feat: configure release-please

.github/workflows/release-please.yml

@@ -0,0 +1,26 @@
+name: release-please
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: release-please-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@v4
+        with:
+          token: ${{ secrets.GH_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.1.0"
+}

README.md

@@ -76,9 +76,10 @@ task check     # PR gate: lint + typecheck + tests
 task build     # release .app + .dmg in src-tauri/target/release/bundle/
 ```
 
-Release builds are created by `.github/workflows/release.yml`.
+Releases are proposed by `.github/workflows/release-please.yml` and packaged by `.github/workflows/release.yml`.
 
-- Normal release: create and publish a GitHub Release with a `v*` tag, for example `v0.1.0`. Publishing the release triggers the cross-platform build and attaches the packages back to that release.
+- Normal release: merge the Release Please PR. It bumps versions, updates `CHANGELOG.md`, creates a `v*` GitHub Release, and publishing that release triggers the cross-platform build.
+- Release Please needs a `GH_TOKEN` repository secret backed by a PAT or GitHub App token with contents and pull-request write access. The default `GITHUB_TOKEN` is intentionally not used because releases it creates do not trigger the packaging workflow.
 - Manual repair path: GitHub Actions → **release** → Run workflow → enter a SemVer version without `v`, for example `0.1.0`. Leave `draft` unchecked to publish it immediately, or check it for a private review pass.
 - Packages built: macOS universal `.dmg`, Windows x64 NSIS installer, Windows ARM64 NSIS installer, Linux x64 `.AppImage`, and Linux x64 `.deb`.
 - `SHA256SUMS.txt` is attached to each release for package integrity checks, and GitHub provenance attestations are generated for the release packages.

release-please-config.json

@@ -0,0 +1,40 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "rust",
+  "bootstrap-sha": "b8a67c26adecb5036130d5e67af3aec5f98109b9",
+  "include-component-in-tag": false,
+  "plugins": [
+    {
+      "type": "cargo-workspace",
+      "updateAllPackages": true
+    }
+  ],
+  "packages": {
+    ".": {
+      "package-name": "adhd-ranch",
+      "changelog-path": "CHANGELOG.md",
+      "extra-files": [
+        {
+          "type": "json",
+          "path": "package.json",
+          "jsonpath": "$.version"
+        },
+        {
+          "type": "json",
+          "path": "package-lock.json",
+          "jsonpath": "$.version"
+        },
+        {
+          "type": "json",
+          "path": "package-lock.json",
+          "jsonpath": "$.packages[''].version"
+        },
+        {
+          "type": "json",
+          "path": "src-tauri/tauri.conf.json",
+          "jsonpath": "$.version"
+        }
+      ]
+    }
+  }
+}