CWG-75: Protect Gitlab secrets, raise awareness

Closes CWG-75

{{cookiecutter.project_slug}}/.gitlab-ci.yml

@@ -129,10 +129,21 @@ pages:
     paths:
       - build/doc/*
 
+release_job:
+  stage: publish
+  image: registry.gitlab.com/gitlab-org/release-cli:latest
+  rules:
+    - if: '$CI_COMMIT_TAG && $CI_COMMIT_REF_PROTECTED == "true"'
+  script:
+    - echo "running release_job"
+  release:
+    tag_name: '$CI_COMMIT_TAG'
+    description: '$CI_COMMIT_TAG'
+
 abi-deploy:
   stage: publish
   needs: ["trigger_prepare"]
-  environment: production
+  environment: abi
   script:
     - cmake --version
     - mkdir build && cd build
@@ -143,4 +154,5 @@ abi-deploy:
     # The syntax is described at https://docs.gitlab.com/ee/user/packages/generic_packages/index.html
     - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file ${APPLICATION_LAST_RELEASE}.dump "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/ABI/${APPLICATION_LAST_RELEASE}/abi.dump"'
   rules:
-    -  when: manual
+    - if: '$CI_COMMIT_TAG && $CI_COMMIT_REF_PROTECTED == "true"'
+    - when: manual