ci: publish versioned 0.1.1 release artifact

.github/workflows/ci.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Upload package and checksum
         uses: actions/upload-artifact@v4
         with:
-          name: openclaw-armada-dm-${{ github.sha }}
+          name: ${{ steps.pack.outputs.package_file }}
           path: |
             ${{ steps.pack.outputs.package_file }}
             ${{ steps.pack.outputs.package_file }}.sha256

.github/workflows/release.yml

@@ -0,0 +1,52 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.22.3
+          cache: npm
+      - name: Verify version tag
+        shell: bash
+        run: |
+          package_version="$(node -p 'require("./package.json").version')"
+          if [[ "${GITHUB_REF_NAME}" != "v${package_version}" ]]; then
+            echo "::error::Tag ${GITHUB_REF_NAME} does not match package version ${package_version}."
+            exit 1
+          fi
+      - run: npm install
+      - run: npm test
+      - run: npm run build
+      - run: npm run package:validate
+      - name: Pack release and write SHA-256 checksum
+        id: pack
+        shell: bash
+        run: |
+          package_file="$(npm pack --silent)"
+          sha256sum "${package_file}" > "${package_file}.sha256"
+          echo "package_file=${package_file}" >> "${GITHUB_OUTPUT}"
+      - name: Verify SHA-256 checksum
+        shell: bash
+        run: sha256sum --check "${{ steps.pack.outputs.package_file }}.sha256"
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            "${{ steps.pack.outputs.package_file }}" \
+            "${{ steps.pack.outputs.package_file }}.sha256" \
+            --verify-tag \
+            --title "${GITHUB_REF_NAME}" \
+            --generate-notes

README.md

@@ -31,9 +31,9 @@ For a standard OpenClaw installation, pack and install the managed artifact:
 
 ```bash
 npm pack
-sha256sum openclaw-armada-dm-0.1.0.tgz > openclaw-armada-dm-0.1.0.tgz.sha256
-sha256sum --check openclaw-armada-dm-0.1.0.tgz.sha256
-openclaw plugins install npm-pack:/absolute/path/openclaw-armada-dm-0.1.0.tgz
+sha256sum openclaw-armada-dm-0.1.1.tgz > openclaw-armada-dm-0.1.1.tgz.sha256
+sha256sum --check openclaw-armada-dm-0.1.1.tgz.sha256
+openclaw plugins install npm-pack:/absolute/path/openclaw-armada-dm-0.1.1.tgz
 openclaw plugins enable armada-dm
 openclaw gateway restart
 ```
@@ -43,6 +43,21 @@ the install, test, build, validation, and pack sequence. The workflow artifact
 contains both the `.tgz` package and its `.sha256` file so a downloaded package
 can be checked with `sha256sum --check <package>.tgz.sha256`.
 
+## Publishing a GitHub release
+
+Maintainers can publish the package and checksum in the repository's Releases
+section by pushing a version tag after its version bump reaches `main`:
+
+```bash
+git tag -a v0.1.1 -m "v0.1.1"
+git push origin v0.1.1
+```
+
+The tag must exactly match `v` followed by the version in `package.json`. The
+release workflow repeats the install, test, build, package-validation, pack, and
+checksum sequence before creating the GitHub release. It attaches
+`openclaw-armada-dm-0.1.1.tgz` and its `.sha256` checksum as release assets.
+
 The published `setup-entry.js` uses only the OpenClaw `2026.6.1` public SDK compatibility baseline, while deployment requires patched OpenClaw `2026.7.2-beta.6` or newer. It does not run a wizard, prompt for values, edit configuration, read the secret file, publish events, or start relay connections.
 
 ## Migrating another Nostr channel

package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-armada-dm",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "OpenClaw channel plugin for private Armada NIP-17 direct messages",
   "type": "module",
   "main": "./dist/index.js",

src/__tests__/metadata.test.ts

@@ -127,6 +127,25 @@ describe("package and manifest contracts", () => {
     expect(workflow).toContain("npm pack");
     expect(workflow).toContain("sha256sum");
     expect(workflow).toContain("actions/upload-artifact@v4");
+    expect(workflow).toContain("name: ${{ steps.pack.outputs.package_file }}");
+  });
+
+  it("publishes checksummed packages as version-tagged GitHub releases", async () => {
+    const workflow = await readFile(
+      new URL(".github/workflows/release.yml", root),
+      "utf8",
+    );
+
+    expect(workflow).toContain('tags: ["v*"]');
+    expect(workflow).toContain("contents: write");
+    expect(workflow).toContain("npm install");
+    expect(workflow).toContain("npm test");
+    expect(workflow).toContain("npm run build");
+    expect(workflow).toContain("npm run package:validate");
+    expect(workflow).toContain("npm pack");
+    expect(workflow).toContain("sha256sum");
+    expect(workflow).toContain("gh release create");
+    expect(workflow).toContain("--verify-tag");
   });
 
   it("fails CI when coverage falls below the repository baseline", async () => {