add release instructions (#21)

Signed-off-by: Brian DeHamer <[email protected]>

RELEASE.md

@@ -0,0 +1,30 @@
+# Release Instructions
+
+Follow the steps below to tag a new release for the
+`actions/attest-sbom` action.
+
+If changes were made to the internal `actions/attest-sbom/predicate`
+action (any updates to [`./predicate/action.yaml`](./predicate/action.yml) or
+any of the code in the [`./src`](./src) directory), start with step #1;
+otherwise, skip directly to step #5.
+
+1. Merge the latest changes to the `main` branch.
+1. Create and push a new predicate tag of the form `[email protected]` following
+   SemVer conventions:
+
+   ```shell
+   git tag -a "[email protected]" -m "[email protected] Release"
+   git push --tags
+   ```
+
+1. Update the reference to the `actions/attest-sbom/predicate`
+   action in [`action.yml`](./action.yml) to point to the SHA of the newly
+   created tag.
+1. Push the `action.yml` change and open a PR. Once it has been reviewed, merge
+   the PR and proceed with the release instructions.
+1. Create a new release for the top-level action using a tag of the form
+   `vX.X.X` following SemVer conventions:
+
+   ```shell
+   gh release create vX.X.X
+   ```