ci(release): attach distributions to GitHub releases

.github/workflows/release.yml

@@ -1,12 +1,12 @@
-name: Release to PyPI
+name: Release
 
 on:
   push:
     tags:
       - "v*.*.*"
 
 concurrency:
-  group: pypi-${{ github.ref }}
+  group: release-${{ github.ref }}
   cancel-in-progress: false
 
 permissions:
@@ -120,3 +120,31 @@ jobs:
 
       - name: Publish distributions to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
+
+  github-release:
+    name: Publish GitHub Release
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@v8
+        with:
+          name: python-package-distributions
+          path: dist/
+
+      - name: Create or update GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            gh release upload "$RELEASE_TAG" dist/* --clobber
+          else
+            gh release create "$RELEASE_TAG" dist/* \
+              --verify-tag \
+              --generate-notes \
+              --title "$RELEASE_TAG"
+          fi

README.md

@@ -982,15 +982,16 @@ uv build
 
 ## Release
 
-PyPI publishing uses `.github/workflows/release.yml` and Trusted Publishing;
-no long-lived API token is stored in GitHub. After configuring the `pypi`
-environment and PyPI publisher, merge the release commit into `main`, then push
-a version-matching tag:
+`.github/workflows/release.yml` builds one verified wheel/sdist pair, attaches
+both files to a generated GitHub Release, and publishes the same distributions
+to PyPI through Trusted Publishing. No long-lived API token is stored in
+GitHub. After configuring the `pypi` environment and PyPI publisher, merge the
+release commit into `main`, then push a version-matching tag:
 
 ```text
 PyPI project: ejagent-core
 GitHub owner: jyh20030112
-Repository: SimAgentPlg (rename separately)
+Repository: EJAgent
 Workflow: release.yml
 Environment: pypi
 ```
@@ -1008,7 +1009,9 @@ git push origin v0.6.0
 
 The workflow rejects tags whose commit is not on `main` or whose value does not
 match `project.version`, reruns the complete quality matrix, builds and smoke
-tests the distributions, then publishes them with a short-lived OIDC identity.
+tests the distributions, then publishes them to GitHub Releases and PyPI. The
+two publishing jobs consume the same immutable Actions artifact; only the PyPI
+job receives a short-lived OIDC identity.
 
 ## Public API
 

README_zh-CN.md

@@ -812,14 +812,15 @@ uv build
 
 ## 发布
 
-PyPI 发布由 `.github/workflows/release.yml` 和 Trusted Publishing 完成，GitHub
-中不保存长期 API Token。配置 `pypi` Environment 和 PyPI Publisher 后，先把发布提交
+`.github/workflows/release.yml` 只构建一份经过验证的 wheel/sdist，将同一份产物同时
+附加到自动生成的 GitHub Release，并通过 Trusted Publishing 发布到 PyPI。GitHub 中
+不保存长期 API Token。配置 `pypi` Environment 和 PyPI Publisher 后，先把发布提交
 合并到 `main`，再推送与项目版本一致的 Tag：
 
 ```text
 PyPI 项目：ejagent-core
 GitHub Owner：jyh20030112
-Repository：SimAgentPlg（单独执行远程改名）
+Repository：EJAgent
 Workflow：release.yml
 Environment：pypi
 ```
@@ -836,7 +837,8 @@ git push origin v0.6.0
 ```
 
 工作流会拒绝不在 `main` 上或与 `project.version` 不一致的 Tag，重新执行完整质量矩阵，
-构建并 smoke test 发布产物，最后使用短期 OIDC 身份上传 PyPI。
+构建并 smoke test 发布产物，然后发布到 GitHub Releases 和 PyPI。两个发布 Job 使用同一份
+不可变 Actions Artifact，只有 PyPI Job 会获得短期 OIDC 身份。
 
 ## 公共 API
 

pyproject.toml

@@ -14,9 +14,9 @@ dependencies = [
 ]
 
 [project.urls]
-Homepage = "https://github.com/jyh20030112/SimAgentPlg"
-Repository = "https://github.com/jyh20030112/SimAgentPlg"
-Issues = "https://github.com/jyh20030112/SimAgentPlg/issues"
+Homepage = "https://github.com/jyh20030112/EJAgent"
+Repository = "https://github.com/jyh20030112/EJAgent"
+Issues = "https://github.com/jyh20030112/EJAgent/issues"
 
 [project.optional-dependencies]
 mcp = [