ops: add goreleaser configuration and release workflow

.github/scripts/release-notes.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+#
+# Extracts the CHANGELOG.md section for a version and formats it as the GitHub
+# release body. Usage: release-notes.sh v1.5.0
+#
+# Exits non-zero when the version has no section, so a tag can never be
+# published with empty or stale release notes.
+
+set -euo pipefail
+
+if [ $# -ne 1 ]; then
+	echo "usage: $0 <version>" >&2
+	exit 2
+fi
+
+version="${1#v}"
+changelog="${CHANGELOG_FILE:-CHANGELOG.md}"
+
+if [ ! -f "$changelog" ]; then
+	echo "$changelog not found" >&2
+	exit 1
+fi
+
+notes=$(awk -v ver="$version" '
+	BEGIN { heading = "## [" ver "]" }
+	index($0, heading) == 1 { found = 1; next }
+	found && index($0, "## [") == 1 { exit }
+	found { print }
+' "$changelog")
+
+if [ -z "${notes//[[:space:]]/}" ]; then
+	echo "no $changelog section found for version $version" >&2
+	exit 1
+fi
+
+printf "## What's new in v%s\n%s\n" "$version" "$notes"

.github/workflows/release.yml

@@ -0,0 +1,33 @@
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      # Fails the release if CHANGELOG.md has no section for this tag.
+      - name: Build release notes from CHANGELOG.md
+        run: .github/scripts/release-notes.sh "${{ github.ref_name }}" > "${RUNNER_TEMP}/release-notes.md"
+
+      - uses: goreleaser/goreleaser-action@v6
+        with:
+          version: '~> v2'
+          args: release --clean --release-notes=${{ runner.temp }}/release-notes.md
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}