[mlhiter]

Summary

Tag builds publish cluster archives to OSS and Actions artifacts, but leave GitHub Releases without downloadable image packages. Add a final tag-only job that verifies all four archives and their SHA-256/MD5 checksums, creates a release when missing (prerelease for hyphenated tags), and uploads the 12 assets. Document publication behavior and permissions.

Validation

• actionlint v1.7.7 passed for both workflows.
• git diff --check passed.
• The new tag-only job still needs a post-merge tagged run for end-to-end validation.

Sequence Diagram

sequenceDiagram
    participant Build as Source build matrix
    participant Assets as Release assets job
    participant Release as GitHub Release
    Build->>Assets: Both sources complete with four archives
    Assets->>Assets: Verify SHA-256 and MD5 checksums
    alt Release is missing
        Assets->>Release: Create release with generated notes and prerelease flag
    end
    Assets->>Release: Upload archives and checksum files

Loading