From d98f0d0fcf2425685746929c7091677a1cd245e2 Mon Sep 17 00:00:00 2001
From: Guillaume <grams@users.noreply.github.com>
Date: Sat, 5 Sep 2026 18:41:21 +0200
Subject: [PATCH] fix(ci): merge release build into release-please's own
 workflow

Tagging via release-please-action's GITHUB_TOKEN doesn't cascade into
a new workflow run, so the previous tag-triggered release.yaml never
fired (v0.1.0 was released with no attached binaries). Gate the build
job on release-please's release_created output instead, in the same
workflow, and scope permissions per job rather than at workflow level.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y1zVUQDr4rhZozGUQBgHgH
---
 .github/workflows/release-please.yaml | 42 +++++++++++++++++++++++----
 .github/workflows/release.yaml        | 37 -----------------------
 AGENTS.md                             |  2 +-
 3 files changed, 38 insertions(+), 43 deletions(-)
 delete mode 100644 .github/workflows/release.yaml

diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
index 77fb817..2d47a51 100644
--- a/.github/workflows/release-please.yaml
+++ b/.github/workflows/release-please.yaml
@@ -5,15 +5,47 @@ on:
     branches:
       - main
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
       - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        id: release
         with:
           release-type: go
-          release-as: "0.1.0"
+
+  build:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.release-please.outputs.tag_name }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      # The e2e package drives a real `claude` binary, which no runner has.
+      - name: Test
+        run: |
+          mapfile -t pkgs < <(go list ./... | grep -v /e2e)
+          go test "${pkgs[@]}"
+
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
deleted file mode 100644
index d15e25a..0000000
--- a/.github/workflows/release.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - "v*"
-
-permissions:
-  contents: write
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      # The e2e package drives a real `claude` binary, which no runner has.
-      - name: Test
-        run: |
-          mapfile -t pkgs < <(go list ./... | grep -v /e2e)
-          go test "${pkgs[@]}"
-
-      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
-        with:
-          distribution: goreleaser
-          version: "~> v2"
-          args: release --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/AGENTS.md b/AGENTS.md
index 8114bc0..68f6f9c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -40,7 +40,7 @@ e2e/
 
 - `release-please` (release-type `go`) runs on every push to `main`, maintaining a Release PR with `CHANGELOG.md` and the next version bump computed from commit history
 - Commits and PR titles must follow Conventional Commits (`feat:`, `fix:`, `chore:`, …) — release-please can't decide a bump or write the changelog otherwise
-- Merging the Release PR tags the release and creates the GitHub Release; the tag push triggers `.github/workflows/release.yaml`, which builds and attaches binaries via `goreleaser` (`.goreleaser.yaml`)
+- Merging the Release PR tags the release and creates the GitHub Release; a second job in the same workflow (`.github/workflows/release-please.yaml`), gated on `release_created`, then builds and attaches binaries via `goreleaser` (`.goreleaser.yaml`) — a tag-push-triggered workflow wouldn't fire here, since GitHub doesn't cascade a new run from a ref created by the workflow's own `GITHUB_TOKEN`
 
 ## Key conventions