From 71f8ef35bdf56e6c2a71c9be8deade05fd746379 Mon Sep 17 00:00:00 2001
From: William Yang <willi64645@gmail.com>
Date: Thu, 25 Jun 2026 22:43:57 -0400
Subject: [PATCH 1/2] ci: add GitHub Actions workflow to build and publish
 releases on tag push

---
 .github/workflows/release.yml | 38 +++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..8161cff
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,38 @@
+name: Release
+
+# Cut a release by pushing a version tag, e.g.:
+#   git tag v1.3 && git push origin v1.3
+# This builds the linux/amd64 `watcloud` binary and attaches it to a GitHub
+# Release named after the tag. The asset is named exactly `watcloud` so the
+# infra-config Ansible role can fetch it from
+#   https://github.com/WATonomous/watcloud-cli/releases/download/<tag>/watcloud
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Build linux/amd64 binary
+        env:
+          CGO_ENABLED: "0"
+          GOOS: linux
+          GOARCH: amd64
+        run: go build -o watcloud ./cmd/watcloud
+
+      - name: Publish GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "$GITHUB_REF_NAME" watcloud --title "$GITHUB_REF_NAME" --generate-notes

From b3fe7434283888cccfe5713f0b2c3d5636306e13 Mon Sep 17 00:00:00 2001
From: William Yang <willi64645@gmail.com>
Date: Thu, 25 Jun 2026 23:03:32 -0400
Subject: [PATCH 2/2] ci: emit sha256 + ready-to-paste infra-config bump
 snippet in release notes

---
 .github/workflows/release.yml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8161cff..06ba51a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,23 @@ jobs:
           GOARCH: amd64
         run: go build -o watcloud ./cmd/watcloud
 
+      - name: Compute checksum and infra-config bump snippet
+        run: |
+          SHA="$(sha256sum watcloud | awk '{print $1}')"
+          echo "$SHA  watcloud" > watcloud.sha256
+          {
+            echo "### Bump in infra-config"
+            echo ""
+            echo "Update the watcloud-cli pin in ansible/roles/common/tasks/main.yml:"
+            echo ""
+            echo "    url: https://github.com/WATonomous/watcloud-cli/releases/download/${GITHUB_REF_NAME}/watcloud"
+            echo "    checksum: sha256:${SHA}"
+          } > release-notes.md
+
       - name: Publish GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release create "$GITHUB_REF_NAME" watcloud --title "$GITHUB_REF_NAME" --generate-notes
+        run: |
+          gh release create "$GITHUB_REF_NAME" watcloud watcloud.sha256 \
+            --title "$GITHUB_REF_NAME" \
+            --notes-file release-notes.md