Refactor release workflows to use gh release create for asset uploads and update README for clarity on release processes

Author: jason810496

.github/workflows/release-candidate.yml

@@ -61,11 +61,20 @@ jobs:
           print-hash: true
 
       - name: Create GitHub prerelease
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
-        with:
-          tag_name: ${{ github.ref_name }}
-          name: Release Candidate ${{ github.ref_name }}
-          prerelease: true
-          generate_release_notes: true
-          files: |
-            dist/*
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          files=(dist/*.tar.gz dist/*.whl dist/*.publish.attestation)
+
+          if [ "${#files[@]}" -eq 0 ]; then
+            echo "No release assets found in dist/." >&2
+            exit 1
+          fi
+
+          gh release create "${GITHUB_REF_NAME}" "${files[@]}" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --title "Release Candidate ${GITHUB_REF_NAME}" \
+            --generate-notes \
+            --prerelease

.github/workflows/release-pypi.yml

@@ -61,10 +61,19 @@ jobs:
           print-hash: true
 
       - name: Create GitHub release
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
-        with:
-          tag_name: ${{ github.ref_name }}
-          name: ${{ github.ref_name }}
-          generate_release_notes: true
-          files: |
-            dist/*
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          files=(dist/*.tar.gz dist/*.whl dist/*.publish.attestation)
+
+          if [ "${#files[@]}" -eq 0 ]; then
+            echo "No release assets found in dist/." >&2
+            exit 1
+          fi
+
+          gh release create "${GITHUB_REF_NAME}" "${files[@]}" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --title "${GITHUB_REF_NAME}" \
+            --generate-notes

README.md

@@ -1,7 +1,7 @@
 # Agent Hooks
 
 <p align="center">
-  <img src="docs/assets/agent-hooks-landing.svg" alt="Agent Hooks landing graphic" width="100%">
+  <img src="https://www.zhu424.dev/agent-hooks/latest/assets/agent-hooks-landing.svg" alt="Agent Hooks landing graphic" width="100%">
 </p>
 
 **No more swipe-and-sweep context switching for multi-session AI coding.**
@@ -12,13 +12,13 @@ Agent Hooks gives Claude Code and Codex one local callback layer: a macOS-ready
 
 ### Claude Code
 
-![Claude Code permission request shown as a macOS dialog](docs/assets/agent-hooks-claude-code-example.png)
+![Claude Code permission request shown as a macOS dialog](https://www.zhu424.dev/agent-hooks/latest/assets/agent-hooks-claude-code-example.png)
 
 Claude Code permission requests become a native local dialog with `Deny`, `Allow Once`, and session-scoped `Always Allow`.
 
 ### Codex
 
-![Codex permission request shown as a macOS dialog](docs/assets/agent-hooks-codex-example.png)
+![Codex permission request shown as a macOS dialog](https://www.zhu424.dev/agent-hooks/latest/assets/agent-hooks-codex-example.png)
 
 Codex `PreToolUse` requests become the same local dialog flow, with `Deny`, `Allow Once`, and optional `execpolicy` short-circuiting for already-allowed Bash commands.
 
@@ -215,21 +215,21 @@ This is enough to route Codex Bash permission checks and stop notifications into
 
 Recommended setup: pass `--provider` explicitly in your provider config when you can. The built-in callback can infer providers from payload markers, but the explicit flag keeps local setup easier to reason about and debug.
 
-If you want to build your own hook app, start with [`AgentHook`](docs/framework/agenthook.md) and then run it with [`agent-hooks run`](docs/cli/custom-apps.md).
+If you want to build your own hook app, start with [`AgentHook`](https://www.zhu424.dev/agent-hooks/latest/framework/agenthook/) and then run it with [`agent-hooks run`](https://www.zhu424.dev/agent-hooks/latest/cli/custom-apps/).
 
 ## Docs Map
 
-- [Features](docs/features.md)
-- [macOS Quickstart](docs/getting-started/macos-quickstart.md)
-- [Built-in Callback](docs/cli/builtin-callback.md)
-- [AgentHook](docs/framework/agenthook.md)
-- [Architecture Overview](docs/architecture/overview.md)
-- [Claude Code](docs/providers/claude-code.md)
-- [Codex](docs/providers/codex.md)
+- [Features](https://www.zhu424.dev/agent-hooks/latest/features/)
+- [macOS Quickstart](https://www.zhu424.dev/agent-hooks/latest/getting-started/macos-quickstart/)
+- [Built-in Callback](https://www.zhu424.dev/agent-hooks/latest/cli/builtin-callback/)
+- [AgentHook](https://www.zhu424.dev/agent-hooks/latest/framework/agenthook/)
+- [Architecture Overview](https://www.zhu424.dev/agent-hooks/latest/architecture/overview/)
+- [Claude Code](https://www.zhu424.dev/agent-hooks/latest/providers/claude-code/)
+- [Codex](https://www.zhu424.dev/agent-hooks/latest/providers/codex/)
 
 ## Maintainers
 
-- [Release Process](scripts/release/README.md)
+- [Release Process](https://github.com/jason810496/agent-hooks/blob/main/scripts/release/README.md)
 
 ## Scope
 
@@ -242,4 +242,4 @@ The docs stay aligned with the current implementation. They describe supported b
 
 ## License
 
-Agent Hooks is licensed under Apache 2.0. See [LICENSE](LICENSE).
+Agent Hooks is licensed under Apache 2.0. See [LICENSE](https://github.com/jason810496/agent-hooks/blob/main/LICENSE).

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agent-hooks"
-version = "0.1.0rc1"
+version = "0.1.0rc2"
 description = "One local callback layer for Claude Code and Codex: a macOS-ready CLI for native permission dialogs and notifications, plus a FastAPI-like Python framework"
 readme = "README.md"
 requires-python = ">=3.10"

scripts/release/README.md

@@ -24,7 +24,7 @@ Examples:
 ## Required GitHub Configuration
 
 The workflows use [PyPI Trusted Publishing](https://docs.pypi.org/trusted-publishers/). No API token is required if the publishers are configured correctly.
-All third-party GitHub Actions in the release workflows are pinned to full commit SHAs, and the trailing comments record the human-readable release version that each SHA came from.
+All third-party GitHub Actions in the release workflows are pinned to full commit SHAs, and the trailing comments record the human-readable release version that each SHA came from. GitHub releases themselves are created with the built-in `gh release create` CLI so immutable releases follow GitHub's draft-upload-publish sequence when assets are attached.
 
 Create these GitHub environments:
 
@@ -105,7 +105,7 @@ After a local `mike deploy`, run `uv run --group docs mike serve` if you want to
    git push origin main --follow-tags
    ```
 
-6. GitHub Actions publishes the distributions to TestPyPI and creates a GitHub prerelease with the built artifacts attached.
+6. GitHub Actions publishes the distributions to TestPyPI and creates a GitHub prerelease with the built artifacts and publish attestations attached.
    The docs workflow also publishes versioned docs for `0.2.0rc1` and moves the `rc` docs alias.
 
 Use the TestPyPI install flow to validate the candidate in a clean environment before promoting it.
@@ -136,7 +136,7 @@ Use the TestPyPI install flow to validate the candidate in a clean environment b
    git push origin main --follow-tags
    ```
 
-6. GitHub Actions publishes the package to PyPI and creates the GitHub release with release notes and distribution artifacts.
+6. GitHub Actions publishes the package to PyPI and creates the GitHub release with release notes, distribution artifacts, and publish attestations attached.
    The docs workflow also publishes immutable versioned docs for `0.2.0` while keeping `latest` reserved for the moving docs built from `main`.
 
 ## CI Validation Rules