release: add tag-driven binaries and prepare v0.1.0

.github/workflows/release.yml

@@ -0,0 +1,104 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*.*.*"]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  create-release:
+    name: Create release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create or reuse GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "Release $TAG already exists."
+          else
+            gh release create "$TAG" --title "$TAG" --generate-notes
+          fi
+
+  build:
+    name: Build (${{ matrix.target }})
+    needs: create-release
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            archive: tar.gz
+          - os: macos-latest
+            target: aarch64-apple-darwin
+            archive: tar.gz
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            archive: zip
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          toolchain: stable
+          targets: ${{ matrix.target }}
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
+        with:
+          workspaces: "."
+      - name: Build release binary
+        run: cargo build --release --locked -p devkit-cli --target ${{ matrix.target }}
+
+      - name: Package archive (Unix)
+        if: matrix.archive == 'tar.gz'
+        shell: bash
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF_NAME}"
+          NAME="stellar-foundry-${TAG}-${{ matrix.target }}"
+          mkdir -p "dist/${NAME}"
+          cp "target/${{ matrix.target }}/release/stellar-foundry" "dist/${NAME}/"
+          cp README.md LICENSE "dist/${NAME}/"
+          tar -C dist -czf "dist/${NAME}.tar.gz" "${NAME}"
+          if command -v sha256sum >/dev/null 2>&1; then
+            (cd dist && sha256sum "${NAME}.tar.gz" > "${NAME}.tar.gz.sha256")
+          else
+            (cd dist && shasum -a 256 "${NAME}.tar.gz" > "${NAME}.tar.gz.sha256")
+          fi
+
+      - name: Package archive (Windows)
+        if: matrix.archive == 'zip'
+        shell: pwsh
+        run: |
+          $tag = $env:GITHUB_REF_NAME
+          $name = "stellar-foundry-$tag-${{ matrix.target }}"
+          New-Item -ItemType Directory -Force -Path "dist/$name" | Out-Null
+          Copy-Item "target/${{ matrix.target }}/release/stellar-foundry.exe" "dist/$name/"
+          Copy-Item README.md, LICENSE "dist/$name/"
+          Compress-Archive -Path "dist/$name" -DestinationPath "dist/$name.zip"
+          $hash = (Get-FileHash "dist/$name.zip" -Algorithm SHA256).Hash.ToLower()
+          "$hash  $name.zip" | Out-File -Encoding ascii "dist/$name.zip.sha256"
+
+      - name: Upload archive (Unix)
+        if: matrix.archive == 'tar.gz'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: gh release upload "$TAG" dist/*.tar.gz dist/*.tar.gz.sha256 --clobber
+
+      - name: Upload archive (Windows)
+        if: matrix.archive == 'zip'
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: gh release upload $env:TAG dist/*.zip dist/*.zip.sha256 --clobber

CHANGELOG.md

@@ -5,10 +5,11 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.1.0] - 2026-10-28
 
-The workspace version is `0.1.0`. This section describes merged work on `main`;
-no tagged release or crates.io publication exists yet.
+First tagged release. Prebuilt binaries for Linux x86_64, macOS arm64, and
+Windows x86_64 are attached to the GitHub Release with SHA256 checksums.
+crates.io publication is still pending.
 
 ### Added
 
@@ -55,7 +56,8 @@ no tagged release or crates.io publication exists yet.
 
 ### Limitations
 
-- No tagged release, release binaries, or crates.io publication exists yet.
+- crates.io publication is still pending; install from the GitHub Release or
+  build from source.
 - `contractspecv0` XDR entries are decoded into official XDR-JSON definitions
   with a variant kind and best-effort name; a normalized ABI schema remains
   future work.

README.md

@@ -9,10 +9,12 @@ and a CLI.
 
 The core works fully **offline** and never requires AI.
 
-> Status: early, pre-release (`0.1.0` in the workspace). The implementation
-> described below is merged on `main`. No tagged release or crates.io
-> publication exists yet. See [docs/PROJECT_STATUS.md](docs/PROJECT_STATUS.md)
-> for exactly what works today. Only documented features exist.
+> Status: early, `0.1.0`. The implementation described below is merged on
+> `main`, and `v0.1.0` has prebuilt Linux, macOS, and Windows binaries on the
+> [Releases page](https://github.com/StellarFoundry/stellar-devkit/releases).
+> crates.io publication is still pending. See
+> [docs/PROJECT_STATUS.md](docs/PROJECT_STATUS.md) for exactly what works
+> today. Only documented features exist.
 
