release.yml

# On a v* tag: publish a GitHub release object for that tag, with install.sh
# attached as an asset.
#
# There is no artifact to build — netmon installs from source at the tag — but
# the release must carry install.sh: the documented bootstrap fetches it from
# /releases/latest/download/install.sh, because unauthenticated
# raw.githubusercontent.com fetches are rate-limited per IP while release-asset
# downloads are not. The release also gives install.sh an authoritative
# "latest" (GitHub's /releases/latest excludes drafts and prereleases) via its
# redirect, and gives the CHANGELOG links somewhere to resolve.
#
# No one-time setup: the workflow's own token may write releases via
# `permissions` below. Actions reads this workflow from the tagged commit,
# not from main.
name: release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: notes
        run: sh scripts/changelog-notes.sh "$GITHUB_REF_NAME" > release-notes.md
      - name: publish
        uses: softprops/action-gh-release@v3
        with:
          body_path: release-notes.md
          files: install.sh
          # Explicit: a release left drafted serves nothing — /releases/latest
          # excludes drafts, so install.sh and the updater would 404.
          draft: false