generate C++ as release artefact

[KrisThielemans]

In addition to upload to conda-forge #69, we could just upload the generated C++ files into a release. This can be automated. I found a few Actions including https://github.com/softprops/action-gh-release, https://github.com/marketplace/actions/github-upload-release-artifacts and https://cicube.io/workflow-hub/ncipollo-release-action/. The first seems the most flexible. It could be something like this

on: push

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5
      <yardl stuff and tests>
      - name: zip C++
        run: |
            cd cpp/
            zip -r ../petsird_cpp *
      - name: Release
        uses: softprops/action-gh-release@v2
        if: github.ref_type == 'tag'
        with:
          generate_release_notes: true
          files: petsird_cpp.zip

Although there's surely more to it, such as permissions.

@casperdcl @naegelejd @johnstairs could you advise?

[casperdcl]

Honestly I find:

• gh CLI very flexible and better maintained than marketplace actions
• my (well rebased) commit messages very well written
  • AI generated notes unforgivably atrocious (you may disagree)

Personally I just make draft releases with commit messages which I manually rewrite in the web interface (to be more user- rather than dev-facing) before publishing:

      run: |
        changelog=$(git log --pretty='format:%d%n- %s%n%b---' $(git tag --sort=v:refname | tail -n2 | head -n1)..HEAD)
        tag="${GITHUB_REF#refs/tags/}"
        gh release create --title "PETSIRD $tag alpha" --draft --notes "$changelog" "$tag" petsird_cpp.zip

[naegelejd]

The only marketplace action you need is softprops/action-gh-release, which is thoroughly maintained and very widely used.

You can see how we do it for MRD here to generate multiple artifacts for each release (shown here).

[casperdcl]

softprops/action-gh-release is an externally maintained JS wrapper around GH APIs (e.g. via octokit), and because of its popularity (it existed pre-gh CLI) is a very attractive candidate for supply chain attacks.

Meanwhile gh CLI is present on all runner images, is officially maintained (i.e. has some legal accountability), and has many more features.

Compare:

-- uses: softprops/action-gh-release@v2
-  with:
-    generate_release_notes: true
-    files: petsird_cpp.zip
+- run: gh release create --generate-notes "${{github.ref_name}}" petsird_cpp.zip