Add release workflow

Author: benwebber

.github/workflows/release.yaml

@@ -0,0 +1,63 @@
+on:
+  release:
+    types: [created]
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - run: |
+          cargo test --all-features --verbose
+
+  build:
+    needs: [test]
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      matrix:
+        platform:
+          - runner: ubuntu-22.04
+            target: x86_64-unknown-linux-musl
+          - runner: ubuntu-22.04
+            target: aarch64-unknown-linux-musl
+          - runner: macos-15
+            target: x86_64-apple-darwin
+          - runner: macos-15-arm
+            target: aarch64-apple-darwin
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - run: |
+          ./bin/build ${{ matrix.platform.target }} ${{ github.ref }}
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: nb-${{ matrix.platform.target }}
+          path: nb-*
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' }}
+    needs: [build]
+    permissions:
+      # Use to sign the release artifacts
+      id-token: write
+      # Used to upload release artifacts
+      contents: write
+      # Used to generate artifact attestation
+      attestations: write
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - run: |
+          sha256sum *.tar.gz >SHA256SUMS
+      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        with:
+          subject-path: 'nb-*'
+          subject-checksums: SHA256SUMS
+      - uses: svenstaro/upload-release-action@81c65b7cd4de9b2570615ce3aad67a41de5b1a13 # latest
+        with:
+          file: '*.tar.gz'
+          file_glob: true
+      - uses: svenstaro/upload-release-action@81c65b7cd4de9b2570615ce3aad67a41de5b1a13 # latest
+        with:
+          file: SHA256SUMS

bin/build

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+TARGET="${1:?target}"
+VERSION="${2:?version}"
+
+cargo build --all-features --release --target "${TARGET}" --verbose
+tar -cvzf "nb-${VERSION}-${TARGET}.tar.gz" -C "target/${TARGET}/release" nb