[jonathan-kosgei]

Summary

Merging a pull request that bumps Version in client.go is now enough to cut a release: the CI workflow tags the merge commit vX.Y.Z and creates the GitHub release for it. No manual tagging is needed any more, and the README gains a short "Releasing" section for maintainers.

How it works

• A new release job in .github/workflows/ci.yml runs only on pushes to the repository's default branch (master), after the test matrix and staticcheck jobs have succeeded. It is the only job with contents: write, and a release concurrency group serialises its runs.
• It reads Version from client.go with sed, derives the tag v<Version>, and checks for it with git ls-remote --exit-code --tags origin refs/tags/<tag>.
• When the tag is missing (ls-remote exits 2) it runs gh release create <tag> --target $GITHUB_SHA --title <tag> --generate-notes with the workflow's own token, which creates the tag and the GitHub release in one step. When the tag already exists the job logs that and does nothing; any other ls-remote failure fails the job without releasing.
• The job exposes tag and created outputs. Nothing is published from CI: Go modules are fetched straight from the tag.
• Existing behaviour is unchanged: pull_request runs still execute only test and staticcheck (the release job is skipped), and a tag or release created by hand keeps working.

Note: master already carries Version = "0.8.2" while the latest tag is v0.8.1, so the first push to master after this is merged will create v0.8.2 and its release at that merge commit.

Verification

• python3 -c 'import yaml,sys; [yaml.safe_load(open(f)) for f in sys.argv[1:]]' .github/workflows/*.yml passes.
• The version command, sed -nE 's/.*Version *= *"([^"]+)".*/\1/p' client.go | head -1, prints 0.8.2 against the checked-out file, and git ls-remote --exit-code --tags origin refs/tags/v0.8.2 exits 2 against the real repository, confirming the detection path.
• The release step's script was exercised locally with a stubbed gh and the real remote: an untagged 0.8.2 produces gh release create v0.8.2 --target <sha> --title v0.8.2 --generate-notes and created=true; the tagged 0.8.1 logs "already exists" and sets created=false without calling gh; an unreachable remote fails the step with the ls-remote exit status; a client.go without Version fails the step.
• actionlint could not be run in this environment, and the push-triggered release job itself cannot run before the merge; the pull_request CI on this branch is the check available here.

🤖 Generated with Claude Code