release: reject dirty sources and build artifacts

Fixes #3583

.github/workflows/release-check.yml

@@ -0,0 +1,35 @@
+name: Release checks
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: nix develop --fallback --command bash -e {0}
+
+jobs:
+  release-check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: NixOS/nix-installer-action@62c1943b776c509394b550f3f983adc14e9212d6 # main
+      - uses: Mic92/hestia@dfed9ced335d28978ba74e513939a10db1f71025 # v3.1.0
+      - name: Validate release configuration
+        run: goreleaser check
+      - name: Test release guards
+        run: bash tools/release-check-test.sh
+      - name: Build and verify Headscale release binary
+        run: goreleaser build --snapshot --clean --single-target