cppa-cursor-browser: tag-triggered release workflow that builds and attaches artifacts

[clean6378-max-it]

Sprint Item

is-8 of 13 — Task — Wednesday PR 2 of 4

Block Relations

Blocked by	—
Blocks	is-10 (soft) — if merged before the tag is pushed, artifacts attach automatically; if not, attach manually and note the gap in the Release body
Repo/day	Independent of is-1–is-6 and is-11–is-13

Calendar Day

Wednesday, July 29, 2026 (PR 2 of 4)

Planned Effort

3 story points (Task) — sprint item is-8

Problem

There is no release automation in .github/workflows/ — only tests.yml and update-lock.yml — so releases are entirely manual.

The build tooling already exists and is unused by any release path:

• hatchling produces a wheel and sdist via [tool.hatch.build.targets.wheel] and [tool.hatch.build.targets.sdist] (pyproject.toml lines 66-80);
• CI already builds a Windows PyInstaller bundle in tests.yml (lines 120-133) from cursor-browser.spec, onedir output at dist/CursorChatBrowser/CursorChatBrowser.exe.

None of it is wired to tag pushes or Release asset upload.

Goal

One PR adding .github/workflows/release.yml that fires on v* tag pushes, builds the Python distributables and the Windows bundle, and attaches all three as Release assets.

Scope

Part A — trigger

• New .github/workflows/release.yml triggering on push of tags matching v*.

Part B — Python distributables

• pip install build && python -m build against the existing hatchling config → wheel + sdist.
• Upload both as GitHub Release assets.

Part C — Windows bundle

• On windows-latest, reuse the existing steps from tests.yml lines 123-133:
  • install pyinstaller>=6,<7
  • run pyinstaller cursor-browser.spec --noconfirm
  • zip dist/CursorChatBrowser/
• Upload the zip as a Release asset.

Part D — attachment and pinning

• Attach via softprops/action-gh-release or the GitHub CLI.
• Pin Actions to commit SHAs, matching the tests.yml convention.

Part E — evidence

• A test tag push in a fork, or a dry run, documenting the expected artifact names and sizes.

Out of scope

• Linux or macOS desktop builds. The desktop extra (pywebview>=5.0,<7) is not installed in CI today, and the spec bundles launcher.py with Flask, templates and static assets only. A new spec would be required — do not attempt it here.
• The Electron desktop app — that is the Week 32 feature item (8 pt, requested by Vinnie).

Acceptance Criteria

• A new workflow, for example .github/workflows/release.yml, triggers on push of tags matching v*.
• The workflow builds Python distributables (python -m build, producing wheel and sdist) and uploads them as GitHub Release assets.
• The workflow builds the Windows PyInstaller bundle from cursor-browser.spec on windows-latest and uploads the zipped dist/CursorChatBrowser/ directory as a Release asset.
• A test tag push in a fork, or a dry run, documents the expected artifact names and sizes.
• Actions are pinned to commit SHAs, matching the tests.yml convention.
• Tests pass in CI; PR approved by at least 1 reviewer.

Verification

# from the cppa-cursor-browser checkout root
.\.venv\Scripts\Activate.ps1
pip install build
python -m build
pyinstaller cursor-browser.spec --noconfirm

• Confirm dist/ contains a wheel and an sdist, and dist/CursorChatBrowser/CursorChatBrowser.exe exists after the PyInstaller run.
• Push a test tag in a fork and confirm the workflow attaches all three artifacts to the resulting Release; record the artifact names and sizes in the PR body.

References

• Sprint: Week 31 (Jul 27–31, 2026) — Chen item is-8 (3 pt, Task)
• Week 31 weekly plan — cppa-cursor-browser
• Week 31 issue descriptions — cppa-cursor-browser, tag-triggered release workflow
• Eval finding: n/a
• Files: .github/workflows/release.yml (new); .github/workflows/tests.yml:120-133; cursor-browser.spec; pyproject.toml:66-80; launcher.py; README.md
• Companion: Wednesday is-7 summary-cache lock, is-9 changelog backfill, is-10 v0.2.1 tag
• Success definition: v0.2.1 Release covering the Week 30 browser-security sweep