Add a ci-update-workflow GitHub Actions to update the go-version matrix

[chizhg]

1. secrets.GCP_CREDENTIALS needs to be uploaded to this repo and it's done.
2. We need a GCP project to be able to run the gcloud functions runtimes list command, and we decided to use gae-runtimes-private

After this is merged and works well, we will configure the GitHub Actions for the repos for other languages, will then decide whether to put them in each repo, or find a central location.

/cc @jihuin

[jihuin]

Adding jinglun as reviewer because I don't have the permission

[jinglundong]

1. secrets.GCP_CREDENTIALS and secrets.PAT need to be uploaded to this repo

I think this is fine. It is a supported security feature of Github. I don't have concerns about secrets leaving GCP. We had previous campaigns to disallow exporting IAM secrets, but I believe it's a different requirement.

2. We need a GCP project to be able to run the gcloud functions runtimes list command, currently it's using my own dev project

Sure, we should have an official project to run these commands. We could use gae-runtimes-private.

3. Shall we add this to each repo, or is there a central location that we can put the github actions for all the repos?

I don't know for sure, but I'd assume we need to configure github actions for each repo. Let's discuss that further after we finish the required setup for this repo.

[jinglundong]

BTW, I'm still seeing this warning "The base branch requires all commits to be signed. Learn more about signing commits."

From my previous experience, I had to fix it by another git clone with the correct git SSH setting.

[chizhg]

BTW, I'm still seeing this warning "The base branch requires all commits to be signed. Learn more about signing commits."

From my previous experience, I had to fix it by another git clone with the correct git SSH setting.

Should be good now. I had to configure the signing key on my local and also upload it to my GitHub account.

I added chainguard-dev/actions/setup-gitsign@main to the GitHub Actions which seems to be able to do keyless signing.

[chizhg]

Updated to this based on the comment at GoogleCloudPlatform/functions-framework-go#177 (comment)

[chizhg]

It turns out I need to configure workflow_dispatch to be able to manually trigger the workflow - https://stackoverflow.com/questions/67523882/workflow-is-not-shown-so-i-cannot-run-it-manually-github-actions