feat(ci): automate binary builds on release and add install script

Binary builds now run as part of the release workflow instead of
relying on release events (which don't propagate from GITHUB_TOKEN).
Added curl-pipe install script for one-line installation.

Author: damusix

.github/workflows/publish.yml

@@ -8,7 +8,7 @@ on:
     paths:
       - '.changeset/**'
       - 'packages/*/package.json'
-      - '.github/workflows/release.yml'
+      - '.github/workflows/publish.yml'
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
@@ -21,6 +21,9 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    outputs:
+      published: ${{ steps.changesets.outputs.published }}
+      publishedPackages: ${{ steps.changesets.outputs.publishedPackages }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -48,3 +51,35 @@ jobs:
           publish: bun run release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  build-binaries:
+    name: Build and upload binaries
+    needs: release
+    if: >-
+      needs.release.outputs.published == 'true' &&
+      contains(needs.release.outputs.publishedPackages, '@noormdev/cli')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Get CLI version
+        id: version
+        run: echo "tag=@noormdev/cli@$(jq -r .version packages/cli/package.json)" >> "$GITHUB_OUTPUT"
+
+      - name: Build binaries
+        run: bun run build:binary
+
+      - name: Upload binaries to release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.version.outputs.tag }}
+          files: packages/cli/bin/noorm-*
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release-binary.yml

@@ -1,8 +1,6 @@
-name: Release Binaries
+name: Release Binaries (Manual)
 
 on:
-    release:
-        types: [published]
     workflow_dispatch:
 
 permissions:
@@ -12,10 +10,6 @@ jobs:
     build-binaries:
         name: Build and upload binaries
         runs-on: ubuntu-latest
-        # Only run for CLI releases, skip SDK-only releases
-        if: >-
-            github.event_name == 'workflow_dispatch' ||
-            contains(github.event.release.tag_name, '@noormdev/cli@')
         steps:
             - name: Checkout
               uses: actions/checkout@v4
@@ -26,12 +20,17 @@ jobs:
             - name: Install dependencies
               run: bun install --frozen-lockfile
 
+            - name: Get CLI version
+              id: version
+              run: echo "tag=@noormdev/cli@$(jq -r .version packages/cli/package.json)" >> "$GITHUB_OUTPUT"
+
             - name: Build binaries
               run: bun run build:binary
 
             - name: Upload binaries to release
               uses: softprops/action-gh-release@v2
               with:
+                  tag_name: ${{ steps.version.outputs.tag }}
                   files: packages/cli/bin/noorm-*
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

install.sh

@@ -0,0 +1,79 @@
+#!/bin/sh
+set -e
+
+# noorm installer
+# Usage: curl -fsSL https://raw.githubusercontent.com/noormdev/noorm/master/install.sh | sh
+
+REPO="noormdev/noorm"
+INSTALL_DIR="${NOORM_INSTALL_DIR:-/usr/local/bin}"
+BINARY_NAME="noorm"
+
+main() {
+    os=$(detect_os)
+    arch=$(detect_arch)
+    suffix="${os}-${arch}"
+
+    if [ "$os" = "windows" ]; then
+        suffix="${suffix}.exe"
+        BINARY_NAME="noorm.exe"
+    fi
+
+    tag=$(latest_cli_tag)
+    version=$(echo "$tag" | sed 's/@noormdev\/cli@//')
+
+    echo "Installing noorm v${version} (${os}-${arch})..."
+
+    url="https://github.com/${REPO}/releases/download/${tag}/noorm-${suffix}"
+    tmpfile=$(mktemp)
+
+    if ! curl -fsSL -o "$tmpfile" "$url"; then
+        echo "Error: Failed to download binary from ${url}" >&2
+        echo "No binary available for ${os}-${arch}." >&2
+        rm -f "$tmpfile"
+        exit 1
+    fi
+
+    chmod +x "$tmpfile"
+
+    if [ -w "$INSTALL_DIR" ]; then
+        mv "$tmpfile" "${INSTALL_DIR}/${BINARY_NAME}"
+    else
+        echo "Installing to ${INSTALL_DIR} (requires sudo)..."
+        sudo mv "$tmpfile" "${INSTALL_DIR}/${BINARY_NAME}"
+    fi
+
+    echo "Installed noorm v${version} to ${INSTALL_DIR}/${BINARY_NAME}"
+}
+
+detect_os() {
+    case "$(uname -s)" in
+        Darwin)  echo "darwin" ;;
+        Linux)   echo "linux" ;;
+        MINGW*|MSYS*|CYGWIN*) echo "windows" ;;
+        *) echo "Unsupported OS: $(uname -s)" >&2; exit 1 ;;
+    esac
+}
+
+detect_arch() {
+    case "$(uname -m)" in
+        x86_64|amd64)  echo "x64" ;;
+        arm64|aarch64) echo "arm64" ;;
+        *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;;
+    esac
+}
+
+latest_cli_tag() {
+    tag=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases" \
+        | grep -o '"tag_name": *"@noormdev/cli@[^"]*"' \
+        | head -1 \
+        | sed 's/"tag_name": *"//;s/"//')
+
+    if [ -z "$tag" ]; then
+        echo "Error: Could not find a CLI release." >&2
+        exit 1
+    fi
+
+    echo "$tag"
+}
+
+main