smooth out the release workflow

.github/workflows/ci.yml

@@ -34,7 +34,27 @@ jobs:
         if: success() || failure()
 
       - uses: actions/upload-artifact@v4
+        if: github.ref_type != 'tag'
         with:
           name: nixos-with-determinate-${{ matrix.runners.system }}.iso
           path: ./result/iso/*
           retention-days: 90
+
+      - name: Release
+        uses: softprops/action-gh-release@v2
+        if: github.ref_type == 'tag'
+        with:
+          prerelease: true
+          files: ./result/iso/*
+
+  release:
+    runs-on: ubuntu-latest
+    needs: build
+    environment: ${{ github.ref_type == 'tag' && 'production' || 'build' }}
+    steps:
+      - run: "true"
+      - name: Release
+        uses: softprops/action-gh-release@v2
+        if: github.ref_type == 'tag'
+        with:
+          prerelease: false

.github/workflows/propose-release.yml

@@ -0,0 +1,24 @@
+on:
+  workflow_dispatch:
+    inputs:
+      reference-id:
+        type: string
+        required: true
+      version:
+        type: string
+        required: true
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  propose-release:
+    uses: DeterminateSystems/propose-release/.github/workflows/workflow.yml@main
+    permissions:
+      id-token: "write"
+      contents: "write"
+      pull-requests: write
+    with:
+      reference-id: ${{ inputs.reference-id }}
+      version: ${{ inputs.version }}