chore: explicit oprf-node release

[paolodamico]

Introduces an explicit workflow to generate and publish releases to the oprf-node images, instead of building on every push to main.

---

Note

Medium Risk
Moderate risk because it changes CI/CD behavior for oprf-node, including tagging/releases and container publishing conditions, which could impact delivery if misconfigured.

Overview
Stops building/publishing the oprf-node image as part of the generic build-docker matrix, leaving only indexer and gateway there.

Adds two GitHub Actions workflows for oprf-node: a manual Prepare OPRF Node Release workflow that opens a release-plz release PR, and an on-main Publish OPRF Node Release workflow that detects a services/oprf-node/Cargo.toml version bump, creates the GitHub release/tag, and then builds/attests and pushes ghcr.io/.../world-id-oprf-node with latest and version tags.

Bumps world-id-oprf-node from 0.1.0 to 0.2.0 (workspace + lockfile), marks the crate publish = false, and introduces services/oprf-node release metadata/docs (release-plz.toml, CHANGELOG.md, README.md).

^{Reviewed by Cursor Bugbot for commit ada9887. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 79b5f135e7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ada9887. Configure here.}

[cursor]

pipefail causes script exit on unreachable BEFORE_SHA

Low Severity

With set -euo pipefail, if git show fails (e.g., BEFORE_SHA is unreachable after a force push or is the null SHA), the pipeline's exit status propagates as non-zero due to pipefail. Since before_version="$(failing_pipeline)" is a simple variable assignment, set -e causes the script to exit immediately rather than continuing to the [ -z "$before_version" ] check that was clearly designed to handle this case gracefully. The 2>/dev/null only suppresses stderr, not the exit code.

 

^{Reviewed by Cursor Bugbot for commit ada9887. Configure here.}