fix(ci): add release build and GitHub release steps back to main pipeline

PR #79 split the pipeline into validation-only (pipeline.yml) and a
separate release pipeline (pipeline.release.yml), but the release
pipeline was never wired in Buildkite. Merging to main created a
tag but no binary or GitHub release.

Fix: restore release_build (binary + sha256) and GitHub release steps
after the tag step in pipeline.yml, so a single run produces both the
tag and the release. The release pipeline remains available as a
standalone option for manually pushed tags.

Also merges build+checksum into one step in pipeline.release.yml
to match the same-agent optimization done in pipeline.yml.

Author: alexhraber

.buildkite/pipeline.release.yml

@@ -4,28 +4,20 @@
 cache: ".buildkite/cache-volume"
 
 steps:
-  - label: ":golang: Build Release Binary"
+  - label: ":golang: Build + Checksum"
     key: build
     command: |
       echo "--- Building release binary for ${BUILDKITE_TAG}"
       .buildkite/setup-go.sh go build \
         -ldflags="-s -w -X main.version=${BUILDKITE_TAG}" \
         -o builddeck ./cmd/builddeck
       echo "+++ Binary size: $(ls -lh builddeck | awk '{print $5}')"
-      buildkite-agent artifact upload builddeck
-
-  - label: ":lock: Checksum"
-    key: checksum
-    depends_on: build
-    command: |
-      echo "--- Generating SHA256 checksum"
-      buildkite-agent artifact download builddeck .
       sha256sum builddeck | tee builddeck.sha256
-      buildkite-agent artifact upload builddeck.sha256
+      buildkite-agent artifact upload "builddeck*"
 
   - label: ":rocket: GitHub Release"
     key: release
-    depends_on: checksum
+    depends_on: build
     command: .buildkite/release.sh "${BUILDKITE_TAG}"
     secrets:
       - GITHUB_TOKEN

.buildkite/pipeline.yml

@@ -59,7 +59,7 @@ steps:
       chmod +x codecov
       ./codecov -f coverage.out
 
-  - label: ":terminal: Snapshot Build"
+  - label: ":terminal: Snapshot + Checksum"
     key: snapshot
     depends_on:
       - vet
@@ -70,24 +70,50 @@ steps:
       echo "--- Building snapshot binary"
       .buildkite/setup-go.sh go build -ldflags="-s -w -X main.version=snapshot-${BUILDKITE_COMMIT:0:7}" -o builddeck ./cmd/builddeck
       echo "+++ Snapshot build succeeded: $(ls -lh builddeck | awk '{print $5}')"
-      buildkite-agent artifact upload builddeck
-
-  - label: ":lock: Checksum"
-    key: checksum
-    depends_on: snapshot
-    command: |
       sha256sum builddeck | tee builddeck.sha256
-      buildkite-agent artifact upload builddeck.sha256
+      buildkite-agent artifact upload "builddeck*"
 
   - label: ":bookmark: Tag"
     key: tag
     depends_on:
       - commitlint
       - test
-      - checksum
+      - snapshot
       - codecov
     branches: main
     command: |
       .buildkite/tag.sh
     secrets:
       - GITHUB_TOKEN
+
+  - label: ":golang: Build Release Binary"
+    key: release_build
+    depends_on: tag
+    command: |
+      echo "--- Checking for release version from tag step"
+      if buildkite-agent artifact download builddeck.tag . --step tag 2>/dev/null; then
+        VERSION=$(cat builddeck.tag)
+        echo "Version from tag step: ${VERSION}"
+      else
+        VERSION="dev"
+        echo "No tag created, building with version: ${VERSION}"
+      fi
+      echo "--- Building release binary"
+      .buildkite/setup-go.sh go build -ldflags="-s -w -X main.version=${VERSION}" -o builddeck ./cmd/builddeck
+      echo "+++ Binary size: $(ls -lh builddeck | awk '{print $5}')"
+      sha256sum builddeck | tee builddeck.sha256
+      buildkite-agent artifact upload "builddeck*"
+
+  - label: ":rocket: GitHub Release"
+    key: release
+    depends_on: release_build
+    command: |
+      if buildkite-agent artifact download builddeck.tag . --step tag 2>/dev/null; then
+        VERSION=$(cat builddeck.tag)
+        echo "Creating GitHub release for ${VERSION}"
+        .buildkite/release.sh "${VERSION}"
+      else
+        echo "No tag was created — skipping GitHub release"
+      fi
+    secrets:
+      - GITHUB_TOKEN

.buildkite/release.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # Creates a GitHub Release linked to git tag with all artifacts and generated notes.
-# Runs in the release pipeline after tag push.
+# Expects builddeck and builddeck.sha256 in the current directory (same-agent
+# after release_build step or tag-push triggered pipeline).
 # Usage: release.sh <version>
 set -euo pipefail
 
@@ -14,9 +15,6 @@ echo "+++ Creating GitHub Release ${VERSION}"
 
 cd "$(dirname "$0")/.."
 
-buildkite-agent artifact download "builddeck" . --step build 2>/dev/null || true
-buildkite-agent artifact download "builddeck.sha256" . --step checksum 2>/dev/null || true
-
 echo "=== Files in workspace ==="
 ls -la