ci: add Slack release notification to on-tag workflow

Author: mchmarny

.github/workflows/on-tag.yaml

@@ -411,14 +411,40 @@ jobs:
             --repo "${REPO}" \
             --ref main
 
+  # =============================================================================
+  # Notify: Post release announcement to Slack
+  # =============================================================================
+
+  notify:
+    name: Slack Notification
+    runs-on: ubuntu-latest
+    needs: [publish]
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Post to Slack
+        env:
+          SLACK_SERVICE: ${{ secrets.SLACK_SERVICE }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
+          SERVER: ${{ github.server_url }}
+        run: |
+          set -euo pipefail
+          RELEASE_URL="${SERVER}/${REPO}/releases/tag/${TAG}"
+          curl -sSf -X POST \
+            -H 'Content-type: application/json' \
+            --data "{\"text\":\"AICR ${TAG} has been released: ${RELEASE_URL}\"}" \
+            "https://hooks.slack.com/services/${SLACK_SERVICE}"
+
   # =============================================================================
   # Summary: Release pipeline report (always runs, even on failure)
   # =============================================================================
 
   summary:
     name: Release Summary
     runs-on: ubuntu-latest
-    needs: [tests, build-ko, build-docker, docker-manifest, image-vuln-scan, attest, release-check, deploy, publish, site]
+    needs: [tests, build-ko, build-docker, docker-manifest, image-vuln-scan, attest, release-check, deploy, publish, site, notify]
     if: always()
     timeout-minutes: 5
     permissions:
@@ -436,6 +462,7 @@ jobs:
           DEPLOY: ${{ needs.deploy.result }}
           PUBLISH: ${{ needs.publish.result }}
           SITE: ${{ needs.site.result }}
+          NOTIFY: ${{ needs.notify.result }}
           TAG: ${{ github.ref_name }}
           COMMIT: ${{ github.sha }}
         run: |
@@ -457,4 +484,5 @@ jobs:
             echo "| Deploy | ${DEPLOY} |"
             echo "| Publish | ${PUBLISH} |"
             echo "| Site | ${SITE} |"
+            echo "| Slack Notification | ${NOTIFY} |"
           } >> "$GITHUB_STEP_SUMMARY"