[jonathan-kosgei]

Summary

Merging a version bump to main is now enough to publish a release: CI tags the merge commit, creates the GitHub release and publishes the package and its documentation to Hex.pm. No manual tagging is needed any more; a tag pushed by hand still publishes as before.

How it works

• A new release job in .github/workflows/publish.yml runs after the tests on every push to the default branch, with permissions: contents: write and a release concurrency group. It reads vsn from src/ipdata.app.src, derives the tag vX.Y.Z and checks it with git ls-remote --exit-code --tags origin. When the tag is missing it runs gh release create "$TAG" --target "$GITHUB_SHA" --title "$TAG" --generate-notes with the workflow's own GITHUB_TOKEN, which creates the tag and the release in one step, and sets the job outputs tag and created. When the tag already exists it does nothing and says so.
• A tag created with the workflow's own token does not start another workflow run, so the existing publish job now also depends on release and runs in the same run when needs.release.outputs.created == 'true'. The previous refs/tags/v* gate is kept as an alternative, so a tag pushed by hand still publishes; the condition uses !cancelled() because the release job is skipped on that path. The publish steps and the secret they use are unchanged.
• Pull request CI is unchanged: the release job is skipped because the event is not a push to the default branch, and the publish job is skipped as before.
• The README gets a short "Releasing" section for maintainers.

Verification

• python3 -c 'import yaml,sys; [yaml.safe_load(open(f)) for f in sys.argv[1:]]' .github/workflows/*.yml passes and actionlint v1.7.12 reports nothing.
• The version command prints 1.1.0 for the checked-out src/ipdata.app.src.
• The two scripts of the release job were run locally with a stubbed gh: for v1.1.0 (not tagged yet) they produce gh release create v1.1.0 --target <sha> --title v1.1.0 --generate-notes and created=true; for v1.0.1 (already tagged) they report that the tag exists and set created=false; when git ls-remote fails for another reason the step fails without setting an output.
• The push-triggered release job itself can only run once this is merged. Note that vsn is already 1.1.0 while the newest tag is v1.0.1 (Hex.pm has 1.0.0 and 1.0.1), so merging this pull request will create v1.1.0 and publish 1.1.0.

🤖 Generated with Claude Code