ci: trigger release build on published release instead of tag push

Both workflows now run on `release: published` and attach the built
archives to the release the user creates, rather than pushing a tag and
having the workflow create the release. Tag comes from the release event;
GitHub no longer regenerates release notes. Docs updated accordingly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.forgejo/workflows/release.yml

@@ -11,9 +11,8 @@ name: Release
 # Settings -> Actions -> Secrets. Without it the build still runs; only the
 # upload step is skipped.
 on:
-  push:
-    tags:
-      - "v*"
+  release:
+    types: [published]
   workflow_dispatch:
 
 jobs:
@@ -71,8 +70,9 @@ jobs:
           rm -rf /var/lib/apt/lists/*
 
       - name: Derive version
-        # On a tag push, strip the leading "v" so artifact names and the injected
-        # app version match the release tag.
+        # On a release, strip the leading "v" so artifact names and the injected
+        # app version match the release tag (the release event still sets
+        # GITHUB_REF_TYPE=tag / GITHUB_REF_NAME=<tag>).
         id: version
         run: |
           if [ "${GITHUB_REF_TYPE:-}" = "tag" ]; then
@@ -93,14 +93,16 @@ jobs:
           mkdir -p dist/release
           cp dist/linux/*.tar.gz dist/windows/*.zip dist/release/
 
-      - name: Publish release
-        if: ${{ startsWith(github.ref, 'refs/tags/') }}
+      - name: Attach assets to release
+        # Only runs for the release event; the release already exists, so this
+        # uploads the built archives to it. Skipped on workflow_dispatch.
+        if: ${{ github.event_name == 'release' }}
         uses: https://code.forgejo.org/actions/forgejo-release@v2
         with:
           direction: upload
           url: https://codeberg.org
           repo: ${{ github.repository }}
-          tag: ${{ github.ref_name }}
+          tag: ${{ github.event.release.tag_name }}
           release-dir: dist/release
           token: ${{ secrets.RELEASE_TOKEN }}
           override: true

.github/workflows/release.yml

@@ -1,18 +1,17 @@
 name: Release
 
-# Build the Linux (amd64/arm64) and Windows (amd64) binaries whenever a version
-# tag is pushed, then attach the packaged archives to a GitHub Release.
+# Build the Linux (amd64/arm64) and Windows (amd64) binaries whenever a GitHub
+# Release is published, then attach the packaged archives to that release.
 #
 # Everything runs inside golang:1.22-bookworm — the same base image as the
 # repo Dockerfile — so the CGO/Fyne toolchain matches the local release builds.
 # The Windows binary is cross-compiled with MinGW-w64 from the same Linux job,
 # which is why no windows-latest runner is needed.
 on:
-  push:
-    tags:
-      - "v*"
-  # Allow a manual run (from the Actions tab) to smoke-test the build without a
-  # tag. Manual runs build the artifacts but do not publish a release.
+  release:
+    types: [published]
+  # Allow a manual run (from the Actions tab) to smoke-test the build without
+  # publishing a release. Manual runs build the artifacts but upload nothing.
   workflow_dispatch:
 
 permissions:
@@ -58,9 +57,11 @@ jobs:
           rm -rf /var/lib/apt/lists/*
 
       - name: Derive version
-        # For a tag push, use the tag without its leading "v" so the artifact
-        # names and the injected app version match the release. Otherwise fall
-        # back to the version in source (handled by the build script).
+        # For a release, use the tag without its leading "v" so the artifact
+        # names and the injected app version match the release (the release
+        # event still sets GITHUB_REF_TYPE=tag / GITHUB_REF_NAME=<tag>).
+        # Otherwise fall back to the version in source (handled by the build
+        # script).
         id: version
         run: |
           ref="${GITHUB_REF_NAME:-}"
@@ -83,11 +84,13 @@ jobs:
             dist/linux/*.tar.gz
             dist/windows/*.zip
 
-      - name: Publish release
-        if: startsWith(github.ref, 'refs/tags/')
+      - name: Attach assets to release
+        # Only runs for the release event; the release already exists, so this
+        # just uploads the built archives to it. Skipped on workflow_dispatch.
+        if: github.event_name == 'release'
         uses: softprops/action-gh-release@v2
         with:
+          tag_name: ${{ github.event.release.tag_name }}
           files: |
             dist/linux/*.tar.gz
             dist/windows/*.zip
-          generate_release_notes: true

docs/DEVELOPMENT.md

@@ -144,17 +144,20 @@ The Windows binary is cross-compiled with MinGW-w64 from the Linux job, so no
 Windows runner is required. Each archive contains the executable plus `README.md`
 and `CHANGELOG.md`, matching the local `package-*` scripts.
 
-To cut a release, bump `src/app/version.go` and push a matching `v` tag:
+To cut a release, bump `src/app/version.go`, then create and publish a release
+with a matching `v` tag on the forge (GitHub Releases / Codeberg releases). You
+can do that from the web UI or the CLI, e.g.:
 
 ```bash
 git tag v0.11.5
 git push origin v0.11.5   # and to the Codeberg remote
+gh release create v0.11.5 --generate-notes   # GitHub; publishes the release
 ```
 
-The workflow strips the leading `v` from the tag and injects it as the version,
-so the tag must match `version.go`. Pushing the tag triggers the build and
-attaches the archives to a release on that forge. `workflow_dispatch` also allows
-a manual, publish-free build to smoke-test the pipeline.
+Publishing the release triggers the workflow: it strips the leading `v` from
+the tag and injects it as the version (so the tag must match `version.go`),
+builds the archives, and attaches them to that release. `workflow_dispatch`
+also allows a manual, upload-free build to smoke-test the pipeline.
 
 Codeberg publishing needs a repository secret named `RELEASE_TOKEN` (a Codeberg
 access token with the `write:repository` scope) under