CI typechecks and tests pushes and pull requests to main. A pushed version tag runs tools/release.sh, after tangled's: it tests, builds the archive reproducibly, attaches it to the release, attests it as published and updates the bundle listing; a version already released is left alone, and a run started by hand is a dry run. The release's OAuth client document is built but not attached until tangled.org serves release files with their content type (tangled.org/core#2264); the upload line is commented out until then.