Automate attested release assets

.github/workflows/release.yml

@@ -0,0 +1,67 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "*.*.*"
+
+permissions:
+  contents: write
+  id-token: write
+  attestations: write
+
+jobs:
+  release:
+    name: Build and release
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check release version
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
+          MANIFEST_VERSION="$(node -p "require('./manifest.json').version")"
+
+          if [ "$PACKAGE_VERSION" != "$TAG" ]; then
+            echo "package.json version $PACKAGE_VERSION does not match tag $TAG" >&2
+            exit 1
+          fi
+
+          if [ "$MANIFEST_VERSION" != "$TAG" ]; then
+            echo "manifest.json version $MANIFEST_VERSION does not match tag $TAG" >&2
+            exit 1
+          fi
+
+      - name: Run checks and build
+        run: npm run check
+
+      - name: Generate artifact attestations
+        uses: actions/attest@v4
+        with:
+          subject-path: |
+            main.js
+            manifest.json
+            styles.css
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          gh release create "$TAG" \
+            main.js manifest.json styles.css \
+            --title "$TAG" \
+            --generate-notes \
+            --verify-tag

README.md

@@ -98,8 +98,6 @@ Run `npm run format` after edits and before `npm run check` so Prettier-only iss
 
 `main.js`, `data.json`, and `node_modules/` are ignored by Git. `main.js` is still the file Obsidian loads, so run `npm run build` or `npm run build:prod` after source changes.
 
-GitHub Releases attach only `main.js`, `manifest.json`, and `styles.css` as Obsidian install assets. `LICENSE` and `NOTICE` are kept in the repository and source archives for license distribution.
-
 The app-server TypeScript bindings in `src/generated/app-server/` are generated from the installed Codex CLI:
 
 ```sh
@@ -109,6 +107,19 @@ npm run check
 
 The generation script uses `codex app-server generate-ts --experimental` because the panel depends on experimental app-server fields such as collaboration mode and generated v2 types.
 
+## Release
+
+GitHub Releases attach only `main.js`, `manifest.json`, and `styles.css` as Obsidian install assets. `LICENSE` and `NOTICE` are kept in the repository and source archives for license distribution.
+
+Create a release by bumping `package.json`, `package-lock.json`, `manifest.json`, and `versions.json`, committing with `Bump version to X.Y.Z`, then pushing the matching tag:
+
+```sh
+git tag X.Y.Z
+git push origin main X.Y.Z
+```
+
+The release workflow runs `npm run check`, attaches the install assets, and generates GitHub artifact attestations for them. Review the generated GitHub release notes after the workflow finishes and edit them when a release needs hand-written notes.
+
 ## License
 
 Codex Panel is licensed under the Apache License 2.0. See `LICENSE`.