release: automate GitHub releases

Author: brianmhunt

.github/workflows/release.yml

@@ -98,3 +98,38 @@ jobs:
         # npm generates provenance attestations automatically during trusted
         # publishing from GitHub Actions.
         run: npx changeset publish
+
+  github-release:
+    name: Create GitHub Release
+    needs: [prepare-release, publish]
+    if: needs.prepare-release.outputs.has_changesets == 'false' && needs.publish.result == 'success'
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout code
+        # actions/checkout v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - name: Determine release version
+        id: version
+        run: echo "version=$(node -p 'require(\"./lerna.json\").version')" >> "$GITHUB_OUTPUT"
+
+      - name: Create GitHub release if missing
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          tag="v${VERSION}"
+          if gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "GitHub release $tag already exists; skipping."
+            exit 0
+          fi
+
+          gh release create "$tag" \
+            --repo "$GITHUB_REPOSITORY" \
+            --target "$GITHUB_SHA" \
+            --title "TKO ${VERSION}" \
+            --generate-notes

AGENTS.md

@@ -106,7 +106,7 @@ GitHub Actions workflows (`.github/workflows/`):
 | `test-headless.yml` | PRs | Matrix test (Chrome, Firefox, jQuery) |
 | `lint-and-typecheck.yml` | PRs | Prettier + ESLint + tsc (combined) |
 | `publish-check.yml` | PRs | Verify packages are publishable |
-| `release.yml` | Push to main | Changeset version PRs + npm publish |
+| `release.yml` | Push to main | Changeset version PRs + npm publish + GitHub release |
 | `deploy-docs.yml` | Push to main | Deploy tko.io to GitHub Pages |
 | `codeql-analysis.yml` | Weekly + main push | Security scanning |
 
@@ -127,6 +127,7 @@ This creates a changeset file in `.changeset/` that gets committed with your PR.
 2. If unreleased changesets exist, the action opens a "Version Packages" PR
 3. Review the PR (it bumps versions and updates changelogs)
 4. Merge it to publish to npm via GitHub Actions OIDC trusted publishing
+5. After a successful publish, CI creates the matching GitHub Release and tag
 
 Avoid manual workstation publishes. If release CI is unavailable, fix the
 workflow or npm trusted publisher configuration rather than bypassing it with a

README.md

@@ -55,7 +55,7 @@ It's available as `@tko/build.knockout`, and over CDN:
 | $ `make test` | Run all tests with electron. See below. |
 | $ `make test-headless` | Run all tests with chromium. See below. |
 | $ `npx changeset add` | Add a changeset for package behavior changes in your PR |
-| Release workflow | On merge to `main`, CI opens or updates a version PR; when that version PR is merged and there are no remaining changesets, CI publishes from GitHub Actions via npm trusted publishing |
+| Release workflow | On merge to `main`, CI opens or updates a version PR; when that version PR is merged and there are no remaining changesets, CI publishes from GitHub Actions via npm trusted publishing and creates the matching GitHub Release |
 | $ `make test-coverage` | Run all tests and create a code coverage report |
 
 Checkout the `Makefile` for more commands that can be executed with `make {command}`.

plans/build-and-release-certainty.md

@@ -71,6 +71,7 @@ to npm.
 - Builds all packages and runs tests
 - If unreleased changesets exist, opens/updates a version PR
 - If version PR is merged, publishes to npm
+- After a successful publish, creates the matching GitHub Release and tag
 - Uses npm trusted publishing via GitHub Actions OIDC
 - Requires trusted publisher configuration for the public `@tko/*` packages on npm