ci: add release workflow with versioned binary names

Add a 'release' matrix job that cross-compiles via Burrito on
each platform, renames the output to a versioned, platform-
tagged convention, and uploads the artifacts.

New naming convention (replaces ado_linux, ado_macos, etc.):
  ado-0.1.0-linux-x86_64
  ado-0.1.0-linux-aarch64
  ado-0.1.0-macos-aarch64
  ado-0.1.0-macos-x86_64
  ado-0.1.0-windows-x86_64.exe

Changes:

1. .github/workflows/ci.yml:
   - Trigger release on push to main OR on tag push (v*).
   - 5-way matrix (linux x86_64, linux arm64, macos aarch64,
     macos x86_64, windows x86_64) running on native runners.
   - Rename step normalizes Burrito's ado_<target>{,.exe} output
     to the stable ado-<version>-<os>-<arch>{,.exe} form.
   - Smoke test runs each binary's --version or --help.
   - Artifacts uploaded per-platform with 90-day retention.

2. .github/workflows/ci.yml (release-attach job):
   - Runs on tag push only.
   - Downloads all release artifacts, creates a GitHub Release
     with a markdown table of all supported platforms.
   - Attaches every binary to the release.

3. justfile:
   - release / release-fast now call release-rename after mix release
   - New 'release-rename' recipe (also callable standalone) reads
     version from mix.exs and maps Burrito target names to
     {os}-{arch} suffixes. Used by both the justfile and CI.

4. bin/sign.sh:
   - Looks up the renamed binary (ado-<version>-macos-aarch64)
     first, falls back to legacy ado_macos for older artifacts.
   - Bash syntax checked.

Verified locally: just release-rename produces the expected
filenames; the renamed macOS binary runs './ado --help' cleanly.

162 tests pass. mix ci green. actionlint clean.

