add github workflow script

.github/RELEASE.md

@@ -0,0 +1,54 @@
+# Creating a Release for Nanobrowser
+
+This guide explains how to create a new release for Nanobrowser with automated asset building.
+
+## Automated Release Process
+
+When you create a new release on GitHub, our GitHub Actions workflow will automatically:
+
+1. Build source code packages (zip and tar.gz) respecting .gitignore
+2. Build the Chrome extension package (nanobrowser.zip)
+3. Attach all three assets to your GitHub release
+
+## Steps to Create a Release
+
+1. **Navigate to your repository**
+   - Go to `https://github.com/YOUR_USERNAME/nanobrowser`
+
+2. **Access the Releases section**
+   - Click on "Releases" in the right sidebar
+
+3. **Create a new release**
+   - Click the "Draft a new release" button
+
+4. **Set up your release**
+   - **Choose a tag**: Create a new tag following semantic versioning (e.g., v1.0.0)
+   - **Release title**: Give your release a descriptive name
+   - **Description**: Write detailed release notes explaining what's new, fixed, or changed
+   - **DO NOT** manually upload assets - they will be built and attached automatically
+
+5. **Publish the release**
+   - Click "Publish release"
+
+6. **Wait for the workflow to complete**
+   - The GitHub Actions workflow will automatically build and attach:
+     - nanobrowser-source.zip
+     - nanobrowser-source.tar.gz
+     - nanobrowser.zip (Chrome extension package)
+
+## Best Practices for Releases
+
+1. **Use Semantic Versioning** (MAJOR.MINOR.PATCH):
+   - MAJOR: incompatible API changes
+   - MINOR: add functionality in a backward-compatible manner
+   - PATCH: backward-compatible bug fixes
+
+2. **Write comprehensive release notes**:
+   - List new features
+   - Document bug fixes
+   - Mention any breaking changes
+   - Include upgrade instructions if needed
+
+3. **Verify the workflow completed successfully**:
+   - Check the "Actions" tab to ensure the workflow ran without errors
+   - Verify all three assets are attached to your release 

.github/workflows/release.yml

@@ -0,0 +1,151 @@
+name: Build Release Assets
+
+on:
+  release:
+    types: [created]
+
+jobs:
+  security-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check release creator
+        run: |
+          CREATOR="${{ github.event.release.author.login }}"
+          ALLOWED_USERS="${{ vars.ALLOWED_RELEASE_USERS }}"
+          
+          # More precise check using array
+          IFS=' ' read -ra USERS <<< "$ALLOWED_USERS"
+          AUTHORIZED=false
+          for user in "${USERS[@]}"; do
+            if [ "$user" = "$CREATOR" ]; then
+              AUTHORIZED=true
+              break
+            fi
+          done
+          
+          if [ "$AUTHORIZED" = false ]; then
+            echo "Release created by unauthorized user: $CREATOR"
+            echo "Allowed users: $ALLOWED_USERS"
+            exit 1
+          fi
+          
+          echo "Release creator authorized: $CREATOR"
+    
+  build-assets:
+    needs: security-check
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+        
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v3
+        with:
+          version: 9.15.1
+          
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+          
+      - name: Setup pnpm cache
+        uses: actions/cache@v3
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+          
+      - name: Extract version from tag
+        id: get_version
+        run: |
+          # Remove 'v' prefix if present (e.g., v1.0.0 -> 1.0.0)
+          VERSION=${GITHUB_REF_NAME#v}
+          echo "VERSION=$VERSION" >> $GITHUB_ENV
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Extracted version: $VERSION"
+          
+      - name: Create Source Code Archives
+        run: |
+          # Create a temporary directory for the source code
+          mkdir -p temp_source
+          
+          echo "Copying source files respecting .gitignore..."
+          # Copy all files respecting .gitignore
+          git ls-files | xargs -I {} cp --parents {} temp_source/
+          
+          # Create archives with version in filename
+          cd temp_source
+          echo "Creating ZIP archive..."
+          zip -r ../nanobrowser-source-v$VERSION.zip .
+          echo "Creating TAR.GZ archive..."
+          tar -czf ../nanobrowser-source-v$VERSION.tar.gz .
+          cd ..
+          
+          # Verify archives were created
+          if [ ! -f "nanobrowser-source-v$VERSION.zip" ] || [ ! -f "nanobrowser-source-v$VERSION.tar.gz" ]; then
+            echo "Error: Failed to create source archives"
+            exit 1
+          fi
+          
+          echo "Source archives created successfully"
+          ls -la nanobrowser-source-v$VERSION.*
+          
+          # Clean up
+          rm -rf temp_source
+      
+      - name: Build Chrome Extension
+        run: |
+          # Set version in package.json
+          echo "Setting version $VERSION in package.json"
+          jq ".version = \"$VERSION\"" package.json > package.json.tmp && mv package.json.tmp package.json
+          
+          # Install dependencies
+          echo "Running pnpm clean..."
+          pnpm clean || { echo "Error during pnpm clean"; exit 1; }
+          
+          echo "Installing dependencies..."
+          pnpm install || { echo "Error during pnpm install"; exit 1; }
+          
+          # Build the extension
+          echo "Building extension..."
+          pnpm build || { echo "Error during pnpm build"; exit 1; }
+          
+          # Rename dist folder to nanobrowser
+          echo "Renaming dist folder to nanobrowser..."
+          mv dist nanobrowser
+          
+          # Create zip file
+          echo "Creating nanobrowser.zip..."
+          zip -r nanobrowser.zip nanobrowser
+          
+          # Verify zip was created
+          if [ ! -f "nanobrowser.zip" ]; then
+            echo "Error: Failed to create nanobrowser.zip"
+            exit 1
+          fi
+          
+          echo "Chrome extension package created successfully"
+          ls -la nanobrowser.zip
+          
+          # Delete the folder
+          rm -rf nanobrowser
+      
+      - name: Upload Release Assets
+        uses: softprops/action-gh-release@v1
+        with:
+          files: |
+            nanobrowser-source-v${{ env.VERSION }}.zip
+            nanobrowser-source-v${{ env.VERSION }}.tar.gz
+            nanobrowser.zip
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}