ci: publish provider binaries in release-plz flow

.github/workflows/release-plz.yml

@@ -13,3 +13,120 @@ jobs:
     secrets:
       github-token: ${{ secrets.GH_TOKEN }}
       cargo-registry-token: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
+  release-context:
+    name: Resolve opy-rs release
+    if: needs.release-plz.outputs.releases_created == 'true'
+    needs: release-plz
+    runs-on: ubuntu-latest
+    outputs:
+      opy_release_created: ${{ steps.resolve.outputs.opy_release_created }}
+      opy_release_tag: ${{ steps.resolve.outputs.opy_release_tag }}
+
+    steps:
+      - name: Select opy-rs release metadata
+        id: resolve
+        env:
+          RELEASES: ${{ needs.release-plz.outputs.releases }}
+        run: |
+          set -euo pipefail
+          opy_release_tag="$(jq -r 'map(select(.package_name == "opy-rs")) | first | .tag // empty' <<<"$RELEASES")"
+          if [[ -n "$opy_release_tag" ]]; then
+            echo "opy_release_created=true" >> "$GITHUB_OUTPUT"
+            echo "opy_release_tag=$opy_release_tag" >> "$GITHUB_OUTPUT"
+          else
+            echo "opy_release_created=false" >> "$GITHUB_OUTPUT"
+            echo "opy_release_tag=" >> "$GITHUB_OUTPUT"
+          fi
+
+  provider:
+    name: Provider (${{ matrix.target }})
+    if: needs.release-context.outputs.opy_release_created == 'true'
+    needs: release-context
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          - os: macos-15-intel
+            target: x86_64-apple-darwin
+          - os: macos-14
+            target: aarch64-apple-darwin
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+
+    steps:
+      - name: Check out release source
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.release-context.outputs.opy_release_tag }}
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+          targets: ${{ matrix.target }}
+
+      - name: Build provider
+        run: cargo build --locked --release --target ${{ matrix.target }} -p opy-provider --bin opy-provider
+
+      - name: Archive provider
+        shell: bash
+        env:
+          TARGET: ${{ matrix.target }}
+          VERSION: ${{ needs.release-context.outputs.opy_release_tag }}
+        run: |
+          VERSION="${VERSION#v}"
+          mkdir -p dist
+          if [[ "$TARGET" == *windows* ]]; then
+            BINARY=opy-provider.exe
+          else
+            BINARY=opy-provider
+          fi
+          cp "target/$TARGET/release/$BINARY" "dist/$BINARY"
+          tar -czf "opy-provider-$VERSION-$TARGET.tar.gz" -C dist "$BINARY"
+          ARCHIVE="opy-provider-$VERSION-$TARGET.tar.gz"
+          CHECKSUM="${ARCHIVE}.sha256"
+          if command -v sha256sum >/dev/null 2>&1; then
+            sha256sum "$ARCHIVE" > "$CHECKSUM"
+          else
+            shasum -a 256 "$ARCHIVE" > "$CHECKSUM"
+          fi
+
+      - name: Stage provider artifact and checksum
+        uses: actions/upload-artifact@v4
+        with:
+          name: opy-provider-${{ matrix.target }}
+          path: |
+            opy-provider-*.tar.gz
+            opy-provider-*.tar.gz.sha256
+
+  publish-provider:
+    name: Publish provider release artifacts
+    if: needs.release-context.outputs.opy_release_created == 'true'
+    needs:
+      - release-context
+      - provider
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download all target artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+
+      - name: Upload provider artifacts to the GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ needs.release-context.outputs.opy_release_tag }}
+        run: |
+          set -euo pipefail
+          gh release upload "$RELEASE_TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            dist/*/opy-provider-*.tar.gz \
+            dist/*/opy-provider-*.tar.gz.sha256 \
+            --clobber