From 0a66cd451af6cc3953bc27a6510b1e4256d7b718 Mon Sep 17 00:00:00 2001
From: blckbx <74455114+blckbx@users.noreply.github.com>
Date: Thu, 27 Aug 2026 10:35:31 +0200
Subject: [PATCH 1/3] ci: use package version in artifact name

---
 .github/workflows/ci.yml       | 2 +-
 src/__tests__/metadata.test.ts | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 24edcea..70f1541 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,7 +48,7 @@ jobs:
       - name: Upload package and checksum
         uses: actions/upload-artifact@v4
         with:
-          name: openclaw-armada-dm-${{ github.sha }}
+          name: ${{ steps.pack.outputs.package_file }}
           path: |
             ${{ steps.pack.outputs.package_file }}
             ${{ steps.pack.outputs.package_file }}.sha256
diff --git a/src/__tests__/metadata.test.ts b/src/__tests__/metadata.test.ts
index 624f9ce..2d2ed10 100644
--- a/src/__tests__/metadata.test.ts
+++ b/src/__tests__/metadata.test.ts
@@ -127,6 +127,7 @@ describe("package and manifest contracts", () => {
     expect(workflow).toContain("npm pack");
     expect(workflow).toContain("sha256sum");
     expect(workflow).toContain("actions/upload-artifact@v4");
+    expect(workflow).toContain("name: ${{ steps.pack.outputs.package_file }}");
   });
 
   it("fails CI when coverage falls below the repository baseline", async () => {

From 2a8bba5eccbe94896a7a93cd791025c74844a136 Mon Sep 17 00:00:00 2001
From: blckbx <74455114+blckbx@users.noreply.github.com>
Date: Thu, 27 Aug 2026 10:37:52 +0200
Subject: [PATCH 2/3] chore: bump package version to 0.1.1

---
 README.md         | 6 +++---
 package-lock.json | 4 ++--
 package.json      | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index d70fad0..b3ac347 100644
--- a/README.md
+++ b/README.md
@@ -31,9 +31,9 @@ For a standard OpenClaw installation, pack and install the managed artifact:
 
 ```bash
 npm pack
-sha256sum openclaw-armada-dm-0.1.0.tgz > openclaw-armada-dm-0.1.0.tgz.sha256
-sha256sum --check openclaw-armada-dm-0.1.0.tgz.sha256
-openclaw plugins install npm-pack:/absolute/path/openclaw-armada-dm-0.1.0.tgz
+sha256sum openclaw-armada-dm-0.1.1.tgz > openclaw-armada-dm-0.1.1.tgz.sha256
+sha256sum --check openclaw-armada-dm-0.1.1.tgz.sha256
+openclaw plugins install npm-pack:/absolute/path/openclaw-armada-dm-0.1.1.tgz
 openclaw plugins enable armada-dm
 openclaw gateway restart
 ```
diff --git a/package-lock.json b/package-lock.json
index ed642a6..32bda1c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "openclaw-armada-dm",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "openclaw-armada-dm",
-      "version": "0.1.0",
+      "version": "0.1.1",
       "license": "MIT",
       "dependencies": {
         "nostr-tools": "2.25.0",
diff --git a/package.json b/package.json
index 317a1e1..b5c9eed 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "openclaw-armada-dm",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "OpenClaw channel plugin for private Armada NIP-17 direct messages",
   "type": "module",
   "main": "./dist/index.js",

From ad308dbd689190eeacae4b2903c49b4911650c7a Mon Sep 17 00:00:00 2001
From: blckbx <74455114+blckbx@users.noreply.github.com>
Date: Thu, 27 Aug 2026 10:44:38 +0200
Subject: [PATCH 3/3] ci: publish tagged package releases

---
 .github/workflows/release.yml  | 52 ++++++++++++++++++++++++++++++++++
 README.md                      | 15 ++++++++++
 src/__tests__/metadata.test.ts | 18 ++++++++++++
 3 files changed, 85 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..599ab77
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,52 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.22.3
+          cache: npm
+      - name: Verify version tag
+        shell: bash
+        run: |
+          package_version="$(node -p 'require("./package.json").version')"
+          if [[ "${GITHUB_REF_NAME}" != "v${package_version}" ]]; then
+            echo "::error::Tag ${GITHUB_REF_NAME} does not match package version ${package_version}."
+            exit 1
+          fi
+      - run: npm install
+      - run: npm test
+      - run: npm run build
+      - run: npm run package:validate
+      - name: Pack release and write SHA-256 checksum
+        id: pack
+        shell: bash
+        run: |
+          package_file="$(npm pack --silent)"
+          sha256sum "${package_file}" > "${package_file}.sha256"
+          echo "package_file=${package_file}" >> "${GITHUB_OUTPUT}"
+      - name: Verify SHA-256 checksum
+        shell: bash
+        run: sha256sum --check "${{ steps.pack.outputs.package_file }}.sha256"
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            "${{ steps.pack.outputs.package_file }}" \
+            "${{ steps.pack.outputs.package_file }}.sha256" \
+            --verify-tag \
+            --title "${GITHUB_REF_NAME}" \
+            --generate-notes
diff --git a/README.md b/README.md
index b3ac347..30f5fde 100644
--- a/README.md
+++ b/README.md
@@ -43,6 +43,21 @@ the install, test, build, validation, and pack sequence. The workflow artifact
 contains both the `.tgz` package and its `.sha256` file so a downloaded package
 can be checked with `sha256sum --check <package>.tgz.sha256`.
 
+## Publishing a GitHub release
+
+Maintainers can publish the package and checksum in the repository's Releases
+section by pushing a version tag after its version bump reaches `main`:
+
+```bash
+git tag -a v0.1.1 -m "v0.1.1"
+git push origin v0.1.1
+```
+
+The tag must exactly match `v` followed by the version in `package.json`. The
+release workflow repeats the install, test, build, package-validation, pack, and
+checksum sequence before creating the GitHub release. It attaches
+`openclaw-armada-dm-0.1.1.tgz` and its `.sha256` checksum as release assets.
+
 The published `setup-entry.js` uses only the OpenClaw `2026.6.1` public SDK compatibility baseline, while deployment requires patched OpenClaw `2026.7.2-beta.6` or newer. It does not run a wizard, prompt for values, edit configuration, read the secret file, publish events, or start relay connections.
 
 ## Migrating another Nostr channel
diff --git a/src/__tests__/metadata.test.ts b/src/__tests__/metadata.test.ts
index 2d2ed10..7c19d64 100644
--- a/src/__tests__/metadata.test.ts
+++ b/src/__tests__/metadata.test.ts
@@ -130,6 +130,24 @@ describe("package and manifest contracts", () => {
     expect(workflow).toContain("name: ${{ steps.pack.outputs.package_file }}");
   });
 
+  it("publishes checksummed packages as version-tagged GitHub releases", async () => {
+    const workflow = await readFile(
+      new URL(".github/workflows/release.yml", root),
+      "utf8",
+    );
+
+    expect(workflow).toContain('tags: ["v*"]');
+    expect(workflow).toContain("contents: write");
+    expect(workflow).toContain("npm install");
+    expect(workflow).toContain("npm test");
+    expect(workflow).toContain("npm run build");
+    expect(workflow).toContain("npm run package:validate");
+    expect(workflow).toContain("npm pack");
+    expect(workflow).toContain("sha256sum");
+    expect(workflow).toContain("gh release create");
+    expect(workflow).toContain("--verify-tag");
+  });
+
   it("fails CI when coverage falls below the repository baseline", async () => {
     const config = await readFile(new URL("vitest.config.mjs", root), "utf8");