feat: add release badge and GitHub Actions release workflow

Builds linux/amd64 and linux/arm64 binaries on release creation
and uploads them as release assets.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: nikicat

.github/workflows/release.yml

@@ -0,0 +1,48 @@
+name: Release
+
+on:
+  release:
+    types: [created]
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+          - goos: linux
+            goarch: arm64
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - uses: denoland/setup-deno@v2
+        with:
+          deno-version: v2.x
+
+      - name: Build frontend
+        run: make frontend && mkdir -p internal/api/web && cp -r web/dist internal/api/web/
+
+      - name: Build binary
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          CGO_ENABLED: "0"
+        run: |
+          go build -ldflags "-X main.version=${{ github.ref_name }} -s -w" \
+            -o secrets-dispatcher-${{ matrix.goos }}-${{ matrix.goarch }} .
+
+      - name: Upload to release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload ${{ github.ref_name }} \
+            secrets-dispatcher-${{ matrix.goos }}-${{ matrix.goarch }}

README.md

@@ -2,6 +2,7 @@
 
 [![CI](https://github.com/nikicat/secrets-dispatcher/actions/workflows/check.yml/badge.svg)](https://github.com/nikicat/secrets-dispatcher/actions/workflows/check.yml)
 [![Go Report Card](https://goreportcard.com/badge/github.com/nikicat/secrets-dispatcher)](https://goreportcard.com/report/github.com/nikicat/secrets-dispatcher)
+[![Release](https://img.shields.io/github/v/release/nikicat/secrets-dispatcher)](https://github.com/nikicat/secrets-dispatcher/releases/latest)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
 Per-operation approval and audit logging for secret access and git commit signing on Linux.

docs/PROMOTION.md

@@ -62,11 +62,10 @@ Checklist for increasing project visibility and adoption.
 
 ### Packaging
 
-- [ ] **AUR** — Create package (Arch Linux users are a core audience)
+- [x] **AUR** — Create package (Arch Linux users are a core audience)
 - [ ] **Nixpkgs** — High priority. Nix users care deeply about reproducibility and security.
-- [ ] **Homebrew (linuxbrew)** — Easy entry point for developers
 - [ ] **Fedora COPR** — Covers Fedora users
-- [ ] **Pre-built binaries** — GitHub Releases with Linux amd64/arm64 binaries (release workflow may need setup)
+- [x] **Pre-built binaries** — GitHub Releases with Linux amd64/arm64 binaries
 
 ### Project Credibility Signals
 
@@ -77,7 +76,7 @@ Checklist for increasing project visibility and adoption.
 - [ ] **Additional badges in README**:
   - [ ] Code coverage
   - [x] Go Report Card
-  - [ ] Latest release version
+  - [x] Latest release version
 
 - [ ] **CHANGELOG.md** — Running changelog ([keepachangelog.com](https://keepachangelog.com/) format).
 
@@ -115,7 +114,6 @@ Checklist for increasing project visibility and adoption.
 
 - [ ] **Man page** — `secrets-dispatcher(1)`. Expected by distro packagers.
 
-- [ ] **Grafana dashboard template** — For users who ship logs to Loki/Elasticsearch. Pre-built dashboard showing secret access patterns.
 
 ## Cross-Promotion with gopass-secret-service