Release automation: tag - build ZIP artifact - GitHub Release notes

[blindzero]

Goal

• Make releases repeatable and low-effort.

Scope

Release workflow (GitHub Actions)

• Trigger: tag push vX.Y.Z
• Preconditions/guards:
  • Workflow runs only for tags that point to main (or otherwise clearly documents the expected branch).
  • Validate tag version matches module manifest version(s) (ModuleVersion); mismatch fails.
• Packaging:
  • Build a curated dist ZIP (install/offline package), NOT a full repo snapshot.
  • Include:
    • src/
    • docs/
    • examples/ (if present)
    • root files: README.md, LICENSE, CHANGELOG.md, SECURITY.md, CONTRIBUTING.md, STYLEGUIDE.md
  • Exclude:
    • tests/
    • .github/
    • other CI/dev-only files
  • Naming: IdLE-vX.Y.Z.zip (or IdentityLifecycleEngine-vX.Y.Z.zip)
• GitHub Release:
  • Create/publish a GitHub Release from the tag.
  • Generate release notes automatically (keep manual notes optional).
  • Attach the dist ZIP asset to the release.
• Permissions:
  • Configure workflow permissions to allow creating releases and uploading assets (contents: write).

Release process (human steps)

• Version bump is done via a normal PR to main (using existing version bump tooling).
• Tagging is done manually by a maintainer after the bump PR is merged:
  • create and push tag vX.Y.Z on main
  • workflow reacts to the tag and publishes the release
• Maintain CHANGELOG.md and update it per release.

Acceptance Criteria

• A GitHub Release can be created from a tag without manual packaging.
• A curated dist ZIP is attached to the GitHub Release and contains the defined included files/folders (and excludes dev/CI Content).
• Release notes are created automatically (at least via GitHub generated notes).
• Release workflow validates that the tag version matches the module manifest version(s); mismatch fails.
• Workflow has the required permissions to create releases and upload assets.