[WRONG BRANCH] Add tag-triggered cross-platform release workflow

.github/workflows/tag-release.yml

@@ -0,0 +1,135 @@
+name: Tag release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+concurrency:
+  group: tag-release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  prepare-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Create GitHub release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME}"
+          if gh release view "$tag" >/dev/null 2>&1; then
+            echo "GitHub release ${tag} already exists; skipping creation"
+            exit 0
+          fi
+          gh release create "$tag" --target "$GITHUB_SHA" --title "$tag" --generate-notes
+
+  build-release:
+    name: build ${{ matrix.target }}
+    needs: prepare-release
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: darwin-arm64
+            runner: macos-15
+            bun-target: bun-darwin-arm64
+            output: opencodex-darwin-arm64
+          - target: darwin-x64
+            runner: macos-15-intel
+            bun-target: bun-darwin-x64
+            output: opencodex-darwin-x64
+          - target: linux-x64
+            runner: ubuntu-latest
+            bun-target: bun-linux-x64
+            output: opencodex-linux-x64
+          - target: linux-arm64
+            runner: ubuntu-24.04-arm
+            bun-target: bun-linux-arm64
+            output: opencodex-linux-arm64
+          - target: windows-x64
+            runner: windows-latest
+            bun-target: bun-windows-x64
+            output: opencodex-windows-x64.exe
+          - target: windows-arm64
+            runner: windows-11-arm
+            bun-target: bun-windows-arm64
+            output: opencodex-windows-arm64.exe
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build release binary
+        shell: bash
+        env:
+          TARGET: ${{ matrix.bun-target }}
+          OUTPUT: ${{ matrix.output }}
+        run: |
+          set -euo pipefail
+          mkdir -p "$GITHUB_WORKSPACE/dist/release"
+          out="$GITHUB_WORKSPACE/dist/release/$OUTPUT"
+          bun build --compile src/cli/index.ts --target "$TARGET" --outfile "$out"
+          if [[ "$RUNNER_OS" != "Windows" ]]; then
+            chmod +x "$out"
+          fi
+          file "$out" || true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.target }}
+          path: dist/release/${{ matrix.output }}
+          if-no-files-found: error
+
+      - name: Upload GitHub release asset
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          gh release upload "${GITHUB_REF_NAME}" "$GITHUB_WORKSPACE/dist/release/${{ matrix.output }}" --clobber
+
+  publish-checksums:
+    name: publish checksums
+    needs: build-release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+
+      - name: Publish final checksums
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          cd dist
+          shopt -s nullglob
+          archives=(opencodex-*)
+          if [[ ${#archives[@]} -eq 0 ]]; then
+            echo "No release archives found"
+            exit 0
+          fi
+          sha256sum "${archives[@]}" | sort -k2 > checksums.txt
+          gh release upload "${GITHUB_REF_NAME}" checksums.txt --clobber