ci(release): build CLI artifacts inline with release-please

When release-please-action creates the GitHub Release using the default
GITHUB_TOKEN, the resulting tag push does NOT fire downstream workflows
listening on `on: push: tags` — GitHub's anti-recursion guard. The repo
worked around this by setting RELEASE_PLEASE_TOKEN to a PAT for v0.1.0
through v0.1.4, but that token has apparently expired: v0.1.5 was cut on
2026-05-14 with no artifacts attached.

Move the GoReleaser job into release-please.yml as a second job gated on
the action's `release_created` output. Now artifacts ship in the same
workflow that cut the release — no cross-workflow token dance, no PAT
maintenance burden.

Keep release-cli.yml as a fallback path with both `push: tags` and a new
`workflow_dispatch` (with a `tag` input). The dispatch path makes it
trivial to backfill artifacts on a release that missed them.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Author: HuanCheng65

.github/workflows/release-cli.yml

@@ -1,9 +1,23 @@
 name: Release CLI
 
+# Fallback / manual entry point for building CLI release artifacts.
+# The primary build path is now release-please.yml's goreleaser job, which
+# runs inline when release-please creates a Release. This workflow exists
+# to handle:
+#   - manually-pushed v* tags (someone tags by hand, bypassing release-please)
+#   - rebuilds via workflow_dispatch (e.g. backfilling a release whose
+#     artifacts went missing for any reason)
+
 on:
   push:
     tags:
       - "v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to build (e.g. v0.1.5)"
+        required: true
+        type: string
 
 permissions:
   contents: write
@@ -15,6 +29,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ inputs.tag || github.ref_name }}
 
       - uses: actions/setup-go@v5
         with:
@@ -33,4 +48,3 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GOFLAGS: -mod=readonly
-

.github/workflows/release-please.yml

@@ -20,9 +20,49 @@ permissions:
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
       - uses: googleapis/release-please-action@v4
+        id: release
         with:
           token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
           config-file: .release-please-config.json
           manifest-file: .release-please-manifest.json
+
+  # When the release-please-action above creates a new GitHub Release, the
+  # tag it pushes is authored by the default GITHUB_TOKEN, which GitHub's
+  # anti-recursion guard prevents from firing `on: push: tags` workflows.
+  # That's why a separate release-cli.yml listening on `v*` tag pushes
+  # silently fails for release-please-created tags. To avoid depending on a
+  # PAT/App token in `RELEASE_PLEASE_TOKEN` (which has historically expired
+  # and broken releases), we build artifacts in this same workflow,
+  # conditional on release-please's `release_created` output.
+  goreleaser:
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.release-please.outputs.tag_name }}
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run CLI tests
+        run: go test -mod=readonly ./apps/cli/...
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser
+          version: latest
+          args: release --clean --config .goreleaser-cli.yml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GOFLAGS: -mod=readonly