ci: publish github release from build artifact

.github/workflows/pipeline.yml

@@ -169,6 +169,41 @@ jobs:
           XWORKMATE_BRIDGE_ARTIFACT_PATH: ${{ github.workspace }}/xworkmate-bridge/dist/xworkmate-bridge
         run: bash ./scripts/github-actions/deploy.sh "${{ steps.deploy_meta.outputs.target_host }}" "${{ steps.deploy_meta.outputs.run_apply }}" ../playbooks
 
+  publish_release:
+    name: Publish GitHub Release
+    needs: build
+    if: ${{ github.event_name != 'pull_request' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download build artifact
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
+        with:
+          name: ${{ needs.build.outputs.artifact_name }}
+          path: dist
+
+      - name: Resolve release metadata
+        id: release_meta
+        run: |
+          short_sha="${GITHUB_SHA::7}"
+          tag="main-${short_sha}"
+          title="main ${short_sha}"
+
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+          echo "title=${title}" >> "$GITHUB_OUTPUT"
+
+      - name: Publish GitHub release
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${{ steps.release_meta.outputs.tag }}" \
+            dist/xworkmate-bridge#xworkmate-bridge-linux-amd64 \
+            --repo "${{ github.repository }}" \
+            --target "${{ github.sha }}" \
+            --title "${{ steps.release_meta.outputs.title }}" \
+            --notes "Automated release for ${GITHUB_SHA}."
+
   validate:
     name: Validate
     needs: deploy