ci(release): integrate Windows ABE payload into goreleaser

[moonD4rk]

Summary

• Wires the Windows reflective-injection ABE payload into the GoReleaser pipeline so release archives for windows-amd64 ship with it (previously only make build-windows produced an ABE-capable binary)
• Adds mode / tag / draft workflow inputs so releases can be triggered as snapshot dry-runs or real tagged drafts from the GitHub UI
• Snapshot mode uploads dist/ as an artifact for offline verification

Changes

• .goreleaser.yml: make payload in before.hooks; new hack-browser-data-windows-amd64 build with tags: [abe_embed]; original build now ignores windows/amd64; archives.ids lists both builds
• .github/workflows/release.yml: mode (snapshot/release), tag, draft inputs; mlugg/setup-zig@v2 installs zig 0.16.0; conditional snapshot vs release goreleaser steps; snapshot artifact upload

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.60%. Comparing base (15680c1) to head (7d05a8c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #590   +/-   ##
=======================================
  Coverage   73.60%   73.60%           
=======================================
  Files          61       61           
  Lines        2815     2815           
=======================================
  Hits         2072     2072           
  Misses        553      553           
  Partials      190      190           

Flag	Coverage Δ
unittests	73.60% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Integrates the Windows ABE reflective-injection payload into the GoReleaser-based release pipeline and adds workflow_dispatch inputs to support snapshot vs. tagged release runs from the GitHub UI.

Changes:

• Added a dedicated windows/amd64 GoReleaser build that compiles with the abe_embed build tag and included it in archives.
• Added a make payload step to GoReleaser before.hooks to generate the embedded payload during releases.
• Updated the release workflow to support mode/tag/draft inputs, install Zig, run snapshot vs. release conditionally, and upload dist/ for snapshot runs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
.goreleaser.yml	Adds payload generation hook and a separate Windows/amd64 build ID to embed the ABE payload in release artifacts.
.github/workflows/release.yml	Adds dispatch inputs, Zig setup, tag creation, conditional GoReleaser execution, and snapshot artifact upload.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

git tag will fail if the tag already exists locally or on the remote (common when re-running a manual release). Add an explicit check for an existing tag (local + git ls-remote --tags) and fail with a clear error before attempting to create/push it, rather than failing mid-workflow.

Suggested change

	git tag ${{ inputs.tag }}
	git push origin ${{ inputs.tag }}
	TAG="${{ inputs.tag }}"
	if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then
	echo "::error::Tag '$TAG' already exists locally"
	exit 1
	fi
	if git ls-remote --tags --exit-code origin "refs/tags/$TAG" >/dev/null 2>&1; then
	echo "::error::Tag '$TAG' already exists on origin"
	exit 1
	fi
	git tag "$TAG"
	git push origin "$TAG"

[Copilot]

The inputs.tag value is interpolated directly into a multi-line shell script without quoting. For workflow_dispatch, a crafted tag containing shell metacharacters (e.g., v1.2.3; ...) would be executed by the runner. Quote and pass the tag as a single argument (e.g., git tag -- "..." / git push origin -- "...") to avoid command injection.

Suggested change

	run: |
	git tag ${{ inputs.tag }}
	git push origin ${{ inputs.tag }}
	env:
	TAG: ${{ inputs.tag }}
	run: |
	git tag -- "$TAG"
	git push origin -- "$TAG"

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

make payload is run as a standalone workflow step, but the PR description indicates this should be handled by GoReleaser (before.hooks). Keeping the payload generation in only one place will reduce drift (e.g., local goreleaser release --snapshot vs CI) and make it clearer which component owns the Zig/payload prerequisite.

Suggested change

	- name: Build ABE payload
	run: make payload