ci: attach binaries to a GitHub Release on tag push

- release job (contents: write, gh CLI) creates the release with generated notes and uploads both binaries + sha256, --clobber for re-runs
- on tag builds the ldflags version comes from the tag itself

.github/workflows/build.yml

@@ -48,6 +48,9 @@ jobs:
         run: |
           set -euo pipefail
           version="$(awk '/^VERSION/{print $3; exit}' Makefile)"
+          case "${GITHUB_REF:-}" in
+            refs/tags/*) version="${GITHUB_REF_NAME#v}" ;;
+          esac
           ext=""
           if [ "$GOOS" = "windows" ]; then ext=".exe"; fi
           out="dsfree2api-${{ matrix.artifact }}${ext}"
@@ -61,3 +64,31 @@ jobs:
           name: dsfree2api-${{ matrix.artifact }}
           path: dsfree2api-${{ matrix.artifact }}*
           if-no-files-found: error
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      actions: read
+    steps:
+      - name: Download binaries
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+      - name: Attach assets to release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          tag="$GITHUB_REF_NAME"
+          ls -l dist/
+          if gh release view "$tag" >/dev/null 2>&1; then
+            gh release upload "$tag" dist/* --clobber
+          else
+            gh release create "$tag" --verify-tag --generate-notes --title "dsfree2api $tag" dist/*
+          fi
+          gh release view "$tag"