ci: add fmt/clippy/test checks and a release build workflow

.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: ci
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: fmt + clippy + test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install pinned Rust toolchain
+        run: rustup show
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Format
+        run: cargo fmt --all --check
+
+      - name: Clippy
+        run: cargo clippy --workspace --all-targets --locked -- -D warnings
+
+      - name: Test
+        run: cargo test --workspace --locked

.github/workflows/release.yml

@@ -0,0 +1,101 @@
+name: release
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v0.2.0)"
+        required: true
+        type: string
+      prerelease:
+        description: "Mark the release as a pre-release"
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: build ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-pc-windows-msvc
+            os: windows-latest
+            ext: .exe
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-latest
+            ext: ""
+          - target: x86_64-apple-darwin
+            os: macos-latest
+            ext: ""
+          - target: aarch64-apple-darwin
+            os: macos-latest
+            ext: ""
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install pinned Rust toolchain
+        run: rustup show
+
+      - name: Add the build target
+        run: rustup target add ${{ matrix.target }}
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.target }}
+
+      - name: Build standarflow CLI
+        run: cargo build --release --locked --target ${{ matrix.target }} -p standarflow-cli
+
+      - name: Stage release asset
+        run: |
+          mkdir -p dist
+          cp "target/${{ matrix.target }}/release/standarflow${{ matrix.ext }}" \
+             "dist/standarflow-${{ matrix.target }}${{ matrix.ext }}"
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: standarflow-${{ matrix.target }}
+          path: dist/standarflow-${{ matrix.target }}${{ matrix.ext }}
+          if-no-files-found: error
+
+  release:
+    name: draft release
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@v6
+        with:
+          path: artifacts
+
+      - name: Collect assets and checksums
+        run: |
+          mkdir -p dist
+          find artifacts -type f -name 'standarflow-*' -exec cp {} dist/ \;
+          cd dist
+          sha256sum standarflow-* > sha256sums.txt
+          echo "=== assets ==="
+          ls -la
+          echo "=== sha256sums.txt ==="
+          cat sha256sums.txt
+
+      - name: Publish draft release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${{ inputs.tag }}" \
+            --repo "${{ github.repository }}" \
+            --target "${{ github.sha }}" \
+            --title "standarflow ${{ inputs.tag }}" \
+            --notes "Automated build for ${{ inputs.tag }}." \
+            --draft \
+            ${{ inputs.prerelease && '--prerelease' || '' }} \
+            dist/standarflow-* dist/sha256sums.txt