CI: Add workflow to upload release assets

.github/workflows/build.yaml

@@ -1,7 +1,10 @@
 name: Build
 on:
   push:
+    branches: [ '**' ]
+    tags-ignore: [ 'v*', 'test-v*' ]
   pull_request:
+  workflow_call:
   workflow_dispatch:
 permissions:
   contents: read
@@ -58,7 +61,7 @@ jobs:
           make GOARCH=${{ matrix.arch }} distro.${{ matrix.type }}
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: distro-${{ matrix.type }}-${{ matrix.arch }}
           path: distro.${{ matrix.type }}

.github/workflows/release.yaml

@@ -0,0 +1,45 @@
+name: Release Artifacts
+on:
+  push:
+    tags: [ 'v*', 'test-v*' ]
+permissions:
+  contents: read
+jobs:
+  build:
+    name: Build Artifacts
+    uses: ./.github/workflows/build.yaml
+  upload:
+    name: Create Release
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # Needed to create releases.
+    steps:
+    - name: Download artifacts
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      with:
+        pattern: distro-*
+    - name: Extract artifacts
+      run: |
+        set -o errexit -o nounset -o xtrace
+        for arch in amd64 arm64; do
+          mv distro-qcow2-${arch}/distro.qcow2 distro.${GITHUB_REF_NAME}.${arch}.qcow2
+          rmdir distro-qcow2-${arch}/
+          mv distro-tar.xz-${arch}/distro.tar.xz distro.${GITHUB_REF_NAME}.${arch}.tar.xz
+          rmdir distro-tar.xz-${arch}/
+        done
+        for f in distro.*.{qcow2,tar.xz}; do
+          sha256sum "$f" > "$f.sha256"
+        done
+    - name: Create release
+      run: >-
+        gh release create
+        --title "${GITHUB_REF_NAME#test-}"
+        --draft
+        --generate-notes
+        --verify-tag
+        --repo ${{ github.repository }}
+        "${GITHUB_REF_NAME}"
+        distro.*.{qcow2,tar.xz}{,.sha256}
+      env:
+        GH_TOKEN: ${{ github.token }}

README.md

@@ -14,3 +14,9 @@ architecture as used by the [go toolchain].  This requires your docker daemon to
 be able to emulate that architecture.
 
 [go toochain]: https://go.dev/doc/install/source#environment
+
+## Release Process
+
+Push a tag of the form `v*` (or `test-v*` for testing if testing in a fork is
+not possible), and the [release workflow](.github/workflows/release.yaml) will
+create a draft release with the artifacts.