Add automated release workflow for multi-platform builds (#118)

* feat: add binary release workflow on tag push

Build cross-platform binaries (linux/darwin amd64+arm64, windows amd64)
and publish them as a GitHub release with checksums when a v* tag is pushed.

https://claude.ai/code/session_01NmKfB4AJrZNBk2mjckmgjK

* fix: address zizmor security findings in release workflow

Scope contents:write permission to the release job only (not
workflow-level) and disable default Go module caching in the
build job.

https://claude.ai/code/session_01NmKfB4AJrZNBk2mjckmgjK

* fix: address review comments on release workflow

- Inject tag version into binary via -X main.version ldflags
- Add version variable to main.go with fallback to BuildInfo
- Use GITHUB_TOKEN instead of GH_TOKEN for softprops action
- Remove unused TAG env var

https://claude.ai/code/session_01NmKfB4AJrZNBk2mjckmgjK

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: jeduden

.github/workflows/release.yml

@@ -0,0 +1,70 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+          - goos: linux
+            goarch: arm64
+          - goos: darwin
+            goarch: amd64
+          - goos: darwin
+            goarch: arm64
+          - goos: windows
+            goarch: amd64
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: go.mod
+          cache: false
+      - name: Build
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          VERSION: ${{ github.ref_name }}
+        run: |
+          ext=""
+          if [ "$GOOS" = "windows" ]; then ext=".exe"; fi
+          bin="mdsmith-${GOOS}-${GOARCH}${ext}"
+          go build -trimpath -ldflags="-s -w -X main.version=${VERSION}" -o "$bin" ./cmd/mdsmith
+          echo "bin=$bin" >> "$GITHUB_ENV"
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: mdsmith-${{ matrix.goos }}-${{ matrix.goarch }}
+          path: ${{ env.bin }}
+
+  release:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          merge-multiple: true
+      - name: Create checksums
+        run: sha256sum mdsmith-* > checksums.txt
+      - name: Create release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
+        with:
+          generate_release_notes: true
+          files: |
+            mdsmith-*
+            checksums.txt

cmd/mdsmith/main.go

@@ -120,12 +120,18 @@ func run() int {
 	}
 }
 
+// version is set via ldflags at build time (e.g. -X main.version=v1.0.0).
+var version string
+
 func printVersion() {
-	version := "(devel)"
-	if info, ok := debug.ReadBuildInfo(); ok && info.Main.Version != "" {
-		version = info.Main.Version
+	v := version
+	if v == "" {
+		v = "(devel)"
+		if info, ok := debug.ReadBuildInfo(); ok && info.Main.Version != "" {
+			v = info.Main.Version
+		}
 	}
-	fmt.Printf("mdsmith %s\n", version)
+	fmt.Printf("mdsmith %s\n", v)
 }
 
 // runCheck implements the "check" subcommand: lint files.