ci: publish releases via GitHub Actions

Author: captain686

.github/workflows/build.yml

@@ -34,7 +34,7 @@ jobs:
     name: Build (${{ matrix.arch }})
     runs-on: ${{ matrix.os }}
     permissions:
-      contents: write
+      contents: read
       id-token: write
       attestations: write
       artifact-metadata: write
@@ -137,15 +137,6 @@ jobs:
           mv target/${{ matrix.target }}/release/warpgate dist/warpgate-${{ env.GITHUB_REF_SLUG }}-${{ matrix.arch }}
           mv cdx.xml dist/warpgate-${{ env.GITHUB_REF_SLUG }}-${{ matrix.arch }}.cdx.xml
 
-      - name: Upload release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
-        if: startsWith(github.ref, 'refs/tags/v')
-        with:
-          draft: true
-          generate_release_notes: true
-          files: dist/*
-          token: ${{ secrets.GITHUB_TOKEN }}
-
   config-schema:
     name: Config schema check
     runs-on: ubuntu-24.04
@@ -169,3 +160,32 @@ jobs:
           mkdir warpgate-web/dist
           just config-schema
           git diff --exit-code config-schema.json
+
+  publish-release:
+    name: Publish release
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - build
+      - config-schema
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          path: dist
+          pattern: warpgate-*
+          merge-multiple: true
+
+      - name: Publish GitHub release
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
+          draft: false
+          prerelease: ${{ contains(github.ref_name, '-') }}
+          generate_release_notes: true
+          files: dist/*
+          token: ${{ secrets.GITHUB_TOKEN }}