From 063b20525381288cc29c2e6c29edc940efdbfdaf Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 25 Aug 2026 08:31:20 +0000
Subject: [PATCH] fix(release): actually create a GitHub Release per successful
 build

releases/latest 404s and tags is empty despite dozens of green
"Release (images + GitOps bump)" runs. Root cause: the workflow never
contained a git-tag or `gh release create` step at all -- it only
builds/pushes images and GitOps-bumps values-prod.yaml via a
self-merged PR (verified working, using GH_APPROVE_TOKEN). There was
no broken/skipped bump step to fix; the release-creation code simply
never existed.

Add a step that creates one GitHub Release per successful build,
tagged release-<short-sha> to match the image tags already pushed to
GHCR. Uses the job's existing GITHUB_TOKEN (contents: write, already
granted) -- creating a tag/Release via the API doesn't push to the
protected `main` branch, so no elevated token or new secret is needed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GaPa3JgrVNtWrGvqQEAEqv
---
 .github/workflows/release.yml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 27cf2c8..3d0fb56 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -150,6 +150,37 @@ jobs:
           GH_TOKEN="${{ secrets.GH_APPROVE_TOKEN }}" gh pr review "${PR_URL}" --approve -b "Automated GitOps release"
           GH_TOKEN="${{ secrets.GH_APPROVE_TOKEN }}" gh pr merge "${PR_URL}" --admin --squash --delete-branch
 
+      - name: Create GitHub Release
+        # Every prior run of this job built and shipped images but never recorded
+        # a tag or a Release object anywhere -- `gh api repos/.../releases/latest`
+        # 404s and `tags` is empty even though dozens of these runs have succeeded.
+        # This closes that gap: one Release per successful build, named after the
+        # same short SHA already used for the image tags above, so the Release is
+        # directly traceable to what actually got built and rolled out. Uses the
+        # job's default GITHUB_TOKEN (contents: write, already granted) -- this
+        # only creates a tag + Release via the API, it never pushes to the
+        # protected `main` branch, so it needs no elevated/admin token.
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          SHA="${{ steps.tag.outputs.sha }}"
+          TAG="release-${SHA}"
+          cat > /tmp/release-notes.md <<EOF
+          Images built and published from commit \`${GITHUB_SHA}\`, then rolled
+          out to prod via the GitOps bump PR merged to \`main\` earlier in this
+          same workflow run.
+
+          - \`ghcr.io/izzywdev/fuzeagent-orchestrator:${SHA}\`
+          - \`ghcr.io/izzywdev/fuzeagent-hierarchy-api:${SHA}\`
+          - \`ghcr.io/izzywdev/fuzeagent-ui:${SHA}\`
+          - \`ghcr.io/izzywdev/fuzeagent-mcp-server:${SHA}\`
+          - \`ghcr.io/izzywdev/fuze-a2a:${SHA}\`
+          EOF
+          gh release create "${TAG}" \
+            --target "${GITHUB_SHA}" \
+            --title "FuzeAgent ${TAG}" \
+            --notes-file /tmp/release-notes.md
+
   # ---------------------------------------------------------------------------
   # claude-runner image library (Track 4)
   # Base image must finish before variants — they all FROM it.