Github release workflow to publish binaries

.github/workflows/build-binaries.yml

@@ -0,0 +1,70 @@
+name: Build binaries
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  build-binary:
+    name: Build-binary (${{ matrix.artifact }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            artifact: spark-linux-x64
+            ext: ""
+            archive: tar.gz
+          - os: ubuntu-24.04-arm
+            artifact: spark-linux-arm64
+            ext: ""
+            archive: tar.gz
+          - os: macos-26
+            artifact: spark-darwin-arm64
+            ext: ""
+            archive: tar.gz
+          - os: macos-15-intel
+            artifact: spark-darwin-x64
+            ext: ""
+            archive: tar.gz
+          - os: windows-2022
+            artifact: spark-windows-x64
+            ext: ".exe"
+            archive: zip
+          - os: windows-11-arm
+            artifact: spark-windows-arm64
+            ext: ".exe"
+            archive: zip
+    steps:
+      - name: Checkout
+        # actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - uses: ./.github/actions/setup
+
+      - name: Build SEA binary
+        run: pnpm build:sea
+
+      - name: Package binary
+        shell: bash
+        working-directory: dist-sea
+        run: |
+          bin="spark${{ matrix.ext }}"
+          out="${{ matrix.artifact }}.${{ matrix.archive }}"
+          if [ "${{ matrix.archive }}" = "zip" ]; then
+            7z a "$out" "$bin"
+          else
+            chmod +x "$bin"
+            tar -czf "$out" "$bin"
+          fi
+
+      - name: Upload archive
+        # actions/upload-artifact@v4.4.3
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
+        with:
+          name: ${{ matrix.artifact }}
+          path: dist-sea/${{ matrix.artifact }}.${{ matrix.archive }}
+          if-no-files-found: error

.github/workflows/ci.yml

@@ -31,44 +31,8 @@ jobs:
         run: pnpm build:beau
 
   build-binary:
-    name: Build-binary (${{ matrix.artifact }})
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-24.04
-            artifact: spark-linux-x64
-            path: dist-sea/spark
-          - os: ubuntu-24.04-arm
-            artifact: spark-linux-arm64
-            path: dist-sea/spark
-          - os: macos-26
-            artifact: spark-darwin-arm64
-            path: dist-sea/spark
-          - os: macos-15-intel
-            artifact: spark-darwin-x64
-            path: dist-sea/spark
-          - os: windows-2022
-            artifact: spark-win-x64
-            path: dist-sea/spark.exe
-    steps:
-      - name: Checkout
-        # actions/checkout@v6.0.2
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-
-      - uses: ./.github/actions/setup
-
-      - name: Build SEA binary
-        run: pnpm build:sea
-
-      - name: Upload SEA binary
-        # actions/upload-artifact@v4.4.3
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
-        with:
-          name: ${{ matrix.artifact }}
-          path: ${{ matrix.path }}
-          if-no-files-found: error
+    name: Build binaries
+    uses: ./.github/workflows/build-binaries.yml
 
   test:
     name: Test

.github/workflows/release.yml

@@ -0,0 +1,67 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (for example v0.1.1)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+
+env:
+  TAG: ${{ inputs.tag || github.ref_name }}
+
+jobs:
+  build:
+    name: Build binaries
+    uses: ./.github/workflows/build-binaries.yml
+
+  publish:
+    name: Publish GitHub Release
+    needs: build
+    runs-on: ubuntu-24.04
+    environment: release
+    permissions:
+      contents: write
+    steps:
+      - name: Validate tag
+        shell: bash
+        run: |
+          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Tag must match v<major>.<minor>.<patch>; got: $TAG" >&2
+            exit 1
+          fi
+
+      - name: Checkout
+        # actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          ref: ${{ env.TAG }}
+
+      - name: Download binaries
+        # actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
+        with:
+          path: release-assets
+          merge-multiple: true
+
+      - name: Generate checksums
+        shell: bash
+        working-directory: release-assets
+        run: sha256sum spark-* > SHA256SUMS
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: gh release create "$TAG" --generate-notes release-assets/*

.github/workflows/tag-on-version-bump.yml

@@ -0,0 +1,77 @@
+name: tag-on-version-bump
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - packages/spark/package.json
+
+permissions:
+  actions: write
+  contents: write
+
+concurrency:
+  group: tag-on-version-bump-main
+  cancel-in-progress: false
+
+jobs:
+  create-tag:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        # actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - id: versions
+        name: Read current and previous versions
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          file=packages/spark/package.json
+          current="$(jq -r .version "$file")"
+          if [ -z "$current" ] || [ "$current" = "null" ]; then
+            echo "Failed to parse version from $file" >&2
+            exit 1
+          fi
+
+          previous=""
+          before="${{ github.event.before }}"
+          if [ -n "$before" ] && [ "$before" != "0000000000000000000000000000000000000000" ] \
+            && git cat-file -e "${before}^{commit}" 2>/dev/null; then
+            previous="$(git show "${before}:${file}" 2>/dev/null | jq -r .version 2>/dev/null || true)"
+          fi
+
+          tag="v${current}"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          if [ "$current" = "$previous" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "Version unchanged ($current); nothing to do."
+          elif git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "Tag $tag already exists; nothing to do."
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create and push tag
+        if: steps.versions.outputs.changed == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          tag="${{ steps.versions.outputs.tag }}"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "$tag" -m "Release $tag" "$GITHUB_SHA"
+          git push origin "refs/tags/$tag"
+
+      - name: Trigger release workflow
+        if: steps.versions.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: gh workflow run release.yml --ref main -f tag="${{ steps.versions.outputs.tag }}"

package.json

@@ -1,8 +1,9 @@
 {
   "name": "spark",
+  "//": "The following version is NOT spark's version. Spark version is tracked in packages/spark/package.json",
   "version": "0.0.0",
   "private": true,
-  "description": "Braintrust wizard monorepo",
+  "description": "CLI wizard to get your project set up with Braintrust",
   "license": "MIT",
   "type": "module",
   "packageManager": "pnpm@10.33.3",