From d3d62e46564aa23cf2e8bc5eb4900e0ec7f8bc3b Mon Sep 17 00:00:00 2001
From: Steve Calvert <steve.calvert@glean.com>
Date: Wed, 28 Oct 2026 15:02:10 -0700
Subject: [PATCH] ci: create a release in each output repo after syncing

The publish workflow updated claude-plugins, cursor-plugins and
codex-plugins but never created a GitHub Release in them, so their
Releases pages stopped at the last release someone made by hand
(v3.5.0).

After the sync PR merges, tag the merged commit in the output repo and
create a release with the same version and notes as the source release.
Skip a tag that already has a release, so re-running a sync is safe, and
mark it latest only when it is the source repo's latest release.
---
 .github/workflows/publish.yml | 36 ++++++++++++++++++++++++++++++++++-
 RELEASE.md                    |  6 +++++-
 2 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 72047cb..d739ec4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -2,7 +2,8 @@ name: Publish plugins
 
 # Sync generated plugin output into the published install-surface repos.
 # Runs on a published release: opens or updates a sync PR in each output repo,
-# then merges it. Can also be dispatched by hand: check mode from any ref
+# merges it, then tags the synced commit and creates a matching release in the
+# output repo. Can also be dispatched by hand: check mode from any ref
 # (fails if any output is stale), and sync mode from a release tag only, to
 # re-run a release's sync.
 on:
@@ -132,3 +133,36 @@ jobs:
           done
           echo "::error::Couldn't merge $REPO#$PR. Check that pluginpack-sync can bypass pull request reviews in $REPO, then merge the PR by hand."
           exit 1
+
+      # Give the output repo a release for this version, so its Releases page
+      # shows what it serves. The release tags the commit the sync PR merged,
+      # or the output repo's default branch when the output didn't change. A
+      # tag that already has a release is left alone, so re-running a release's
+      # sync is safe.
+      - name: Release ${{ matrix.repo }}
+        if: (inputs.mode || 'sync') == 'sync' && startsWith(github.ref, 'refs/tags/v')
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          SOURCE_TOKEN: ${{ github.token }}
+          REPO: gleanwork/${{ matrix.repo }}
+          PR: ${{ steps.sync.outputs.pr-number }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          if gh release view "$TAG" --repo "$REPO" > /dev/null 2>&1; then
+            echo "$REPO already has a release for $TAG."
+            exit 0
+          fi
+          if [ -n "$PR" ]; then
+            target=$(gh pr view "$PR" --repo "$REPO" --json mergeCommit --jq .mergeCommit.oid)
+          else
+            target=$(gh api "repos/$REPO/commits/HEAD" --jq .sha)
+          fi
+          notes="$RUNNER_TEMP/release-notes.md"
+          GH_TOKEN="$SOURCE_TOKEN" gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json body --jq .body > "$notes"
+          printf '\nBuilt from [%s %s](%s/%s/releases/tag/%s).\n' "$GITHUB_REPOSITORY" "$TAG" "$GITHUB_SERVER_URL" "$GITHUB_REPOSITORY" "$TAG" >> "$notes"
+          # Mark it latest only when it is the source repo's latest release, so
+          # re-running an older tag's sync doesn't relabel the output repo.
+          latest=$(GH_TOKEN="$SOURCE_TOKEN" gh release view --repo "$GITHUB_REPOSITORY" --json tagName --jq .tagName)
+          if [ "$latest" = "$TAG" ]; then make_latest=true; else make_latest=false; fi
+          gh release create "$TAG" --repo "$REPO" --target "$target" \
+            --title "Release ${TAG#v}" --notes-file "$notes" --latest="$make_latest"
diff --git a/RELEASE.md b/RELEASE.md
index b362b22..8722081 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -103,10 +103,14 @@ Publishing the GitHub Release triggers
    `gleanwork/codex-plugins`), on a machine-owned `pluginpack/sync-<target>`
    branch labeled `pluginpack-sync`.
 3. Squash-merges each sync PR. Users get the release once these merge.
+4. Tags the merged commit in each output repo and creates a GitHub Release
+   there with the same version and notes, for example `Release 3.6.1`. If a
+   release for that tag already exists, it is left alone.
 
 The merge step needs `pluginpack-sync` to be allowed to bypass pull request
 reviews in each output repo. If a merge fails, the job says which PR to
-merge by hand.
+merge by hand. The job then stops before step 4. After you merge the PR,
+re-run the release's sync (below) to create the output repo releases.
 
 The sync PRs are regenerated and force-pushed on every sync — **don't push
 to them by hand or hand-edit their content**.