From c65cbe7f346494bba1655a27f4ae02693e40b2a1 Mon Sep 17 00:00:00 2001
From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com>
Date: Mon, 22 Jun 2026 08:50:45 -0700
Subject: [PATCH] ci: add Release workflow (verify + test + GitHub release;
 crates.io publish driven by release.sh)

---
 .github/workflows/release.yml | 51 +++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..c59d0dc
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,51 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Verify Cargo.toml version matches tag
+        run: |
+          CARGO_VER="v$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')"
+          if [ "$CARGO_VER" != "${{ github.ref_name }}" ]; then
+            echo "::error::Cargo.toml says $CARGO_VER but tag is ${{ github.ref_name }}"
+            exit 1
+          fi
+          echo "Version match: $CARGO_VER"
+
+  test:
+    needs: verify
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@1.86.0
+      # freemkv-keysources is a library — Cargo.lock isn't tracked, so --locked
+      # would always fail (no lockfile to lock against on a fresh runner). Its
+      # libfreemkv dep resolves from crates.io (the dev .cargo/config.toml patch
+      # is gitignored and absent on the runner), so libfreemkv must already be
+      # published at this version — the release script enforces that ordering.
+      - run: cargo test
+
+  # NOTE: the crates.io publish is driven by the release script
+  # (freemkv-private/scripts/release.sh) from local credentials, not from CI —
+  # this repo has no CARGO_REGISTRY_TOKEN secret. CI here only verifies the
+  # version/tag match, runs tests, and cuts the GitHub Release.
+
+  release:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true