Add a release workflow that builds binaries on tag push

Pushing a v* tag cross-compiles static binaries (linux/darwin/windows,
amd64/arm64), packages them with SHA256 checksums, and publishes a
GitHub Release. The tag name is stamped into the binary via -ldflags,
surfaced through a new -version flag.

Author: splitbrain

.github/workflows/release.yml

@@ -0,0 +1,90 @@
+name: Release
+
+# Build cross-platform binaries and publish a GitHub Release whenever a
+# version tag (e.g. v1.2.3) is pushed.
+on:
+  push:
+    tags:
+      - "v*"
+
+# Required for softprops/action-gh-release to create the release.
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { goos: linux, goarch: amd64 }
+          - { goos: linux, goarch: arm64 }
+          - { goos: darwin, goarch: amd64 }
+          - { goos: darwin, goarch: arm64 }
+          - { goos: windows, goarch: amd64 }
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build
+        env:
+          CGO_ENABLED: "0"
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          VERSION: ${{ github.ref_name }}
+        run: |
+          bin=k8tc
+          [ "$GOOS" = windows ] && bin=k8tc.exe
+          # Static, trimmed, version-stamped — mirrors the Makefile's flags,
+          # plus -s -w to strip debug info for a smaller release binary.
+          go build -trimpath -ldflags "-s -w -X main.version=${VERSION}" -o "$bin" ./cmd/k8tc
+
+      - name: Package
+        id: package
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          VERSION: ${{ github.ref_name }}
+        run: |
+          name="k8tc_${VERSION}_${GOOS}_${GOARCH}"
+          if [ "$GOOS" = windows ]; then
+            zip "${name}.zip" k8tc.exe README.md
+            echo "asset=${name}.zip" >> "$GITHUB_OUTPUT"
+          else
+            tar -czf "${name}.tar.gz" k8tc README.md
+            echo "asset=${name}.tar.gz" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ steps.package.outputs.asset }}
+          path: ${{ steps.package.outputs.asset }}
+          if-no-files-found: error
+
+  release:
+    name: Publish release
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+
+      - name: Generate checksums
+        working-directory: dist
+        run: sha256sum * > SHA256SUMS
+
+      - name: Create release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/*
+          generate_release_notes: true
+          fail_on_unmatched_files: true

cmd/k8tc/main.go

@@ -19,6 +19,10 @@ import (
 	"github.com/cosmocode/k8tc/internal/ui"
 )
 
+// version is the build version, stamped at release time via
+// -ldflags "-X main.version=<tag>". It is "dev" for local builds.
+var version = "dev"
+
 func main() {
 	var (
 		kubeContext string
@@ -28,6 +32,7 @@ func main() {
 		remotePath  string
 		localPath   string
 		preserve    bool
+		showVersion bool
 	)
 
 	flag.StringVar(&kubeContext, "context", "", "kube context (kubectl --context); default current")
@@ -41,8 +46,14 @@ func main() {
 	flag.BoolVar(&preserve, "preserve-ownership", false,
 		"attempt to restore owner UID/GID on extract (--same-owner --numeric-owner); "+
 			"only effective against a privileged extract target")
+	flag.BoolVar(&showVersion, "version", false, "print version and exit")
 	flag.Parse()
 
+	if showVersion {
+		fmt.Println("k8tc", version)
+		return
+	}
+
 	// Fail fast if kubectl is missing rather than surfacing it on first list.
 	if _, err := exec.LookPath("kubectl"); err != nil {
 		fmt.Fprintln(os.Stderr, "error: kubectl not found on PATH")