[build] Pre-release workflow improvements (#16946)

* [build] allow running pre-release with just major and minor versions specified

* [build] pre-release does not need ruby installed

* [build] have pre-release get latest from trunk before updating files

* [build] have pre-release workflow automatically request and lock trunk

Author: titusfortner

.github/workflows/get-approval.yml

@@ -0,0 +1,44 @@
+name: Get Approval
+
+permissions: {}
+
+on:
+  workflow_call:
+    inputs:
+      title:
+        description: 'Notification title'
+        required: true
+        type: string
+      message:
+        description: 'Notification message'
+        required: true
+        type: string
+    secrets:
+      SLACK_WEBHOOK_URL:
+        required: true
+
+jobs:
+  notify:
+    name: Send Notification
+    runs-on: ubuntu-latest
+    steps:
+      - name: Slack Notification
+        uses: rtCamp/action-slack-notify@v2
+        env:
+          SLACK_ICON_EMOJI: ":key:"
+          SLACK_COLOR: warning
+          SLACK_CHANNEL: selenium-tlc
+          SLACK_USERNAME: GitHub Workflows
+          SLACK_TITLE: ${{ inputs.title }}
+          SLACK_MESSAGE: ${{ inputs.message }}
+          MSG_MINIMAL: actions url
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
+
+  authorize:
+    name: Authorize
+    needs: notify
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Approved
+        run: echo "Approved"

.github/workflows/pre-release.yml

@@ -19,6 +19,18 @@ permissions:
   contents: read
 
 jobs:
+  get-approval:
+    name: Get Approval
+    uses: ./.github/workflows/get-approval.yml
+    with:
+      title: Release approval needed
+      message: |
+        Selenium ${{ github.event.inputs.version }} release preparation started.
+        Please approve to lock trunk when ready.
+    secrets:
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+
+  # Rust jobs run in parallel with approval since work is not on trunk
   update-rust:
     name: Update Rust Version
     runs-on: ubuntu-latest
@@ -82,10 +94,18 @@ jobs:
         run: |
           git push origin --delete rust-release-${{ github.event.inputs.version }}
 
+  restrict-trunk:
+    name: Restrict Trunk Branch
+    needs: [get-approval, selenium-manager]
+    uses: ./.github/workflows/restrict-trunk.yml
+    with:
+      restrict: true
+    secrets: inherit
+
   update-files:
     name: Update Files
     runs-on: ubuntu-latest
-    needs: selenium-manager
+    needs: restrict-trunk
     steps:
       - name: "Checkout project"
         uses: actions/checkout@v4
@@ -94,11 +114,8 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
           ref: trunk
-      - name: Install Ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: '3.2'
-          working-directory: 'rb'
+      - name: Get latest trunk
+        run: git pull --ff-only origin trunk
       - name: Setup curl for Ubuntu
         run: sudo apt-get update && sudo apt-get install -y libcurl4-openssl-dev
       - name: Setup Bazel
@@ -116,6 +133,19 @@ jobs:
         run: |
           git config --local user.email "[email protected]"
           git config --local user.name "Selenium CI Bot"
+      - name: Normalize version
+        id: version
+        shell: bash
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          VERSION="${VERSION//[[:space:]]/}"
+          if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+$ ]]; then
+            VERSION="${VERSION}.0"
+          elif [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Invalid version format: '$VERSION'. Expected major.minor or major.minor.patch"
+            exit 1
+          fi
+          echo "value=$VERSION" >> "$GITHUB_OUTPUT"
       - name: Update browser versions
         id: browsers
         run: |
@@ -168,7 +198,7 @@ jobs:
           fi
       - name: Bump versions
         run: |
-          ./go all:version ${{ github.event.inputs.version }}
+          ./go all:version ${{ steps.version.outputs.value }}
           git commit -m "bump versions in preparation for release"
       - name: Update changelogs
         run: |
@@ -180,9 +210,9 @@ jobs:
           token: ${{ secrets.SELENIUM_CI_TOKEN }}
           author: Selenium CI Bot <[email protected]>
           delete-branch: true
-          branch: release-preparation-${{ github.event.inputs.version }}
+          branch: release-preparation-${{ steps.version.outputs.value }}
           base: trunk
-          title: "[build] Prepare for release of Selenium ${{ github.event.inputs.version }}"
+          title: "[build] Prepare for release of Selenium ${{ steps.version.outputs.value }}"
           body: |
 
             ### Updates Applied