The Release step was gated with if: startsWith(github.ref, 'refs/tags/'), so pushes to main/master built the binaries but never published a release. Also, the workflow relied on secrets.TOKEN (a manually configured PAT) instead of the built-in GITHUB_TOKEN.

Changes

• Removed if: startsWith(github.ref, 'refs/tags/') guard from the Release step
• Added a Set release tag step to derive the correct tag at runtime:
  • Branch push → tag=latest, prerelease=true
  • Tag push → tag=<tag_name>, prerelease=false
• Passed tag_name and prerelease inputs to softprops/action-gh-release@v2; used fromJSON() to coerce the shell string output to a proper boolean
• Replaced env: GITHUB_TOKEN: ${{ secrets.TOKEN }} with token: ${{ secrets.GITHUB_TOKEN }} (built-in, no manual secret needed)

- name: Set release tag
  id: release_tag
  run: |
    if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
      echo "tag=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
      echo "prerelease=false" >> $GITHUB_OUTPUT
    else
      echo "tag=latest" >> $GITHUB_OUTPUT
      echo "prerelease=true" >> $GITHUB_OUTPUT
    fi

- name: Release
  uses: softprops/action-gh-release@v2
  with:
    tag_name: ${{ steps.release_tag.outputs.tag }}
    prerelease: ${{ fromJSON(steps.release_tag.outputs.prerelease) }}
    token: ${{ secrets.GITHUB_TOKEN }}