feat: add GitHub Releases with changelog on version tags (#3)

- Add release job to docker workflow: verifies package.json version
  matches the tag, extracts changelog, creates GitHub Release
- Add `latest` Docker tag on version tag pushes
- Add CHANGELOG.md with Keep a Changelog format
- Add CLAUDE.md documenting dev workflow and release process

Author: Kukks

.github/workflows/docker.yml

@@ -43,6 +43,7 @@ jobs:
             type=ref,event=branch
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
             type=sha
 
       - name: Build and push
@@ -55,3 +56,46 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Extract version from tag
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Verify package.json version matches tag
+        run: |
+          pkg_version=$(node -p "require('./package.json').version")
+          tag_version="${{ steps.version.outputs.version }}"
+          if [ "$pkg_version" != "$tag_version" ]; then
+            echo "::error::package.json version ($pkg_version) does not match tag ($tag_version)"
+            exit 1
+          fi
+
+      - name: Extract changelog for this version
+        id: changelog
+        run: |
+          version="${{ steps.version.outputs.version }}"
+          # Extract the section between this version header and the next version header (or EOF)
+          changelog=$(awk "/^## \[?${version//./\\.}\]?/{found=1; next} /^## \[?[0-9]/{if(found) exit} found{print}" CHANGELOG.md)
+          if [ -z "$changelog" ]; then
+            changelog="No changelog entry found for v${version}."
+          fi
+          # Write to file to avoid delimiter issues
+          echo "$changelog" > /tmp/release-notes.md
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ github.ref_name }}" \
+            --title "${{ github.ref_name }}" \
+            --notes-file /tmp/release-notes.md

CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## 0.1.0
+
+### Added
+- LNURL-pay service with SSE-based wallet sessions (LUD-06)
+- Amountless Lightning receives via reverse swaps
+- Reusable sessions: wallet sends a token, server derives a deterministic sessionId via SHA-256
+- Session hijack prevention by construction (different tokens always produce different sessionIds)
+- Token-based authentication for invoice endpoints
+- Multi-arch Docker image (amd64 + arm64) published to GHCR
+- Input validation for token (hex, minimum length)
+- Comment passthrough to wallet via SSE events

CLAUDE.md

@@ -0,0 +1,51 @@
+# lnurl-server
+
+LNURL-pay service for amountless Lightning receives via Arkade wallet reverse swaps.
+
+## Development
+
+```bash
+pnpm dev          # start dev server with hot reload
+pnpm build        # build with tsup
+pnpm test         # run tests
+pnpm type-check   # typecheck without emitting
+```
+
+## Testing
+
+Tests use vitest with real HTTP servers (no mocks). Each test starts a server on a random port.
+
+## Releasing
+
+Releases are triggered by pushing a semver git tag:
+
+```bash
+# 1. Update version in package.json
+# 2. Update CHANGELOG.md with the new version's changes
+# 3. Commit: "release: v0.2.0"
+# 4. Tag and push:
+git tag v0.2.0
+git push origin main --tags
+```
+
+This triggers the CI workflow which:
+- Builds and pushes Docker image to `ghcr.io/arklabshq/lnurl-server:{version}` + `latest`
+- Creates a GitHub Release with changelog content extracted from CHANGELOG.md
+- Verifies that `package.json` version matches the tag
+
+## Changelog
+
+Maintain `CHANGELOG.md` between version bumps. Add entries under an `## Unreleased` section as changes are merged. When cutting a release, rename `Unreleased` to the version number.
+
+Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/):
+- **Added** for new features
+- **Changed** for changes in existing functionality
+- **Fixed** for bug fixes
+- **Removed** for removed features
+
+## Architecture
+
+- `src/server.ts` — Express app with SSE session endpoints and LNURL-pay protocol
+- `src/session-manager.ts` — Session lifecycle, SSE streaming, invoice request/response flow
+- `src/types.ts` — Shared TypeScript types
+- `src/cli.ts` — CLI entrypoint reading config from env vars