Author: gilbertwong96

.github/workflows/ci.yml

@@ -3,6 +3,7 @@ name: CI
 on:
   push:
     branches: [main, "feature/*", "fix/*"]
+    tags: ["v*"]
   pull_request:
     branches: [main]
   workflow_dispatch:
@@ -176,3 +177,183 @@ jobs:
           echo "Linux result: ${{ needs.linux.result }}"
           echo "macOS result: ${{ needs.macos.result }}"
           exit 1
+
+  # ── Release build: cross-compile via Burrito, rename, upload artifacts ─
+  release:
+    name: "Release · Burrito · ${{ matrix.label }}"
+    # Only build releases on pushes to main (not on PRs) and on tag pushes.
+    # Use workflow_dispatch to trigger manually for ad-hoc builds.
+    if: |
+      github.event_name == 'push' &&
+      (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))
+    needs: [ci-status]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      # Don't cancel other platforms if one fails — we want all
+      # binaries even if e.g. macOS signing fails.
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: linux
+            cpu: x86_64
+            ext: ""
+            label: "Linux x86_64"
+            artifact: ado-linux-x86_64
+          - os: ubuntu-latest
+            target: linux_arm
+            cpu: aarch64
+            ext: ""
+            label: "Linux ARM64"
+            artifact: ado-linux-aarch64
+          - os: macos-latest
+            target: macos
+            cpu: aarch64
+            ext: ""
+            label: "macOS Apple Silicon"
+            artifact: ado-macos-aarch64
+          - os: macos-latest
+            target: macos_x86
+            cpu: x86_64
+            ext: ""
+            label: "macOS Intel"
+            artifact: ado-macos-x86_64
+          - os: windows-latest
+            target: windows
+            cpu: x86_64
+            ext: ".exe"
+            label: "Windows x86_64"
+            artifact: ado-windows-x86_64
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Elixir
+        uses: erlef/setup-beam@v1
+        with:
+          otp-version: ${{ env.OTP_VERSION }}
+          elixir-version: ${{ env.ELIXIR_VERSION }}
+
+      - name: Cache build artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            _build
+            deps
+            priv/plts
+          key: release-${{ runner.os }}-${{ hashFiles('**/mix.lock') }}
+          restore-keys: |
+            release-${{ runner.os }}-
+
+      - name: Install dependencies
+        run: mix deps.get
+
+      - name: Build Burrito release
+        env:
+          MIX_ENV: prod
+        # Burrito writes binaries to burrito_out/<target-key> by
+        # convention. We rename the output below to a stable,
+        # versioned name.
+        run: |
+          mkdir -p release_bin
+          mix release --overwrite --target ${{ matrix.target }}
+          ls -lh burrito_out/
+
+      - name: Get version
+        id: version
+        run: |
+          # Read the version from mix.exs so the release artifact name
+          # always matches the source of truth.
+          VERSION=$(grep -E '^\s*version:\s*"' mix.exs | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Rename binary
+        # Normalize the binary name to:
+        #   ado-<version>-<os>-<arch><.exe?>
+        # e.g. ado-0.1.0-macos-aarch64
+        #      ado-0.1.0-linux-x86_64
+        #      ado-0.1.0-windows-x86_64.exe
+        run: |
+          set -euo pipefail
+          VERSION="${{ steps.version.outputs.version }}"
+          # Map matrix.target to a clean {os}-{arch} string
+          case "${{ matrix.target }}" in
+            linux)      SUFFIX="linux-x86_64" ;;
+            linux_arm)  SUFFIX="linux-aarch64" ;;
+            macos)      SUFFIX="macos-aarch64" ;;
+            macos_x86)  SUFFIX="macos-x86_64" ;;
+            windows)    SUFFIX="windows-x86_64" ;;
+            *)          echo "::error::Unknown target ${{ matrix.target }}"; exit 1 ;;
+          esac
+          OUT_NAME="ado-${VERSION}-${SUFFIX}${{ matrix.ext }}"
+          SRC="burrito_out/ado_${{ matrix.target }}${{ matrix.ext }}"
+          DEST="release_bin/${OUT_NAME}"
+          if [[ ! -f "${SRC}" ]]; then
+            echo "::error::Expected Burrito output not found: ${SRC}"
+            ls -lh burrito_out/
+            exit 1
+          fi
+          mv "${SRC}" "${DEST}"
+          chmod +x "${DEST}"
+          echo "Renamed ${SRC} -> ${DEST}"
+          ls -lh release_bin/
+
+      - name: Smoke test the binary
+        run: |
+          set -euo pipefail
+          # Glob is intentional here — there's exactly one file in
+          # the dir, but actionlint warns about unquoted globs.
+          BINARY=$(ls release_bin/ado-*)
+          echo "Testing $BINARY"
+          "$BINARY" --version || "$BINARY" --help | head -20
+
+      - name: Upload release binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.artifact }}
+          path: release_bin/ado-*
+          retention-days: 90
+          if-no-files-found: error
+
+  # ── Attach binaries to GitHub Release on tag push ──────────────────
+  release-attach:
+    name: Publish GitHub Release
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [release]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist/
+          merge-multiple: true
+
+      - name: Display downloaded artifacts
+        run: ls -lh dist/
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: "AdoCli ${{ github.ref_name }}"
+          body: |
+            ## AdoCli ${{ github.ref_name }}
+
+            Pre-built binaries for all supported platforms.
+
+            | Platform | Architecture | Binary |
+            |----------|--------------|--------|
+            | Linux | x86_64 | `ado-*-linux-x86_64` |
+            | Linux | aarch64 | `ado-*-linux-aarch64` |
+            | macOS | Apple Silicon | `ado-*-macos-aarch64` |
+            | macOS | Intel | `ado-*-macos-x86_64` |
+            | Windows | x86_64 | `ado-*-windows-x86_64.exe` |
+
+            See [README.md](https://github.com/gilbertwong96/ado_cli) for
+            installation instructions.
+          draft: false
+          prerelease: false
+          files: |
+            dist/ado-*

