ci: add GitHub release workflow

Author: ComputelessComputer

.github/workflows/release.yml

@@ -0,0 +1,80 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag, for example v0.1.0"
+        required: true
+        type: string
+
+concurrency:
+  group: release-${{ github.workflow }}-${{ github.ref || inputs.tag }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: macos-15
+    permissions:
+      contents: write
+    timeout-minutes: 30
+    env:
+      GH_TOKEN: ${{ github.token }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Resolve tag
+        id: meta
+        shell: bash
+        run: |
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+            TAG="${{ inputs.tag }}"
+          else
+            TAG="${GITHUB_REF_NAME}"
+          fi
+
+          if [[ -z "${TAG}" ]]; then
+            echo "Tag is required" >&2
+            exit 1
+          fi
+
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+
+      - name: Show toolchain
+        run: |
+          swift --version
+          xcodebuild -version
+
+      - name: Build release binaries
+        run: swift build -c release
+
+      - name: Package release artifacts
+        run: |
+          chmod +x scripts/package-release.sh
+          scripts/package-release.sh "${{ steps.meta.outputs.tag }}" dist
+
+      - name: Publish GitHub release
+        shell: bash
+        run: |
+          TAG="${{ steps.meta.outputs.tag }}"
+          ARCHIVE="dist/openbird-${TAG}-macos-arm64.tar.gz"
+          CHECKSUM="dist/openbird-${TAG}-macos-arm64.sha256"
+
+          if gh release view "${TAG}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
+            gh release upload "${TAG}" "$ARCHIVE" "$CHECKSUM" --clobber --repo "${GITHUB_REPOSITORY}"
+          else
+            gh release create "${TAG}" \
+              "$ARCHIVE" \
+              "$CHECKSUM" \
+              --target "${GITHUB_SHA}" \
+              --title "${TAG}" \
+              --generate-notes \
+              --repo "${GITHUB_REPOSITORY}"
+          fi

README.md

@@ -47,3 +47,17 @@ GitHub Actions runs the package build and test workflow on:
 - pushes to `main`
 - pull requests
 - manual runs from the Actions tab via `workflow_dispatch`
+
+## Releases
+
+GitHub Actions also publishes release artifacts from `.github/workflows/release.yml`.
+
+- push a tag like `v0.1.0`, or
+- run the `Release` workflow manually and provide a tag
+
+Each release uploads:
+
+- `openbird-<tag>-macos-arm64.tar.gz`
+- `openbird-<tag>-macos-arm64.sha256`
+
+The release archive currently contains unsigned SwiftPM release binaries for `OpenbirdApp` and `OpenbirdCollector`.

scripts/package-release.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ $# -ne 2 ]]; then
+  echo "usage: $0 <tag> <output-dir>" >&2
+  exit 1
+fi
+
+TAG="$1"
+OUTPUT_DIR="$2"
+BUILD_DIR=".build/arm64-apple-macosx/release"
+STAGE_DIR="${OUTPUT_DIR}/openbird-${TAG}-macos-arm64"
+ARCHIVE_BASENAME="openbird-${TAG}-macos-arm64"
+
+mkdir -p "$OUTPUT_DIR"
+rm -rf "$STAGE_DIR"
+mkdir -p "$STAGE_DIR"
+
+cp "$BUILD_DIR/OpenbirdApp" "$STAGE_DIR/"
+cp "$BUILD_DIR/OpenbirdCollector" "$STAGE_DIR/"
+cp README.md "$STAGE_DIR/"
+
+cat > "$STAGE_DIR/RELEASE.txt" <<EOF
+Openbird ${TAG}
+
+Included artifacts:
+- OpenbirdApp
+- OpenbirdCollector
+
+These are unsigned macOS arm64 release binaries built via SwiftPM.
+EOF
+
+(
+  cd "$OUTPUT_DIR"
+  tar -czf "${ARCHIVE_BASENAME}.tar.gz" "${ARCHIVE_BASENAME}"
+  shasum -a 256 "${ARCHIVE_BASENAME}.tar.gz" > "${ARCHIVE_BASENAME}.sha256"
+)