Tag and release in one go

.github/workflows/release.yml

@@ -1,8 +1,13 @@
-name: Package and release
+name: Tag and release
 on:
   push:
-    tags:
-      - '**'
+    branches:
+      - main
+    paths:
+      - CHANGELOG.md
+
+permissions:
+  contents: write # required to tag through API
 
 jobs:
   release:
@@ -11,6 +16,19 @@ jobs:
       - name: Clone project
         uses: actions/checkout@v4
 
+      - name: Get latest version from changelog header
+        run: echo "tag=$(grep -m 1 -oP '(?<=### Changes in )(\d{5,}.\d{1,}-\w+)(?=:)' CHANGELOG.md)" >> "$GITHUB_OUTPUT"
+        id: changelog
+
+      - name: Tag
+        # honestly a crap action, find a better one
+        uses: mathieudutour/github-tag-action@v6.2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }} # why tho, just read the env..
+          create_annotated_tag: true # lightweight by default
+          custom_tag: ${{ steps.changelog.outputs.tag }}
+          tag_prefix: '' # otherwise it'll prepend "v"
+
       - name: Trim changelog
         run: sed -ni '1p;2,/^###/{/^###/q;p;}' CHANGELOG.md