Jing Chen b568325093 publish a release tag after the artifacts are uploaded. ...

A release tag was created before the release built, so a failed build left a
tag on GitHub with nothing behind it. release-20260824.0 is an example: the
build failed, but users still see a release that they cannot install.

Before
```
  make tag RELEASE_COMMIT=<sha> RELEASE_NAME=20260831.0 RELEASE_NOTES=<file>
                     │
  tag_release.sh     └─ pushes the annotated tag as  release-20260831.0   ← published immediately
                     │
        ┌────────────┴────────────┐
        │                         │
  Buildkite                  GitHub Actions
  (triggered by the tag)     release_mirror.yml
        ├─ make artifacts         ├─ poll GCS for artifacts (240 min timeout)
        ├─ make release           ├─ verify sha512
        └─ gcloud storage cp      └─ create the GitHub Release
           → gs://gvisor/releases/
```

After
```
  make tag RELEASE_COMMIT=<sha> RELEASE_NAME=20260831.0 RELEASE_NOTES=<file>
                     │
  tag_release.sh     └─ pushes the annotated tag as  staging-release-20260831.0
                     │
  Buildkite          ├─ tag.sh stage      restore release-20260831.0 locally (version stamping)
  (triggered by      ├─ make artifacts    x86_64 + aarch64
   the staging tag)  ├─ make release      sign, lay out repo/
                     ├─ gcloud storage cp → gs://gvisor/releases/
                     └─ tag.sh publish    push release-20260831.0, delete staging tag
                     │
  GitHub Actions     └─ release_mirror.yml  verify sha512, create the GitHub Release

```

2026-09-02 22:43:23 +00:00

..

pgo

Move PGO profile data to runsc/profiles/data.

2025-06-25 17:15:00 -07:00

release

publish a release tag after the artifacts are uploaded.

2026-09-02 22:43:23 +00:00