bin/sign.sh

@@ -36,7 +36,22 @@ set -euo pipefail
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 BURRITO_OUT="$ROOT/burrito_out"
-BINARY="$BURRITO_OUT/ado_macos"
+# Use the renamed binary (versioned, e.g. ado-0.1.0-macos-aarch64).
+# If only the legacy Burrito name is present (ado_macos), use that as
+# a fallback so the script keeps working on older release artifacts.
+VERSION=$(grep -E '^\s*version:\s*"' "$ROOT/mix.exs" | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
+NEW_BINARY="$BURRITO_OUT/ado-${VERSION}-macos-aarch64"
+LEGACY_BINARY="$BURRITO_OUT/ado_macos"
+if [[ -f "$NEW_BINARY" ]]; then
+  BINARY="$NEW_BINARY"
+elif [[ -f "$LEGACY_BINARY" ]]; then
+  BINARY="$LEGACY_BINARY"
+else
+  printf '\033[1;31mxx  macOS binary not found: tried %s and %s\033[0m\n' \
+    "$NEW_BINARY" "$LEGACY_BINARY" >&2
+  printf '    Run '\''just release'\'' first.\n' >&2
+  exit 1
+fi
 
 MACOS_SIGN_IDENTITY="${MACOS_SIGN_IDENTITY:-}"
 MACOS_KEYCHAIN_PROFILE="${MACOS_KEYCHAIN_PROFILE:-}"

justfile

@@ -47,16 +47,21 @@ run +args:
 # ── Burrito Release ────────────────────────────────────────────────────
 
 # Build Burrito release for all targets (clears cache first)
+# Output: burrito_out/ado_<target>{,.exe}, then renames to
+#         burrito_out/ado-<version>-<os>-<arch>{,.exe} for stable naming.
 release:
     rm -rf ~/Library/Application\ Support/.burrito/ado*
     rm -rf _build/prod
     MIX_ENV=prod mix release --overwrite
+    @just release-rename
     @echo "→ burrito_out/"
 
 # Build Burrito release without clearing cache (faster, for minor changes)
 release-fast:
     rm -rf _build/prod
     MIX_ENV=prod mix release --overwrite
+    @just release-rename
+    @echo "→ burrito_out/"
 
 # Clear Burrito cache only
 release-clean:
@@ -66,6 +71,38 @@ release-clean:
 release-list:
     @ls -lh burrito_out/
 
+# Rename Burrito's ado_<target>{,.exe} binaries to the versioned,
+# platform-tagged naming convention used by the CI release workflow:
+#   ado-<version>-linux-x86_64
+#   ado-<version>-linux-aarch64
+#   ado-<version>-macos-aarch64
+#   ado-<version>-macos-x86_64
+#   ado-<version>-windows-x86_64.exe
+# Original Burrito outputs are removed.
+release-rename:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    VERSION=$(grep -E '^\s*version:\s*"' mix.exs | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
+    for src in burrito_out/ado_*; do
+      [[ -f "$src" ]] || continue
+      base=$(basename "$src")
+      ext=""
+      [[ "$base" == *.exe ]] && ext=".exe"
+      key="${base%.exe}"
+      key="${key#ado_}"
+      case "$key" in
+        linux)     SUFFIX="linux-x86_64" ;;
+        linux_arm) SUFFIX="linux-aarch64" ;;
+        macos)     SUFFIX="macos-aarch64" ;;
+        macos_x86) SUFFIX="macos-x86_64" ;;
+        windows)   SUFFIX="windows-x86_64" ;;
+        *) echo "::warn::Unknown Burrito target: $key (no rename rule)"; continue ;;
+      esac
+      dest="burrito_out/ado-${VERSION}-${SUFFIX}${ext}"
+      mv "$src" "$dest"
+      echo "renamed $src -> $dest"
+    done
+
 # Build, sign, and notarize the macOS binary. See bin/sign.sh for env vars.
 release-macos:
     @just release