Versioned releases: no tags, no changelog, no version in the binary

[jason-shen]

Problem

There is no released artifact of this server. .github/workflows/deploy-ec2.yml pushes ghcr.io/streamcoreai/streamcore-server:${{ github.sha }} on every push to main and redeploys the EC2 host, which is a deployment pipeline, not a distribution channel. Three things are missing on top of it:

• No version in the binary. The Dockerfile builds with RUN CGO_ENABLED=0 GOOS=linux go build -o /server . and passes no -ldflags, so nothing in the process knows its own commit. Add /version endpoint and richer /health with build info #30 covers the /version endpoint; this issue covers the value it would report.
• No standalone binaries. Running without Docker means installing Go and building. For a single static CGO_ENABLED=0 binary that is a self-inflicted wound.
• No changelog and no tags. A user upgrading has no way to find out what changed, and "which version broke it" is not a question anyone can currently answer.

Proposed change

Tag-driven release workflow. Add .github/workflows/release.yml triggered on v* tags. It should do three things and nothing else, so a failure in one is diagnosable:

1. goreleaser for standalone binaries — linux/amd64, linux/arm64, darwin/arm64, darwin/amd64. CGO_ENABLED=0 already holds (the Opus codec runs as WebAssembly through wazero), so cross-compilation is free. Ship config.toml.example and the README in the archive; a server binary with no example config is not usable on arrival.
2. Image tags. Publish the same image the deploy workflow builds under :v1.2.3, :v1.2, and :latest in addition to the SHA tag. Do not modify deploy-ec2.yml; the running deployment path should be untouched by this.
3. Release notes generated from the tag range, with a hand-written summary at the top.

Version stamping. -X main.version, -X main.commit, -X main.date, set by goreleaser for binaries and by a --build-arg for the image. Fall back to runtime/debug.ReadBuildInfo() so a plain go build ./... or a go install still reports the module version and VCS stamp instead of unknown.

CHANGELOG.md in Keep a Changelog format, with an Unreleased section maintained in PRs. Note explicitly which changes are breaking — the repo already has a breaking change label for wire protocol, event shape, config key, and public SDK signature changes, and those are exactly the entries a user upgrading needs to find first.

Versioning policy. Worth writing down in CONTRIBUTING.md before the first tag rather than after: pre-1.0, what a minor bump is allowed to break, and how the server version relates to the five client SDK versions, which are released on their own cadence.

Acceptance criteria

• Pushing tag v0.1.0 produces a GitHub release with binaries for the four platform pairs.
• ./streamcore-server -version (or /version, per Add /version endpoint and richer /health with build info #30) reports the tag and commit from a released binary.
• ghcr.io/streamcoreai/streamcore-server:v0.1.0 and :latest exist and run.
• go build ./... with no ldflags still reports something useful, not an empty string.
• CHANGELOG.md exists and covers the first release.
• deploy-ec2.yml is unchanged and still green.

Pointers

• Dockerfile — build stage L13, where ARG/-ldflags go
• .github/workflows/deploy-ec2.yml — existing GHCR login and build-push-action@v6 usage to mirror; DOCKER_IMAGE env L25
• main.go — version vars and flag handling
• Related: Add /version endpoint and richer /health with build info #30 (/version endpoint), Publish multi-arch (amd64 + arm64) images to GHCR #32 (multi-arch GHCR images)