ci: add pii-model release workflow, guard npm-publish

New workflow builds and releases PII model bundles on pii-model-v* tags.
npm-publish now skipped for non-v* releases.

Author: rmorse

.github/workflows/npm-publish.yml

@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   npm:
+    if: startsWith(github.event.release.tag_name, 'v')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/pii-model.yml

@@ -0,0 +1,35 @@
+name: PII Model Release
+
+on:
+  push:
+    tags:
+      - "pii-model-v*"
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Extract version from tag
+        id: version
+        run: |
+          TAG="${GITHUB_REF#refs/tags/pii-model-v}"
+          echo "version=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Build platform bundles
+        run: ./scripts/prepare-pii-model.sh dist/pii-model
+        env:
+          PII_MODEL_VERSION: ${{ steps.version.outputs.version }}
+
+      - name: Create release and upload assets
+        run: |
+          gh release create "pii-model-v${{ steps.version.outputs.version }}" \
+            --title "PII Model v${{ steps.version.outputs.version }}" \
+            --notes "PII redaction model bundle (distilbert-base-multilingual-cased-ner-hrl, INT8 quantized) + ONNX Runtime." \
+            dist/pii-model/pii-model-*.tar.gz
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

scripts/prepare-pii-model.sh

@@ -6,7 +6,7 @@
 # Output: per-platform tarballs + SHA-256 hashes ready for GitHub Release upload.
 set -euo pipefail
 
-VERSION="1.0.0"
+VERSION="${PII_MODEL_VERSION:-1.0.0}"
 MODEL_REPO="Xenova/distilbert-base-multilingual-cased-ner-hrl"
 ORT_VERSION="1.23.0"
 OUTDIR="${1:-dist/pii-model}"