 ## What works today
 
@@ -37,6 +39,10 @@ exact scope and known limitations.
 
 ## Install and build
 
+Download a prebuilt binary from the
+[Releases page](https://github.com/StellarFoundry/stellar-devkit/releases), or
+build from source:
+
 ```bash
 cargo build --release
 ./target/release/stellar-foundry version
@@ -74,7 +80,7 @@ Decode commands accept `-` to read one bounded value from stdin. Exit codes:
   code-scanning permissions.
 - RPC configuration is currently consumed by `rpc-health`; other commands do not
   make network requests.
-- No tagged release, release binaries, or crates.io publication exists yet.
+- crates.io publication is still pending; binaries are on the Releases page.
 
 ## Relationship to other Stellar tooling
 

docs/APPEAL.md

@@ -47,8 +47,11 @@ link to a merged PR, commit, CI run, release, or contributor.
 > 4. **The scope is distinct.** DevKit is an XDR/RPC/transaction/contract
 >    inspection workflow. It is not a source-level vulnerability scanner; the
 >    boundary with `soroban-security-scanner` is documented in `docs/WHY_DEVKIT.md`.
+> 5. **There is a release.** `v0.1.0` is published with Linux, macOS, and Windows
+>    binaries plus SHA256 checksums.
 >
 > Evidence:
+> - Release: https://github.com/StellarFoundry/stellar-devkit/releases/tag/v0.1.0
 > - Merge: `aec759c`
 > - CI: https://github.com/StellarFoundry/stellar-devkit/actions/runs/40690141880
 > - RustSec: https://github.com/StellarFoundry/stellar-devkit/actions/runs/40690141721
@@ -87,10 +90,10 @@ it first. Example:
 
 These are not required, but they strengthen an appeal:
 
-- Tag and publish `v0.1.0` with release binaries and checksums.
-- Publish the workspace crates to crates.io.
-- Get 3–5 external contributions or documented real-world usage.
-- Add a docs site or a recorded end-to-end demo with real testnet data.
+- [x] Tag and publish `v0.1.0` with release binaries and checksums.
+- [ ] Publish the workspace crates to crates.io.
+- [ ] Get 3–5 independent external contributions or documented real-world usage.
+- [ ] Add a docs site or a recorded end-to-end demo with real testnet data.
 
 ## After submitting
 

docs/ARCHITECTURE.md

@@ -146,7 +146,8 @@ Commands: `version`, `doctor`, `strkey`, `scval`, `envelope`, `event`,
 - Rule/CLI exit codes and machine output are treated as API and documented.
 - The toolkit tracks current Stellar protocol crates (28.x line at the time of
   writing).
-- The workspace version is `0.1.0`; no tagged release exists yet.
+- The workspace version is `0.1.0`; `v0.1.0` is tagged and released. crates.io
+  publication is still pending.
 
 ## Testing architecture
 

docs/BUILD_REPORT.md

@@ -68,7 +68,12 @@ read or logged.
 
 ## Release status
 
-No releases yet. No tagged release, binaries, or crates.io publication.
+`v0.1.0` is tagged and published with Linux x86_64, macOS arm64, and Windows
+x86_64 archives plus SHA256 checksums:
+
+<https://github.com/StellarFoundry/stellar-devkit/releases/tag/v0.1.0>
+
+crates.io publication is still pending.
 
 ## Issue backlog
 
@@ -89,7 +94,8 @@ See [DRIPS_READINESS.md](DRIPS_READINESS.md),
 
 ## Known limitations
 
-- No tagged release, release binaries, or crates.io publication.
+- crates.io publication is still pending; use the GitHub Release or build from
+  source.
 - `contractspecv0` output is XDR-JSON with best-effort names, not a normalized
   ABI.
 - Analysis rules are structural heuristics, not a vulnerability proof.

docs/DRIPS_APPLICATION_DRAFT.md

@@ -13,8 +13,8 @@ typed RPC protocol layer with deterministic mocks and a bounded HTTP transport;
 non-executing WASM inspection; deterministic structural findings with SARIF 2.1.0
 output; strict TOML configuration; and a CLI named `stellar-foundry`.
 
-The implementation is merged into `main`. There is no tagged release or crates.io
-publication yet.
+The implementation is merged into `main`. `v0.1.0` is released with prebuilt
+Linux, macOS, and Windows binaries; crates.io publication is still pending.
 
 ## Problem and ecosystem relevance
 
@@ -89,8 +89,10 @@ available.
   artifact exists and code-scanning permissions are available.
 - RPC configuration is wired into `rpc-health`; other commands do not consume
   RPC settings.
-- No tagged release, release binaries, or crates.io publication exists yet.
-- External adoption is limited; no external contributor has merged a PR yet.
