Can we produce stable download artifacts?

@rickeylev had this suggestion:

The github /archive/ urls aren't guaranteed to have stable hashes. Github has changed their hashing twice and plans to do it again in the next year or so. It does violate a best practice to ensure remote artifacts aren't being tampered with.

There are probably github docs about how to do this somewhere. What it means is, when creating a "github release", a file of the source is attached to it, much like you'd attach some built library you wanted to make directly download.

In rules_python, we do this automatically using an action:

https://github.com/bazelbuild/rules_python/blob/677fb53a16d65082729be927dafd3a45fafa04c5/.github/workflows/release.yml#L40-L46

The prior "create_archive_and_notes.sh" creates the tar.gz file, and that action-gh-release action uploads the file into the "github release".

If you're doing manual releases, then it means you edit the release, and upload/attach the file to it.

Start by reviewing the existing release process and the referenced rules_python .github/workflows/release.yml example, including create_archive_and_notes.sh and action-gh-release. The work is done when each GitHub release includes an attached source archive with stable contents instead of relying on /archive/ URLs.