Release: attach macOS raw binary and publish artifact explainer notes

Author: crisdosaygo

.github/workflows/release.yml

@@ -298,13 +298,15 @@ jobs:
           fi
 
           # Checksums
-          (cd "$DIST" && shasum -a 256 "fipspad_darwin_universal.pkg" > "SHA256SUMS_darwin_universal.txt")
+          cp "$BINARY" "$DIST/fips-pad"
+          (cd "$DIST" && shasum -a 256 "fips-pad" "fipspad_darwin_universal.pkg" > "SHA256SUMS_darwin_universal.txt")
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
           name: macos-universal
           path: |
+            dist/fips-pad
             dist/fipspad_darwin_universal.pkg
             dist/SHA256SUMS_darwin_universal.txt
 
@@ -444,9 +446,32 @@ jobs:
           gh release upload "$TAG" SHA256SUMS.txt \
             --repo "${{ github.repository }}" --clobber
 
+          cat > RELEASE_NOTES.md <<'EOF'
+          Release ${TAG}
+
+          Attached artifacts:
+
+          - `fips-pad` — Raw macOS universal CLI binary (unsigned installer wrapper not required).
+          - `fipspad_darwin_universal.pkg` — macOS installer package (signed/notarized when credentials are configured).
+          - `fipspad_linux_amd64` — Linux amd64 binary.
+          - `fipspad_windows_amd64.exe` — Windows amd64 executable (signed when credentials are configured).
+          - `SHA256SUMS.txt` — Combined checksums for all release artifacts.
+          - `SHA256SUMS_darwin_universal.txt` — Checksums for macOS artifacts.
+          - `SHA256SUMS_linux_amd64.txt` — Checksum for Linux artifact.
+          - `SHA256SUMS_windows_amd64.txt` — Checksum for Windows artifact.
+
+          Verify downloads:
+
+          ```bash
+          sha256sum -c SHA256SUMS.txt
+          ```
+          EOF
+          sed -i "s/\${TAG}/${TAG}/g" RELEASE_NOTES.md
+
           # Publish (remove draft)
           gh release edit "$TAG" \
             --repo "${{ github.repository }}" \
+            --notes-file RELEASE_NOTES.md \
             --draft=false
 
           echo "Release $TAG published!"