ci: publish release packages to GitHub Releases

.github/workflows/release.yml

@@ -66,6 +66,15 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: npm run tauri build
 
+      - name: Upload Windows packages as GitHub artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: court-pilot-windows
+          if-no-files-found: error
+          path: |
+            src-tauri/target/release/bundle/msi/*.msi
+            src-tauri/target/release/bundle/nsis/*.exe
+
       - name: Upload release assets to CrabNebula
         uses: crabnebula-dev/cloud-release@v0
         with:
@@ -116,6 +125,13 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: npm run tauri build -- --target ${{ matrix.target }} --bundles app,dmg
 
+      - name: Upload macOS packages as GitHub artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: court-pilot-macos-${{ matrix.target }}
+          if-no-files-found: error
+          path: src-tauri/target/${{ matrix.target }}/release/bundle/dmg/*.dmg
+
       - name: Upload release assets to CrabNebula
         uses: crabnebula-dev/cloud-release@v0
         with:
@@ -228,3 +244,37 @@ jobs:
           api-key: ${{ secrets.CN_API_KEY }}
           path: ./src-tauri
           working-directory: ./src-tauri
+
+  # ---------------------------------------------------------
+  # Publish GitHub release after CrabNebula publication succeeds
+  # ---------------------------------------------------------
+  github-release:
+    needs: publish
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download release packages
+        uses: actions/download-artifact@v4
+        with:
+          pattern: court-pilot-*
+          path: release-assets
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        shell: bash
+        run: |
+          mapfile -d '' assets < <(find release-assets -type f -print0)
+          if [ "${#assets[@]}" -eq 0 ]; then
+            echo "No release packages found" >&2
+            exit 1
+          fi
+          gh release create "$RELEASE_TAG" "${assets[@]}" \
+            --verify-tag \
+            --title "$RELEASE_TAG" \
+            --generate-notes

docs/development.md

@@ -214,12 +214,19 @@ GIT_EDITOR=true git tag v1.2.0
 
 Replace `1.2.0` with the confirmed release version and verify the tag points to the intended commit. Do not overwrite or move an existing release tag.
 
-Creating the tag is local. Pushing it starts `.github/workflows/release.yml`, which builds Windows and macOS artifacts for CrabNebula and builds/publishes the Linux Snap. Push only after explicit confirmation:
+Creating the tag is local. Pushing it starts `.github/workflows/release.yml`, which builds Windows and macOS artifacts for CrabNebula and builds/publishes the Linux Snap. After CrabNebula publication succeeds, it also creates a GitHub Release for the pushed tag with generated release notes and attaches the Windows installers, both macOS DMGs, and the Linux Snap. Push only after explicit confirmation:
 
 ```sh
 git push origin v1.2.0
 ```
 
+The GitHub Release job uses the built-in `GITHUB_TOKEN` with job-scoped
+`contents: write` permission; no additional secret is required. Existing
+CrabNebula, updater-signing, and Snap Store secrets are still required. Manual
+workflow runs on branches skip the GitHub Release job; runs on `v*` tags include
+it. Use a new version tag for each release: creation fails if a GitHub Release
+already exists for that tag.
+
 ## Generated and local directories
 
 Do not manually edit or commit generated/dependency content unless a workflow explicitly requires an artifact: