instruction: Create a GitHub Actions workflow for CI/CD automation with automated testing
output: ## api-release.yml
  
  **Repository:** containerd/containerd
  **File Type:** Github Workflow
  **Purpose:** Production configuration from containerd project
  
  ```yaml
  on:
    push:
      tags:
        - "api/v*" # Push events to matching api/v*, i.e. api/v1.0, api/v20.15.10
  
  name: API Release
  
  env:
    GO_VERSION: "1.24.6"
  
  permissions: # added using https://github.com/step-security/secure-workflows
    contents: read
  
  jobs:
    check:
      name: Check Signed Tag
      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/api/v')
      runs-on: ubuntu-24.04
      timeout-minutes: 5
      outputs:
        stringver: ${{ steps.contentrel.outputs.stringver }}
  
      steps:
        - name: Checkout code
          uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
          with:
            ref: ${{ github.ref }}
            path: src/github.com/containerd/containerd
  
        - name: Check signature
          run: |
            releasever=${{ github.ref }}
            releasever="${releasever#refs/tags/}"
            TAGCHECK=$(git tag -v ${releasever} 2>&1 >/dev/null) ||
            echo "${TAGCHECK}" | grep -q "error" && {
                echo "::error::tag ${releasever} is not a signed tag. Failing release process."
                exit 1
            } || {
                echo "Tag ${releasever} is signed."
                exit 0
            }
          working-directory: src/github.com/containerd/containerd
  
        - name: Release content
          id: contentrel
          run: |
            RELEASEVER=${{ github.ref }}
            echo "stringver=${RELEASEVER#refs/tags/api/v}" >> $GITHUB_OUTPUT
            git tag -l ${RELEASEVER#refs/tags/} -n20000 | tail -n +3 | cut -c 5- >release-notes.md
          working-directory: src/github.com/containerd/containerd
  
        - name: Save release notes
          uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
          with:
            name: containerd-release-notes
            path: src/github.com/containerd/containerd/release-notes.md
  
    release:
      name: Create containerd Release
      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/api/v')
      permissions:
        contents: write
      runs-on: ubuntu-24.04
      timeout-minutes: 10
      needs: [check]
      steps:
        - name: Download release notes
          uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
          with:
            path: builds
        - name: Create Release
          uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
          with:
            token: ${{ secrets.GITHUB_TOKEN }}
            fail_on_unmatched_files: true
            name: containerd API ${{ needs.check.outputs.stringver }}
            draft: false
            make_latest: false
            prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'rc') }}
            body_path: ./builds/containerd-release-notes/release-notes.md
  
  ```
  
  This GitHub Actions workflow demonstrates production CI/CD practices including automated testing, building, and deployment.