ci: add release tarballs and GitHub Release upload job

- Add release: published trigger to CI workflow
- Create notedeck-{arch}-{os}.tar.gz tarballs in packaging and macOS jobs
- Add upload-to-release job that attaches all artifacts to the GitHub Release
- Update notedeck-release tool to accept any artifact by file extension
  instead of a hardcoded list

Changelog-None:

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jb55

.github/workflows/rust.yml

@@ -8,6 +8,8 @@ on:
   pull_request:
     branches:
       - "*"
+  release:
+    types: [published]
 
 jobs:
   changelog-check:
@@ -113,7 +115,7 @@ jobs:
     name: rpm/deb
     runs-on: ubuntu-22.04
     needs: linux-test
-    if: github.ref_name == 'master' || github.ref_name == 'ci'
+    if: github.ref_name == 'master' || github.ref_name == 'ci' || github.event_name == 'release'
 
     strategy:
       fail-fast: false
@@ -143,6 +145,26 @@ jobs:
         if: matrix.arch == runner.arch
         run: cargo build --release --workspace --exclude notedeck_release
 
+      - name: Create release tarball (Cross)
+        if: matrix.arch != runner.arch
+        run: |
+          mkdir -p packages
+          tar czf packages/notedeck-${{ matrix.arch }}-linux.tar.gz \
+            -C target/${{ matrix.arch }}-unknown-linux-gnu/release notedeck
+
+      - name: Create release tarball (Native)
+        if: matrix.arch == runner.arch
+        run: |
+          mkdir -p packages
+          tar czf packages/notedeck-${{ matrix.arch }}-linux.tar.gz \
+            -C target/release notedeck
+
+      - name: Upload tarball
+        uses: actions/upload-artifact@v4
+        with:
+          name: notedeck-${{ matrix.arch }}-linux.tar.gz
+          path: packages/notedeck-${{ matrix.arch }}-linux.tar.gz
+
       - name: Build RPM (Cross)
         if: matrix.arch != runner.arch
         run: cargo generate-rpm -p crates/notedeck_chrome --target=${{ matrix.arch }}-unknown-linux-gnu
@@ -192,7 +214,7 @@ jobs:
     name: macOS dmg
     runs-on: macos-latest
     needs: macos-test
-    if: github.ref_name == 'master' || github.ref_name == 'ci'
+    if: github.ref_name == 'master' || github.ref_name == 'ci' || github.event_name == 'release'
     env:
       NOTEDECK_APPLE_RELEASE_CERT_ID: ${{ secrets.NOTEDECK_APPLE_RELEASE_CERT_ID }}
       NOTEDECK_RELEASE_APPLE_ID: ${{ secrets.NOTEDECK_RELEASE_APPLE_ID }}
@@ -227,6 +249,18 @@ jobs:
       - name: Run macOS DMG Build Script
         run: ARCH=${{ matrix.arch }} ./scripts/macos_build.sh
 
+      - name: Create release tarball
+        run: |
+          mkdir -p packages
+          tar czf packages/notedeck-${{ matrix.arch }}-macos.tar.gz \
+            -C target/${{ matrix.arch }}-apple-darwin/release notedeck
+
+      - name: Upload tarball
+        uses: actions/upload-artifact@v4
+        with:
+          name: notedeck-${{ matrix.arch }}-macos.tar.gz
+          path: packages/notedeck-${{ matrix.arch }}-macos.tar.gz
+
       - name: Upload DMG Artifact
         uses: actions/upload-artifact@v4
         with:
@@ -237,7 +271,7 @@ jobs:
     name: Windows Installer
     runs-on: windows-latest
     needs: windows-test
-    if: github.ref_name == 'master' || github.ref_name == 'ci'
+    if: github.ref_name == 'master' || github.ref_name == 'ci' || github.event_name == 'release'
     strategy:
       fail-fast: false
       matrix:
@@ -324,7 +358,7 @@ jobs:
     name: Upload Artifacts to Server
     runs-on: ubuntu-22.04
     needs: [packaging, macos-dmg, windows-installer]
-    if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/ci'
+    if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/ci' || github.event_name == 'release'
 
     steps:
       - name: Download all Artifacts
@@ -349,6 +383,44 @@ jobs:
           put $ARTIFACTS/notedeck-aarch64.dmg/*
           put $ARTIFACTS/DamusNotedeckInstaller-x86_64.exe/*
           put $ARTIFACTS/DamusNotedeckInstaller-aarch64.exe/*
+          put $ARTIFACTS/notedeck-x86_64-linux.tar.gz/*
+          put $ARTIFACTS/notedeck-aarch64-linux.tar.gz/*
+          put $ARTIFACTS/notedeck-x86_64-macos.tar.gz/*
+          put $ARTIFACTS/notedeck-aarch64-macos.tar.gz/*
           bye
           EOF
 
+  upload-to-release:
+    name: Upload to GitHub Release
+    runs-on: ubuntu-22.04
+    needs: [packaging, macos-dmg, windows-installer]
+    if: github.event_name == 'release'
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download all Artifacts
+        uses: actions/download-artifact@v4
+
+      - name: Upload assets to GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag="${{ github.event.release.tag_name }}"
+          echo "=== Downloaded artifact directories ==="
+          ls -la
+          for dir in */; do
+            echo "--- $dir ---"
+            ls -la "$dir"
+          done
+          echo "=== Uploading to release $tag ==="
+          for dir in notedeck-*.rpm notedeck-*.deb notedeck-*.dmg notedeck-*-linux.tar.gz notedeck-*-macos.tar.gz DamusNotedeckInstaller-*.exe; do
+            if [ -d "$dir" ]; then
+              for file in "$dir"/*; do
+                [ -f "$file" ] || continue
+                echo "uploading $file..."
+                gh release upload "$tag" "$file" --repo "${{ github.repository }}" --clobber
+              done
+            fi
+          done
+

crates/notedeck_release/src/main.rs

@@ -23,14 +23,8 @@ fn usage() {
 
 const GITHUB_REPO: &str = "damus-io/notedeck";
 
-const RELEASE_ARTIFACTS: &[&str] = &[
-    "notedeck-x86_64-linux.tar.gz",
-    "notedeck-aarch64-linux.tar.gz",
-    "notedeck-x86_64-macos.tar.gz",
-    "notedeck-aarch64-macos.tar.gz",
-    "notedeck-x86_64-windows.zip",
-    "notedeck-aarch64-windows.zip",
-];
+/// File extensions recognized as release artifacts
+const ARTIFACT_EXTENSIONS: &[&str] = &[".tar.gz", ".zip", ".dmg", ".deb", ".rpm", ".exe", ".msi"];
 
 fn sha256_hex(data: &[u8]) -> String {
     let mut hasher = Sha256::new();
@@ -98,8 +92,8 @@ fn fetch_github_artifacts(version: &str) -> Result<Vec<ArtifactInfo>, String> {
     let mut artifacts = Vec::new();
     for asset in assets {
         let name = asset["name"].as_str().unwrap_or("").to_string();
-        if !RELEASE_ARTIFACTS.contains(&name.as_str()) {
-            eprintln!("  skipping unknown asset: {name}");
+        if !ARTIFACT_EXTENSIONS.iter().any(|ext| name.ends_with(ext)) {
+            eprintln!("  skipping non-artifact asset: {name}");
             continue;
         }
         let browser_url = asset["browser_download_url"]