build: production Windows release pipeline (PyInstaller, SBOM, CI, signing hook)

.github/workflows/release.yml

@@ -0,0 +1,56 @@
+name: Release Build
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Optional version override (e.g. 1.2.0)"
+        required: false
+        default: ""
+
+jobs:
+  release:
+    name: Build Windows release
+    runs-on: windows-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Production release build
+        shell: pwsh
+        run: |
+          $args = @()
+          if ("${{ github.event.inputs.version }}") { $args += "-Version", "${{ github.event.inputs.version }}" }
+          & ./scripts/release_build.ps1 @args
+
+      - name: Upload release artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: ProxyGod-windows-amd64
+          path: |
+            releases/**/*
+            dist/ProxyChainManager.exe
+            dist/ProxyChainManager.exe.sha256
+          if-no-files-found: error
+
+      - name: Create GitHub Release (tag push only)
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            releases/**/*.zip
+            releases/**/ProxyChainManager.exe
+            releases/**/ProxyChainManager.exe.sha256
+            releases/**/RELEASE_MANIFEST.json
+            releases/**/SBOM.json
+          generate_release_notes: true