If your adversary is a nation state actor, and you need to ask this question on StackExchange, then you're doing it wrong. You cannot be "100% safe" from a determined, powerful adversary. While it's fallacious to say "if they want you, they'll get you", it is true that you cannot be 100% safe from any powerful adversary. They will always have 0days that you are not aware of, and will be tapping infrastructure you are not aware of.
1 Which OS? Windows 10, Linux, Qubes, Whonix etc, or use Whonix inside of Qubes? which the most secure? If Linux which version? How the best to configure it?
That depends on your threat model. Qubes is great for mitigating hardware-type attacks (such as a compromised NIC), but it uses the quite vulnerable Xen and has other nasty configuration issues, such as running with NOPASSWD sudo (which allows anyone to get root without a password). Whonix is good for a very specific threat model (IP disclosure), but when run in a VM rather than on physical hardware, you negate much of the benefit. The Russian government absolutely has VM escape 0days.
2 Then need to install virtual machine on it? which one?
Different VMs have different strengths and weaknesses. They can all be compromised with enough resources. QEMU for example runs in userspace, which allows it to be sandboxed via a command line option. The virtualization is done in the kernel by KVM, which is pretty secure. However QEMU is also buggy (as are all VMs), so unless it is being sandboxed and is using a chroot, it can be an issue.
3 Then which third party programs I need on it?
Not sure what you mean. It depends on your threat model. Use whatever well-regarded programs give you the features you require. Tails has many programs which are sandboxed for security, and which provide you with a decent amount of productivity software (audio editors, text editors, spreadsheet programs, collaboration programs, etc).
You do not want to use things like VPNs. Even if you trust the VPN provider, the technology was not designed for anonymity. In fact, the "private" in VPN is referring to IANA-reserved private addresses, not the right to privacy. They are designed to allow connecting two virtual network interfaces together, especially to get on a corporate network. They have been abused by companies that want your money by advertising the fact that their name has "private" in it, and that they do hide your IP against any naive adversary.
4 What browser to use? If TOR - What’s the best Configuration for TOR browser? As I know just using TOR browser is not enough they still can find you. and Use China server?
It's Tor, not TOR. And the best configuration is simply setting the security slider to high. This will disable JavaScript and certain other risky features. In contrast with what the other answer says, Tor was neither created by the government nor given away by them. The concept of onion routing was created by the Navy. Tor itself was created by Roger Dingledine. The computer mouse was created by DARPA, but that does not mean that your little Lenovo mouse is from the government!
While Tor itself is quite effective (so don't change its configuration!), Tor Browser is based on Firefox, which is not a perfect browser. However, it is the only browser that provides fingerprinting defense. There are 0days that governments and government contractors have that can compromise the browser, and if the browser is compromised, it can bypass Tor by connecting directly to a government-controlled server. There is no way to avoid this with complete certainty.
5 Need Antivirus? Antispyware? Which one?
This is actually harmful. AV is fine for low-level threats that are already known in the wild, but advanced malware can take advantage of an AV, compromising it to elevate privileges. AV software runs with high privileges, parsing any attacker-controlled data you throw at it. This is a recipe for disaster.
I guess that’'s should be enough?
Nope. If you're not using a hardened kernel with heavy monitoring and extensive syscall filters, you aren't even close to good enough. Protecting against a nation state adversary who is determined to attack you and is willing to spend plenty of resources on you requires expertise, many years of expertise. It would take me months and hundreds of pages worth of answers to even provide you with the basics. This is why threat modeling is so important. It allows you to determine who your adversary is, what their capabilities are, what their resources are, and what assets they are after. This makes it easier to protect yourself.
Thanks a lot for saving my ass.
Honestly, the Russian government will not be spending a lot of money to get you. You can raise the bar a good bit by using things like Whonix (on real hardware), Tails, or Qubes, but none of that is perfect.
You need to define a threat model. To expand a bit on your implied threat model regarding "posting some documents on the internet", that makes it a lot easier. For example, you won't have to worry too much about exploits, unless you tell everywhere where you are posting the documents to or stay a long time, giving the chance to attack you. When posting documents, the threat model involves avoiding retroactive tracking, with the assets not being your computer resources or anything like that, but simply your identity. Your adversary will only be able to target you after you post documents, not before, so you do not need to worry about them lying in wait with a 0day exploit to use against you. Using Tails is perfect for this, as it not only is amnesic and such resists forensic attacks, but it is designed to be fool-proof for anonymity, making it extremely difficult to shoot yourself in the foot. Keep those documents on an encrypted flash drive, use Tails to upload them (e.g. to Wikileaks), then get rid of the flash drive and move on with your life.
