AI-118: use GitHub hosted runners; consolidate main and presubmit (#77)

Linux CI jobs are currently not picked up because we disabled legacy
CI Runners for open source repos. This repo has light usage, so just use
GitHub hosted runners instead.

Since we no longer need separate configuration for Linux and other OSs,
fold Linux jobs into the matrix strategy where it makes sense.

This PR also squashes the main and presubmit workflows. There's no
good reason for them to be separate.

Signed-off-by: Jay Conrod <jay@engflow.com>

---------

Signed-off-by: Jay Conrod <jay@engflow.com>

go.mod: upgrade jwt to 5.2.2 (#68)

5.2.1 apparently has a DoS vulnerability, though I don't think
it's relevant for this tool.

go.mod: upgrade jwt to 5.2.2 (#68)

5.2.1 apparently has a DoS vulnerability, though I don't think
it's relevant for this tool.

Fix build info for windows binary (#62)

Putting the build status string into quotes won't match the check and
thus never report a clean / official build.

REC-110: don't use keyring when an unencrypted file token is present (#…

…60)

On Linux, the keyring library can prompt the user for a password if it's
not automatically unlocked. This causes engflow_auth to hang when
invoked as a credential helper because neither stdin nor stdout are
connected to a terminal.

With this change, the get command (and anything else that calls
loadToken) now checks for a token created with -store=file first, then
falls back to the keyring library if that's not present. This reverses
the previous order.

When storing a token into the keyring, storeToken now deletes the token
created with -store=file, if present, preventing it from taking
precedence.

Together, these changes that mean when -store=file is used, the keyring
library should only be used by the logout command, which attempts to
delete both tokens.

REC-102: release: multiple fixes (#56)

Set uploaded artifact names uniquely so that different jobs upload
separate artifacts. The default was to overwrite the same artifact. No
such setting is needed for downloading: the default is to download all
artifacts.

Fixed the regular expression used to validate semantic versions. We used
a PCRE-compatible regex from semver.org, but grep doesn't use PCRE, and
different versions of grep (on Linux and macOS at least) interpret the
same expression differently. Hopefully we've landed on something that
works.

Added an .exe extension to the Windows artifact.

REC-55: login.sh: upgrade to v0.0.8 (#55)

Before #53, I fixed a typo spotted by @minor-fixes without
manually testing it: the Linux build now runs on Debian 11.
That means the engflow_auth binary installed by login.sh
does not work because v0.0.7 was built on Debian 12.
We need v0.0.8 instead.

REC-55: login.sh: upgrade to v0.0.8 (#55)

Before #53, I fixed a typo spotted by @minor-fixes without
manually testing it: the Linux build now runs on Debian 11.
That means the engflow_auth binary installed by login.sh
does not work because v0.0.7 was built on Debian 12.
We need v0.0.8 instead.

REC-55: login.sh: upgrade to v0.0.8 (#55)

Before #53, I fixed a typo spotted by @minor-fixes without
manually testing it: the Linux build now runs on Debian 11.
That means the engflow_auth binary installed by login.sh
does not work because v0.0.7 was built on Debian 12.
We need v0.0.8 instead.

REC-67: build release on Debian 11 (#49)

Switched to a Debian 11 worker image so that we link against a glibc
with a lower version.

Disabled remote execution for the release workflow because the currently
release binaries
are linked against a higher version of glibc and don't run on Debian 11.
Also some things
are not wired up correctly. We can turn this back on after the next
release.

Added a "dry run" mode to the release workflow so it's easier to check
if things are wired up
correctly in the future.

Bug: linear/REC-67