Use release-pliz

.github/workflows/release-plz.yml

@@ -0,0 +1,62 @@
+name: release-plz
+
+# Turns conventional commits on master into releases:
+#
+#   1. `release-pr` keeps a "chore: release vX.Y.Z" PR open, bumping the version
+#      in Cargo.toml and writing CHANGELOG.md from the commits since the last
+#      release (feat: -> minor, fix: -> patch).
+#   2. Merging that PR makes `release` create the git tag and GitHub release.
+#   3. That new tag triggers release.yml, which builds the five targets and
+#      attaches the binaries to the release that already exists.
+#
+# Step 3 is why RELEASE_PLZ_TOKEN must be a PAT rather than the default
+# GITHUB_TOKEN: pushes made with GITHUB_TOKEN deliberately do not start new
+# workflow runs, so release.yml would never fire and no binaries would ship.
+# The same restriction would leave the release PR with no CI checks at all.
+
+on:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  # Tags and releases a version that is in Cargo.toml but not yet released.
+  # A no-op on ordinary pushes, so it only acts once the release PR merges.
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # release-plz reads the whole commit history to work out the bump.
+          fetch-depth: 0
+      - run: rustup toolchain install stable --profile minimal
+      - uses: release-plz/action@v0.5
+        with:
+          command: release
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }}
+
+  # Opens or updates the release PR.
+  release-pr:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    # Two runs racing would fight over the same PR branch.
+    concurrency:
+      group: release-plz-${{ github.ref }}
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: rustup toolchain install stable --profile minimal
+      - uses: release-plz/action@v0.5
+        with:
+          command: release-pr
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }}

README.md

@@ -86,6 +86,18 @@ cargo insta review   # or: cargo insta accept
 
 CI runs `cargo fmt --check`, `cargo clippy -- -D warnings` and the test suite on Linux, macOS and Windows; please make sure those pass before opening a pull request.
 
+### Releases
+
+Commit messages follow [Conventional Commits](https://www.conventionalcommits.org) — `feat:` for features, `fix:` for bug fixes, `chore:`/`docs:`/`refactor:` for everything else. [release-plz](https://release-plz.dev) reads them to decide the next version, so the prefix on a commit is what determines whether a release is minor or patch.
+
+Releasing is then just merging a pull request:
+
+1. release-plz keeps a `chore: release vX.Y.Z` PR open, bumping `Cargo.toml` and writing `CHANGELOG.md`.
+2. Merging it tags the commit and creates the GitHub release.
+3. The new tag triggers the release workflow, which builds macOS, Linux and Windows binaries and attaches them, along with `SHA256SUMS`.
+
+The binaries take a few minutes to appear after the release itself. Releases can also be produced by hand from Actions → Release → Run workflow, which reads the version straight from `Cargo.toml`.
+
 ## Notes
 
 - Uses the public EUVD API at `https://euvdservices.enisa.europa.eu/api`; no API key required.