From ddac025fb5ad97d4ac1d90c3ca50c3b00e8aa606 Mon Sep 17 00:00:00 2001
From: Alex Lee <3076438032@qq.com>
Date: Fri, 23 Oct 2026 10:44:04 +0800
Subject: [PATCH] ci(release): attach verified cluster archives to GitHub
 releases

---
 .github/workflows/ci.yml | 35 +++++++++++++++++++++++++++++++++++
 README.md                |  6 ++++++
 2 files changed, 41 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d70d837..e20348f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,3 +37,38 @@ jobs:
       publish: ${{ github.event_name == 'push' || inputs.publish_images == true || inputs.upload_oss == true }}
       upload_oss: ${{ github.event_name == 'push' || inputs.upload_oss == true }}
     secrets: inherit
+
+  release-assets:
+    needs: versions
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: cluster-*
+          path: cluster-bundles
+          merge-multiple: true
+      - name: Verify and publish release assets
+        working-directory: cluster-bundles
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          archives=(*.tar.gz)
+          checksums=(*.tar.gz.sha256)
+          md5_checksums=(*.tar.gz.md5)
+          [[ ${#archives[@]} -eq 4 && ${#checksums[@]} -eq 4 && ${#md5_checksums[@]} -eq 4 ]]
+          sha256sum -c "${checksums[@]}"
+          md5sum -c "${md5_checksums[@]}"
+          if ! gh release view "$RELEASE_TAG" > /dev/null; then
+            flags=()
+            [[ "$RELEASE_TAG" != *-* ]] || flags+=(--prerelease)
+            gh release create "$RELEASE_TAG" --verify-tag --title "$RELEASE_TAG" --generate-notes "${flags[@]}"
+          fi
+          gh release upload "$RELEASE_TAG" "${archives[@]}" "${checksums[@]}" "${md5_checksums[@]}" --clobber
diff --git a/README.md b/README.md
index 98b9605..d777f02 100644
--- a/README.md
+++ b/README.md
@@ -49,6 +49,12 @@ Each source produces two `.tar.gz` cluster image archives and matching `.sha256`
 files. Checksums are verified before upload and contain portable basenames.
 Archives are also retained as GitHub Actions artifacts for seven days.
 
+For `v*` tag pushes, after both source builds and OSS uploads succeed, CI also
+attaches all four archives and their SHA-256/MD5 files to the GitHub Release.
+If the release does not exist, CI creates it with generated notes; tags containing
+a hyphen (such as `v5.2.0-beta1`) are marked as prereleases. Reruns replace assets
+with the same names. This job requires `contents: write` for `GITHUB_TOKEN`.
+
 - Release destination: `oss://<OSS_BUCKET>/release/<git-tag>/<source>/`
 - Branch/manual destination: `oss://<OSS_BUCKET>/ci/<source>/<sha7>/`