revert: restore original codecov-cli release process

[thomasrockhu-codecov]

Summary

The release process inherited from the getsentry/prevent-cli migration (Craft + build.yml + create-release.yml + release-codecov-cli.yml) is broken. This PR rolls the release pipeline back to the original codecov/codecov-cli flow, adapted only as needed for the current monorepo layout where the package now lives under codecov-cli/.

prevent-cli/ sources are intentionally left in place; this PR is scoped to the release pipeline only. A follow-up PR will deal with removing the prevent-cli directory and flattening codecov-cli/ back to the repo root.

Removed (the Craft pipeline)

• .craft.yml
• .github/workflows/build.yml (built both CLIs on release/** for Craft)
• .github/workflows/create-release.yml (getsentry/action-prepare-release driver)
• .github/workflows/release-codecov-cli.yml (fired after Craft published the release)
• scripts/{bump-version.sh,build_alpine.sh,build_linux.sh,pre-build.sh,uv-installer-0.7.8.sha256sum}

Restored (the original release flow, adapted to codecov-cli/ + uv)

• .github/workflows/create_release_pr.yml — workflow_dispatch bumps codecov-cli/pyproject.toml on a release/<version> branch and opens a PR into main.
• .github/workflows/create_release.yml — on merge of a release/* PR, cuts the v<version> GitHub release.
• .github/workflows/release_flow.yml — on release creation, calls build_for_pypi + build_assets, publishes to PyPI, and announces the release via the GCS Pub/Sub topic.
• .github/workflows/build_for_pypi.yml — uv build of the codecov-cli sdist + wheel.
• .github/workflows/build_assets.yml — pyinstaller binaries for macOS / Ubuntu / Windows + alpine and linux ARM via Docker.
• scripts/build_alpine_arm.sh, scripts/build_linux_arm.sh — Docker entrypoints that build the codecovcli_<distro>_<arch> binary out of codecov-cli/.

Secrets / vars that must exist (all pre-date the migration)

• RELEASER_GPG_PRIVATE_KEY
• GH_RELEASE_TOKEN
• CODECOV_RELEASE_PAT
• CODECOV_GCP_WIDP, CODECOV_GCP_WIDSA
• GCLOUD_UPLOADER_PROJECT_ID, GCLOUD_UPLOADER_PUBSUB_TOPIC

If any were rotated or removed during the prevent-cli migration, they'll need to be re-added.

Test plan

• Confirm the secrets above still exist in the repo / org.
• Trigger Create CLI Release PR via workflow_dispatch with a throwaway version (e.g. 99.0.0-test) to verify the release branch + PR are created against codecov-cli/pyproject.toml.
• On a dry run release tag, confirm release_flow.yml runs end-to-end (build, PyPI publish — preferably first against TestPyPI, GCS Pub/Sub message).
• Verify build_assets.yml produces codecovcli_macos, codecovcli_linux, codecovcli_windows.exe, and the alpine / linux ARM binaries.

Made with Cursor

[sentry]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
700	1	699	1

View the full list of 1 ❄️ flaky test(s)

api.temp.calculator.test_calculator::test_divide

Flake rate in main: 100.00% (Passed 0 times, Failed 120 times)

Stack Traces | 0.001s run time

def
                test_divide():
                > assert Calculator.divide(1, 2) == 0.5
                E assert 1.0 == 0.5
                E + where 1.0 = <function Calculator.divide at 0x104c9eb90>(1, 2)
                E + where <function Calculator.divide at 0x104c9eb90> = Calculator.divide
                .../temp/calculator/test_calculator.py:30: AssertionError

To view more test analytics, go to the Prevent Tests Dashboard

[thomasrockhu-codecov]

Addressed the CodeQL warnings about missing permissions: blocks by adding minimal scoped permissions to each new workflow:

• build_for_pypi.yml, create_release.yml, release_flow.yml: top-level contents: read (only checkout / artifact upload / OIDC-based publish, which already has its own id-token: write at the job).
• create_release_pr.yml: top-level contents: read, job-level contents: write (needed to git push the release/<version> branch; the PR creation uses GH_RELEASE_TOKEN directly).
• build_assets.yml: top-level contents: read, job-level contents: write on build_assets and build_assets_alpine_arm (needed for svenstaro/upload-release-action when inputs.release == true).

Force-pushed as 5f9bcf8 (single commit).