From 59b1d8d0afee877281da97df246cfbfebc8e5136 Mon Sep 17 00:00:00 2001
From: Maximilian Arnold <max@ontora.com>
Date: Wed, 15 Jul 2026 16:42:22 +0200
Subject: [PATCH] ci: auto-cut a versioned release on merge to main; drop
 nightly

- build.yml: PR-only now (build check + downloadable artifact). Removed the
  push-to-main trigger and the rolling 'nightly' pre-release.
- auto-release.yml: on push to main, auto-increment the patch from the latest
  v* tag and dispatch nudge-release.yml (which signs, notarizes, publishes).
  Uses workflow_dispatch (a GITHUB_TOKEN exception that does trigger runs), so
  no PAT needed. Manual runs can bump minor/major via the 'bump' input.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/auto-release.yml | 60 ++++++++++++++++++++++++++++++
 .github/workflows/build.yml        | 22 ++---------
 2 files changed, 63 insertions(+), 19 deletions(-)
 create mode 100644 .github/workflows/auto-release.yml

diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
new file mode 100644
index 0000000..4528052
--- /dev/null
+++ b/.github/workflows/auto-release.yml
@@ -0,0 +1,60 @@
+name: Auto-release on merge to main
+
+# Every push to main (i.e. a merged PR) cuts a new versioned release:
+# auto-increment the patch from the latest v* tag, then hand off to
+# nudge-release.yml (which signs, notarizes, and publishes).
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: 'Which part to bump (patch/minor/major)'
+        required: false
+        default: patch
+        type: string
+
+permissions:
+  contents: read
+  actions: write
+
+concurrency:
+  group: auto-release
+  cancel-in-progress: false
+
+jobs:
+  tag-and-release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Compute next version
+        id: v
+        env:
+          BUMP: ${{ github.event.inputs.bump || 'patch' }}
+        run: |
+          set -euo pipefail
+          latest=$(git tag -l 'v*' | sed 's/^v//' | sort -V | tail -1)
+          if [[ -z "${latest}" ]]; then
+            next="0.1.0"
+          else
+            IFS=. read -r MA MI PA <<< "${latest}"
+            case "${BUMP}" in
+              major) next="$((MA+1)).0.0" ;;
+              minor) next="${MA}.$((MI+1)).0" ;;
+              *)     next="${MA}.${MI}.$((PA+1))" ;;
+            esac
+          fi
+          echo "version=${next}" >> "$GITHUB_OUTPUT"
+          echo "Latest tag: v${latest:-<none>} → next: v${next}"
+
+      - name: Dispatch signed release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.v.outputs.version }}
+        run: |
+          set -euo pipefail
+          echo "Dispatching nudge-release for v${VERSION}"
+          gh workflow run nudge-release.yml --ref main -f version="${VERSION}"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0f5c64e..5b19ed7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,9 +1,9 @@
 name: Build
 
+# PR build check + downloadable artifact. Releases are handled separately
+# (auto-release.yml on merge to main → nudge-release.yml). No nightly.
 on:
   pull_request:
-  push:
-    branches: [main]
   workflow_dispatch:
 
 concurrency:
@@ -11,7 +11,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   build:
@@ -61,19 +61,3 @@ jobs:
           path: ${{ steps.package.outputs.zip_name }}
           if-no-files-found: error
           retention-days: 14
-
-      # On merge to main, publish/refresh a rolling "nightly" pre-release.
-      - name: Publish nightly pre-release
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: nightly
-          name: Nightly (main)
-          prerelease: true
-          fail_on_unmatched_files: true
-          body: |
-            Automated unsigned build from the latest `main` (${{ github.sha }}).
-
-            ⚠️ Unsigned: on first launch, right-click the app → Open (or allow it
-            in System Settings → Privacy & Security) to bypass Gatekeeper.
-          files: ${{ steps.package.outputs.zip_name }}