ci: replace semantic-release with tag-triggered manual release

.github/workflows/ci.yml

@@ -33,18 +33,3 @@ jobs:
       - uses: shogo82148/actions-goveralls@v1
         with:
           path-to-profile: ./profile.cov
-
-  semantic-release:
-    needs: [test]
-    runs-on: ubuntu-latest
-    steps:
-
-      - uses: actions/checkout@v2
-
-      - name: Run semantic-release
-        if: github.repository == 'casbin/mongodb-adapter' && github.event_name == 'push'
-        run: |
-          npm install --save-dev semantic-release@17.2.4
-          npx semantic-release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,95 @@
+name: Release
+
+# Releases are cut manually by pushing a git tag:
+#   v1.4.0-rc1 -> GitHub pre-release only (source package for the Apache vote)
+#   v1.4.0     -> GitHub release (the Go module is published automatically by
+#                 proxy.golang.org once the tag exists)
+#
+# The release manager downloads the source package from the release, signs it
+# locally with their own GPG key, and uses it for the vote. This workflow does
+# not sign anything and does not touch any other Apache infrastructure.
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    if: ${{ github.repository == 'apache/casbin-mongodb-adapter' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Compute release metadata
+        id: meta
+        run: |
+          TAG_NAME="${GITHUB_REF_NAME}"
+
+          if [[ "${TAG_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            PRERELEASE=false
+          elif [[ "${TAG_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-rc[0-9]+$ ]]; then
+            PRERELEASE=true
+          else
+            echo "Unsupported release tag: ${TAG_NAME}. Use v1.2.3 or v1.2.3-rc1." >&2
+            exit 1
+          fi
+
+          VERSION="${TAG_NAME#v}"
+          BASENAME="casbin-mongodb-adapter-${VERSION}-incubating-src"
+
+          {
+            echo "tag=${TAG_NAME}"
+            echo "version=${VERSION}"
+            echo "basename=${BASENAME}"
+            echo "prerelease=${PRERELEASE}"
+          } >> "${GITHUB_OUTPUT}"
+
+      - name: Build source release tarball
+        env:
+          BASENAME: ${{ steps.meta.outputs.basename }}
+          TAG: ${{ steps.meta.outputs.tag }}
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          git archive --format=tar.gz --prefix="${BASENAME}/" -o "dist/${BASENAME}.tar.gz" "${TAG}"
+          cd dist
+          sha512sum "${BASENAME}.tar.gz" > "${BASENAME}.tar.gz.sha512"
+          sha512sum -c "${BASENAME}.tar.gz.sha512"
+          ls -l
+
+      - name: Write release notes
+        env:
+          VERSION: ${{ steps.meta.outputs.version }}
+          PRERELEASE: ${{ steps.meta.outputs.prerelease }}
+          BASENAME: ${{ steps.meta.outputs.basename }}
+        run: |
+          if [[ "${PRERELEASE}" == "true" ]]; then
+            printf 'Release candidate for version `%s`. This is **not** a released version; it is the source artifact for the Apache release vote.\n' "${VERSION%%-rc*}"
+          else
+            printf 'Version `%s`.\n' "${VERSION}"
+          fi
+          printf '\n| Asset | Description |\n| --- | --- |\n'
+          printf '| `%s.tar.gz` | Source release |\n' "${BASENAME}"
+          printf '| `%s.tar.gz.sha512` | SHA-512 checksum |\n\n' "${BASENAME}"
+          printf 'The release manager signs the tarball locally with their own GPG key before starting the vote.\n'
+        # shellcheck: the script above deliberately keeps release notes minimal
+        # (per the project's policy: no extra Apache processes in CI).
+
+      - name: Create GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.meta.outputs.tag }}
+          name: Casbin MongoDB Adapter ${{ steps.meta.outputs.tag }}
+          body_path: release-notes.md
+          draft: false
+          prerelease: ${{ steps.meta.outputs.prerelease == 'true' }}
+          files: |
+            dist/${{ steps.meta.outputs.basename }}.tar.gz
+            dist/${{ steps.meta.outputs.basename }}.tar.gz.sha512

DISCLAIMER

@@ -0,0 +1,5 @@
+Apache Casbin (Incubating) is an effort undergoing incubation at the Apache Software Foundation (ASF), sponsored by the Apache Incubator PMC.
+
+Incubation is required of all newly accepted projects until a further review indicates that the infrastructure, communications, and decision making process have stabilized in a manner consistent with other successful ASF projects.
+
+While incubation status is not necessarily a reflection of the completeness or stability of the code, it does indicate that the project has yet to be fully endorsed by the ASF.

NOTICE

@@ -0,0 +1,8 @@
+Apache Casbin (Incubating)
+Copyright 2026 The Apache Software Foundation
+
+This product includes software developed at
+The Apache Software Foundation (https://www.apache.org/).
+
+Portions of this software were originally developed by the Casbin project.
+Copyright 2017-2026 The casbin Authors.