From 79bbdf7e6a793e700777ad8f8402d89c50adcf10 Mon Sep 17 00:00:00 2001
From: phatpham9 <phat@onroads.xyz>
Date: Sun, 21 Jun 2026 21:56:51 +0700
Subject: [PATCH 1/2] ci: automate releases with release-please

---
 .github/workflows/cd.yml             | 60 +++++++++++++++++++++++++++-
 .github/workflows/release-please.yml | 36 +++++++++++++++++
 .release-please-manifest.json        |  3 ++
 release-please-config.json           |  8 ++++
 4 files changed, 106 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/release-please.yml
 create mode 100644 .release-please-manifest.json
 create mode 100644 release-please-config.json

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 733c5b7..e40bc58 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -6,7 +6,7 @@ on:
       - "v*.*.*"
 
 permissions:
-  contents: read
+  contents: write
   packages: write
 
 env:
@@ -58,3 +58,61 @@ jobs:
           cache-to: type=gha,mode=max
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+
+  update-release-notes:
+    runs-on: ubuntu-latest
+    needs: build-and-push
+
+    steps:
+      - name: Ensure GitHub release exists
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag="${GITHUB_REF_NAME}"
+          if ! gh release view "$tag" >/dev/null 2>&1; then
+            gh release create "$tag" --title "$tag" --generate-notes
+          fi
+
+      - name: Append container image instructions to release body
+        env:
+          GH_TOKEN: ${{ github.token }}
+          IMAGE_REF: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+        run: |
+          # GITHUB_REF_NAME comes from the trusted maintainer-created tag ref that triggered this workflow.
+          python3 <<'PY'
+          import os
+          import subprocess
+          import textwrap
+
+          tag = os.environ["GITHUB_REF_NAME"]
+          image_ref = os.environ["IMAGE_REF"]
+          marker = "## Container image"
+
+          body = subprocess.check_output(
+              ["gh", "release", "view", tag, "--json", "body", "-q", ".body"],
+              text=True,
+          )
+
+          container_section = textwrap.dedent(
+              f"""
+              ## Container image
+
+              Pull the published container from GHCR:
+
+              ```bash
+              docker pull {image_ref}:{tag.lstrip('v')}
+              docker pull {image_ref}:latest
+              ```
+              """
+          ).strip()
+
+          if marker in body:
+              body = body.split(marker, 1)[0].rstrip()
+
+          body = f"{body}\n\n{container_section}\n" if body.strip() else f"{container_section}\n"
+
+          with open("RELEASE_NOTES.md", "w", encoding="utf-8") as fh:
+              fh.write(body)
+          PY
+
+          gh release edit "$GITHUB_REF_NAME" --notes-file RELEASE_NOTES.md
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
new file mode 100644
index 0000000..300682c
--- /dev/null
+++ b/.github/workflows/release-please.yml
@@ -0,0 +1,36 @@
+name: Release Please
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: release-please-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Validate release-please token is configured
+        env:
+          RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+        run: |
+          if [ -z "$RELEASE_PLEASE_TOKEN" ]; then
+            echo "::error::Missing RELEASE_PLEASE_TOKEN secret. Configure a PAT or GitHub App token with repository write access before enabling this workflow."
+            exit 1
+          fi
+
+      - name: Run release-please
+        uses: googleapis/release-please-action@v4
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
new file mode 100644
index 0000000..37fcefa
--- /dev/null
+++ b/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "1.0.0"
+}
diff --git a/release-please-config.json b/release-please-config.json
new file mode 100644
index 0000000..7a2df43
--- /dev/null
+++ b/release-please-config.json
@@ -0,0 +1,8 @@
+{
+  "packages": {
+    ".": {
+      "release-type": "go",
+      "changelog-path": "CHANGELOG.md"
+    }
+  }
+}

From 9f55635f614ec26a5aa4decc12fd792ac07dda27 Mon Sep 17 00:00:00 2001
From: phatpham9 <phat@onroads.xyz>
Date: Sun, 21 Jun 2026 22:12:07 +0700
Subject: [PATCH 2/2] ci: simplify release-please setup

---
 .github/workflows/release-please.yml | 3 +--
 .release-please-manifest.json        | 3 ---
 release-please-config.json           | 8 --------
 3 files changed, 1 insertion(+), 13 deletions(-)
 delete mode 100644 .release-please-manifest.json
 delete mode 100644 release-please-config.json

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 300682c..a84a267 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -32,5 +32,4 @@ jobs:
         uses: googleapis/release-please-action@v4
         with:
           token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
-          config-file: release-please-config.json
-          manifest-file: .release-please-manifest.json
+          release-type: go
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
deleted file mode 100644
index 37fcefa..0000000
--- a/.release-please-manifest.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  ".": "1.0.0"
-}
diff --git a/release-please-config.json b/release-please-config.json
deleted file mode 100644
index 7a2df43..0000000
--- a/release-please-config.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "packages": {
-    ".": {
-      "release-type": "go",
-      "changelog-path": "CHANGELOG.md"
-    }
-  }
-}