chore: import upstream snapshot with attribution

.github/scripts/release/github/cleanup-artifacts.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+for name in GITHUB_REPOSITORY GITHUB_RUN_ID; do
+  if [ -z "${!name:-}" ]; then
+    echo "$name is required" >&2
+    exit 1
+  fi
+done
+
+if [ -z "${GH_TOKEN:-${GITHUB_TOKEN:-}}" ]; then
+  echo "GH_TOKEN or GITHUB_TOKEN is required" >&2
+  exit 1
+fi
+
+artifacts_file="$(mktemp)"
+trap 'rm -f "$artifacts_file"' EXIT
+artifact_name_regex="${ARTIFACT_NAME_REGEX:-}"
+cleanup_description="${ARTIFACT_CLEANUP_DESCRIPTION:-intermediate Actions artifacts after publish}"
+
+gh api --paginate \
+  -H "Accept: application/vnd.github+json" \
+  "/repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts?per_page=100" \
+  --jq '.artifacts[] | select(.expired | not) | [.id, .name] | @tsv' \
+  > "$artifacts_file"
+
+if [ ! -s "$artifacts_file" ]; then
+  echo "No workflow artifacts to delete for run $GITHUB_RUN_ID"
+  exit 0
+fi
+
+deleted_count=0
+while IFS=$'\t' read -r artifact_id artifact_name; do
+  if [ -z "$artifact_id" ]; then
+    continue
+  fi
+  if [ -n "$artifact_name_regex" ] && ! [[ "$artifact_name" =~ $artifact_name_regex ]]; then
+    continue
+  fi
+
+  echo "Deleting workflow artifact $artifact_name ($artifact_id)"
+  gh api \
+    -X DELETE \
+    -H "Accept: application/vnd.github+json" \
+    "/repos/$GITHUB_REPOSITORY/actions/artifacts/$artifact_id"
+  deleted_count=$((deleted_count + 1))
+done < "$artifacts_file"
+
+if [ "$deleted_count" -eq 0 ] && [ -n "$artifact_name_regex" ]; then
+  echo "No workflow artifacts matched ARTIFACT_NAME_REGEX=$artifact_name_regex for run $GITHUB_RUN_ID"
+  exit 0
+fi
+
+echo "Deleted $deleted_count workflow artifacts from run $GITHUB_RUN_ID"
+
+if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+  {
+    echo ""
+    echo "### Workflow artifacts"
+    echo ""
+    echo "Deleted $deleted_count $cleanup_description."
+  } >> "$GITHUB_STEP_SUMMARY"
+fi

.github/scripts/release/github/stable-notes.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+for name in BRANCH_NAME GITHUB_OUTPUT GITHUB_REPOSITORY GITHUB_SHA RELEASE_CHANNEL RELEASE_SIGNED RELEASE_VERSION RUNNER_TEMP VERSION_TAG; do
+  if [ -z "${!name:-}" ]; then
+    echo "$name is required" >&2
+    exit 1
+  fi
+done
+
+release_public_origin="${RELEASE_PUBLIC_ORIGIN:-${CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN:-}}"
+if [ -z "$release_public_origin" ]; then
+  echo "RELEASE_PUBLIC_ORIGIN or CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN is required" >&2
+  exit 1
+fi
+
+notes_file="$RUNNER_TEMP/open-design-stable-notes.md"
+public_origin="${release_public_origin%/}"
+cat > "$notes_file" <<EOF
+## Summary
+- channel: $RELEASE_CHANNEL
+- version: $RELEASE_VERSION
+- R2 metadata: $public_origin/$RELEASE_CHANNEL/latest/metadata.json
+- E2E report: $public_origin/$RELEASE_CHANNEL/versions/$RELEASE_VERSION/report.zip
+- mac signed/notarized: $RELEASE_SIGNED
+- mac x64 signed/notarized: ${MAC_INTEL_SIGNED:-false}
+- windows signed: false
+- branch: $BRANCH_NAME
+- commit: $GITHUB_SHA
+
+See [CHANGELOG.md](https://github.com/${GITHUB_REPOSITORY}/blob/$VERSION_TAG/CHANGELOG.md) for the full release notes.
+
+This stable release ships mac arm64/x64 DMG and ZIP assets, Windows x64 NSIS installer assets, checksums, updater feed files, and a zipped packaged e2e spec report. Linux AppImage packaging remains optional through the stable Linux lane.
+EOF
+echo "notes_file=$notes_file" >> "$GITHUB_OUTPUT"