feat: github release bot

[lirenjie95]

Fixes #98

Automated Release Workflow:

• .github/workflows/release.yml: Added a GitHub Actions workflow to handle automated releases triggered by version tags or manual dispatch. The workflow includes steps for building multi-platform artifacts, generating changelogs, publishing to crates.io, and uploading release assets.

Documentation Updates:

• RELEASE.md: Added a comprehensive guide detailing the release process, including setup instructions, versioning conventions, and step-by-step workflows for automated and manual releases.

Version Management:

• scripts/update-version.sh: Added a script to update version numbers in Cargo.toml files and synchronize dependencies across the workspace. The script supports both Go-style (v1.2.3) and Rust-style (1.2.3) version formats.

[Copilot]

Pull Request Overview

This PR introduces an automated release system for the Rust2Go project, supporting both Go and Rust ecosystems with unified version management using Go-style versioning (v1.2.3) as the primary format.

• Adds GitHub Actions workflow for automated releases triggered by version tags or manual dispatch
• Provides comprehensive documentation for the release process including setup and workflow instructions
• Implements a shell script for updating version numbers across the workspace with support for both Go and Rust version formats

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/release.yml	GitHub Actions workflow for automated releases with multi-platform builds, changelog generation, and publishing to crates.io
RELEASE.md	Comprehensive documentation covering release processes, version management, and troubleshooting
scripts/update-version.sh	Shell script for updating version numbers in Cargo.toml files and synchronizing workspace dependencies

Comments suppressed due to low confidence (1)

[lirenjie95]

Hi @ihciah @suikammd,

I've rebased onto latest master, resolved the CI failures, and fixed several issues found during review. Here's a summary:

---

🔧 Fixes Applied

1. .github/workflows/release.yml

Issue	Fix
Missing workflow permissions	Added permissions: contents: write at workflow level. Without this, if the repo's default Actions permission is "Read-only", `actio
n-gh-release` will fail to create releases.
Windows target unreliable	Changed x86_64-pc-windows-gnu → x86_64-pc-windows-msvc. GitHub windows-latest runners have MSVC toolchain by default; GNU requires
manual MinGW installation which is fragile.
sccache version inconsistent	Upgraded v0.0.9 → v0.0.10 to match the repo's CI workflow.
Duplicate build steps	Removed redundant cargo build --release --target (whole workspace) before cargo build -p rust2go-cli. The CLI binary is what we actually
ship.
Wrong crate publish order	Moved mem-ring before rust2go-mem-ffi in publish sequence, since rust2go-mem-ffi depends on mem-ring.

2. scripts/update-version.sh

Issue	Fix
Incomplete dependency mapping	Added missing internal deps: rust2go-macro→rust2go-common, rust2go-cli→rust2go-common, rust2go-mem-ffi→mem-ring + `rust2
go-convert`. Without these, running the script would leave some path dependency versions stale.
Overly aggressive cargo update	Changed to cargo update --workspace to avoid bumping external crates.io dependencies unexpectedly.

---

🔑 About Secrets Configuration

There's a common misconception here — let me clarify what actually needs to be done:

GITHUB_TOKEN — No manual secret needed ✅

secrets.GITHUB_TOKEN is automatically injected by GitHub Actions on every run. You do not need to create it in Settings > Secrets.

What you DO need to check:

• Go to Settings > Actions > General > Workflow permissions
• Ensure it's set to "Read and write permissions" (not "Read repository contents and packages permissions only")
• If restricted, the release job will fail with a permission denied error when trying to create the GitHub Release

CARGO_REGISTRY_TOKEN — Must be configured once ⚠️

This is the only secret that requires manual setup:

1. Visit https://crates.io/me → generate an API token
2. Go to Settings > Secrets and variables > Actions > New repository secret
3. Name: CARGO_REGISTRY_TOKEN, Value: your crates.io token

Why this matters: Without this token, the release workflow will:

• ✅ Successfully create GitHub Release with binaries
• ❌ Fail to publish to crates.io, leaving Rust users unable to cargo add rust2go@0.4.2

This is a one-time setup for permanent automated releases. After configuring, every future release is just:

git tag v0.5.0 && git push origin master --tags
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
✅ Current Status
• cargo build — passing
• cargo clippy --all-features --all-targets -- --deny warnings — passing
• PR mergeable state: clean
Ready for final review!

[lirenjie95]

security issue found (via @ihciah)
https://blog.ammaraskar.com/github-token-stealing/

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.74%. Comparing base (f2bb1b9) to head (f80ddb8).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master     #100       +/-   ##
===========================================
+ Coverage   83.52%   93.74%   +10.21%     
===========================================
  Files          18       18               
  Lines        3672     3818      +146     
===========================================
+ Hits         3067     3579      +512     
+ Misses        605      239      -366     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.