Add schema-validated release catalog companion action

[msarahan]

This adds a schema-validated action that creates a release catalog companion for an existing build artifact. The release platform can aggregate these job-level entry files into the release catalog. That catalog supports the two purposes tracked in rapidsai/build-infra#381:

• assembling releases that can be tested and verified before formal tagging
• preserving build-time software evidence, especially for binary artifacts such as wheels where that evidence cannot reliably be reconstructed later.

The action:

• validates configuration before inspecting artifacts
• validates every resolved artifact, package identity, and evidence file during materialization
• uploads one enveloped release-catalog-entries.json plus collected evidence as release-catalog-<source-artifact-name>

Tracks rapidsai/build-infra#381.

[jameslamb]

I did my best to review this.

My read is that this replaces a bunch of individual arguments with:

• automatically calculating some of the values
• allowing a few more values only needed in specific cases (like cuVS Java builds) to be passed in as a single dictionary via this new config: argument

At a surface level that sounds good to me! Less opportunity for misconfiguration across the repos, easier to change the behavior in the future.

My comments in this PR are light, but see my review on rapidsai/shared-workflows#609 ... I think documentation (ideally written by a human) in the release-build-output/ directory would be really helpful for folks to understand why this exists and what it does. I looked through the code, logs, and output from the testing PRs (rapidsai/dask-cuda#1672, rapidsai/nx-cugraph#274, NVIDIA/cuvs#2400) and think I have a picture of that, but I personally would find it hard to modify this setup if a new requirement came in.

[jameslamb]

Suggested change

	skip: [actionlint-docker, release-build-output-config]
	# why skip these in pre-commit.ci?
	#
	# * 'actionlint-docker': needs docker
	# * 'release-build-output-config': need 'jq'
	#
	# There are covered in other CI jobs where we have more control over the runtime evnvironment.
	#
	skip: [actionlint-docker, release-build-output-config]

This comment is really verbose, overly-specific, and only applies to release-build-output-config even though its placement makes it looks like it applies to everything in skip:. Would you consider something like this suggestion?

[jameslamb]

Suggested change

	https://github.com/rapidsai/shared-actions/blob/main/release-build-output/config.schema.json
	JSON string with configuration for this action. Schema and field documentation:
	https://github.com/rapidsai/shared-actions/blob/main/release-build-output/config.schema.json

I don't think repeating the literal field names and the implementation detail "... and package identity when artifact_type is custom" is helpful. Let's simplify this and redirect back to the schema.

[jameslamb]

How do I figure out a value for this?

Do I generate a UUID and provide my own? Is this auto-generated by the code?

That type of detail would be helpful.