ci: automatic CalVer release and self-hosted runners

.github/workflows/docker-build.yml

@@ -32,7 +32,7 @@ env:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, hetzner]
     timeout-minutes: 15
     permissions:
       contents: write
@@ -45,6 +45,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
 
@@ -107,7 +110,7 @@ jobs:
 
   security-scan:
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, hetzner]
     timeout-minutes: 15
     if: github.event_name != 'pull_request'
     permissions:

.github/workflows/pre-commit.yml

@@ -9,4 +9,4 @@ name: Pre-commit
 
 jobs:
   pre-commit:
-    uses: Baker-scripts/.github/.github/workflows/pre-commit.yml@4b60709b79fd3458601b56595b3a4abc6cc51b3a # main
+    uses: Baker-scripts/.github/.github/workflows/pre-commit.yml@3c1f3173b20fba4832b50116a455be4fc85a2ebc # main

.github/workflows/release.yml

@@ -0,0 +1,26 @@
+---
+name: Release
+
+"on":
+  workflow_run:
+    workflows: [Pre-commit, Docker Build and Publish, Devvit app]
+    types: [completed]
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Release
+    if: >-
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.conclusion == 'success'
+    permissions:
+      contents: write
+      actions: read
+    uses: bakerboy448/.github/.github/workflows/release-calver-gated.yml@3f32d193e96c22760f874cc5ae35e0f072e0a173
+    with:
+      sha: ${{ github.event.workflow_run.head_sha }}
+      required_workflows: pre-commit.yml,docker-build.yml
+      optional_workflows: devvit.yml