+- crates.io publication is still pending; install from the GitHub Release or
+  build from source.
+- External adoption is limited; no independent external contributor has merged a
+  PR yet.
 
 ## Supporting documentation
 

docs/DRIPS_READINESS.md

@@ -73,8 +73,8 @@ exact scope.
   WASM artifact in the repository plus code-scanning permissions.
 - RPC config is wired into `rpc-health`; other commands do not use RPC settings.
   Endpoint precedence is command line, then environment, then config file.
-- The workspace is `0.1.0`, but there is no tagged release, no release binaries,
-  and no crates.io publication.
+- `v0.1.0` is released with Linux, macOS, and Windows binaries and checksums;
+  crates.io publication is still pending.
 - The project has limited external adoption: no external contributors have merged
   PRs yet, and the repository is new. Do not present issue counts or labels as
   evidence of traction.

docs/FINAL_AUDIT.md

@@ -26,8 +26,9 @@ Audit date: 2026-10-28. Commit: `aec759c`.
 | Fuzzing | Verified | `fuzz/fuzz_targets/*`; scheduled fuzz workflow |
 | Performance measured | Partial | Memory measurement example; benchmarks pending |
 | Composite GitHub Action | Pending | Tracked as an issue; only manual SARIF upload exists |
-| Release binaries / crates.io | Pending | No tag, no binaries, no crates.io package |
-| External contributors | Pending | No external contributor has merged a PR yet |
+| Tagged release + binaries | Verified | `v0.1.0` with Linux/macOS/Windows archives and SHA256 checksums |
+| crates.io publication | Pending | No crates.io package yet |
+| External contributors | Pending | No independent external contributor has merged a PR yet |
 
 ## Notes
 

docs/PROJECT_STATUS.md

@@ -1,6 +1,6 @@
 # Project Status
 
-**Current phase:** Developer-tooling implementation merged on `main`; pre-release hardening
+**Current phase:** Developer-tooling implementation merged on `main`; post-`v0.1.0` hardening
 
 **Repository:** https://github.com/StellarFoundry/stellar-devkit
 
@@ -48,9 +48,13 @@ Rust 1.91.0 MSRV tests:
 
 ## Release status
 
-The workspace version is `0.1.0`. There is **no tagged release**, no GitHub
-Release with binaries, and no crates.io publication yet. The release-validation
-workflow and checklist exist, but publishing remains outstanding work.
+The workspace version is `0.1.0`, and `v0.1.0` is tagged and published with
+prebuilt Linux x86_64, macOS arm64, and Windows x86_64 binaries plus SHA256
+checksums:
+
+- https://github.com/StellarFoundry/stellar-devkit/releases/tag/v0.1.0
+
+crates.io publication remains outstanding.
 
 ## Remaining limitations
 
@@ -64,8 +68,8 @@ workflow and checklist exist, but publishing remains outstanding work.
 - RPC configuration is wired into `rpc-health`: command-line endpoint overrides
   environment, which overrides the TOML file. Other commands do not consume RPC
   configuration because they do not make network requests.
-- The project is pre-release. Do not describe the workspace version as a
-  published release.
+- crates.io publication is pending. Do not describe the workspace as published
+  on crates.io.
 
 ## Security status
 

docs/RELEASE_CHECKLIST.md

@@ -10,4 +10,5 @@ Before publishing a version:
 6. Confirm the lockfile is regenerated and committed after dependency changes.
 7. Review the generated SARIF against the SARIF 2.1.0 schema.
 8. Verify artifacts and checksums before publishing; do not include credentials or local configuration.
-9. State known limitations in the release notes. Structural analysis findings are heuristics and do not prove a vulnerability.
+9. Push the `v*.*.*` tag and confirm the `Release` workflow uploaded the Linux, macOS, and Windows archives plus SHA256 checksums.
+10. State known limitations in the release notes. Structural analysis findings are heuristics and do not prove a vulnerability.

docs/WHY_DEVKIT.md

@@ -80,7 +80,8 @@ belong to XDR/RPC/transaction inspection belong here.
   ABI.
 - Structural analysis is heuristic, not a vulnerability proof.
 - RPC configuration currently applies to `rpc-health`.
-- No tagged release or crates.io publication exists yet.
+- `v0.1.0` is released with Linux, macOS, and Windows binaries; crates.io
+  publication is still pending.
 
 If a workflow needs something not listed here, treat it as planned work only
 when an open issue says so.