ci(release): attach verified cluster archives to GitHub releases

.github/workflows/ci.yml

@@ -37,3 +37,38 @@ jobs:
       publish: ${{ github.event_name == 'push' || inputs.publish_images == true || inputs.upload_oss == true }}
       upload_oss: ${{ github.event_name == 'push' || inputs.upload_oss == true }}
     secrets: inherit
+
+  release-assets:
+    needs: versions
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: cluster-*
+          path: cluster-bundles
+          merge-multiple: true
+      - name: Verify and publish release assets
+        working-directory: cluster-bundles
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          archives=(*.tar.gz)
+          checksums=(*.tar.gz.sha256)
+          md5_checksums=(*.tar.gz.md5)
+          [[ ${#archives[@]} -eq 4 && ${#checksums[@]} -eq 4 && ${#md5_checksums[@]} -eq 4 ]]
+          sha256sum -c "${checksums[@]}"
+          md5sum -c "${md5_checksums[@]}"
+          if ! gh release view "$RELEASE_TAG" > /dev/null; then
+            flags=()
+            [[ "$RELEASE_TAG" != *-* ]] || flags+=(--prerelease)
+            gh release create "$RELEASE_TAG" --verify-tag --title "$RELEASE_TAG" --generate-notes "${flags[@]}"
+          fi
+          gh release upload "$RELEASE_TAG" "${archives[@]}" "${checksums[@]}" "${md5_checksums[@]}" --clobber

README.md

@@ -49,6 +49,12 @@ Each source produces two `.tar.gz` cluster image archives and matching `.sha256`
 files. Checksums are verified before upload and contain portable basenames.
 Archives are also retained as GitHub Actions artifacts for seven days.
 
+For `v*` tag pushes, after both source builds and OSS uploads succeed, CI also
+attaches all four archives and their SHA-256/MD5 files to the GitHub Release.
+If the release does not exist, CI creates it with generated notes; tags containing
+a hyphen (such as `v5.2.0-beta1`) are marked as prereleases. Reruns replace assets
+with the same names. This job requires `contents: write` for `GITHUB_TOKEN`.
+
 - Release destination: `oss://<OSS_BUCKET>/release/<git-tag>/<source>/`
 - Branch/manual destination: `oss://<OSS_BUCKET>/ci/<source>/<sha7>/`