.
• Add script to checklist.

Test plan

...

Closing issues

...

[ret2libc]

What's the issue with GitHub releases?

[Rot127]

@ret2libc It now assigned twice in a row the tag to the dev branch. And not to the stable.
Also the signing doesn't work reliably. So we can just as well sign it on our own.

[ret2libc]

@ret2libc It now assigned twice in a row the tag to the dev branch. And not to the stable. Also the signing doesn't work reliably. So we can just as well sign it on our own.

Where exactly? In the CI? Maybe we should use target_commitish in the softprops/action-gh-release@v1 action. With regards to signing, there is https://sigstore.dev/ which allows automatic signatures from GH CI without any manual operation and without us having to deal with GPG keys, rotating them, updating them, etc.

[XVilka]

@ret2libc It now assigned twice in a row the tag to the dev branch. And not to the stable. Also the signing doesn't work reliably. So we can just as well sign it on our own.

Where exactly? In the CI? Maybe we should use target_commitish in the softprops/action-gh-release@v1 action. With regards to signing, there is https://sigstore.dev/ which allows automatic signatures from GH CI without any manual operation and without us having to deal with GPG keys, rotating them, updating them, etc.

Not CI - tag was created on dev if we create it via GitHub interface from the Draft Release.

[XVilka]

Please remove instructions about signing, since we need first to decide on how exactly we do that. GitHub "standard" verification isn't enough, especially since they changed ZIP archives once. This is tracked in #3786

[ret2libc]

@ret2libc It now assigned twice in a row the tag to the dev branch. And not to the stable. Also the signing doesn't work reliably. So we can just as well sign it on our own.

Where exactly? In the CI? Maybe we should use target_commitish in the softprops/action-gh-release@v1 action. With regards to signing, there is https://sigstore.dev/ which allows automatic signatures from GH CI without any manual operation and without us having to deal with GPG keys, rotating them, updating them, etc.

Not CI - tag was created on dev if we create it via GitHub interface from the Draft Release.

Yeah I understand, I'm afraid that it's caused by the wrong commit being referenced in the draft release when we create it in the CI. IIRC I "recently" changed that part of the CI as we had to switch GH action for release, so it might behave slightly different and cause this behaviour.