From a22af8c3f6bc654c103c95dbd6573098a022225c Mon Sep 17 00:00:00 2001
From: Fraser Brown <“service@act.foundation”>
Date: Wed, 12 Aug 2026 13:34:37 +0300
Subject: [PATCH] ci: upload junod binaries on GitHub Releases

Restore release assets (junod + sha256) for published tags and allow
workflow_dispatch backfill for v30.0.0 (#1220).
---
 .github/workflows/release-binaries.yml | 55 ++++++++++++++++++++++++++
 .github/workflows/release-dispatch.yml |  5 ++-
 RELEASES.md                            | 14 +++++++
 3 files changed, 72 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/release-binaries.yml

diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml
new file mode 100644
index 000000000..a17e00d52
--- /dev/null
+++ b/.github/workflows/release-binaries.yml
@@ -0,0 +1,55 @@
+name: Release Binaries
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag to upload binaries for (for example `v30.0.0`)
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  upload-release-binaries:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Resolve release tag
+        id: resolve-tag
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          INPUT_TAG: ${{ inputs.tag }}
+        run: |
+          tag="${RELEASE_TAG:-$INPUT_TAG}"
+          if [ -z "$tag" ]; then
+            echo "Release tag is required"
+            exit 1
+          fi
+
+          echo "release_tag=$tag" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout release tag
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.resolve-tag.outputs.release_tag }}
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.25.10
+
+      - name: Build junod
+        run: VERSION="${{ steps.resolve-tag.outputs.release_tag }}" LEDGER_ENABLED=false make build
+
+      - name: Create release assets
+        run: |
+          cp bin/junod junod
+          sha256sum junod > junod_sha256.txt
+
+      - name: Upload release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "${{ steps.resolve-tag.outputs.release_tag }}" junod junod_sha256.txt --clobber
diff --git a/.github/workflows/release-dispatch.yml b/.github/workflows/release-dispatch.yml
index 95b68a618..98e99b85a 100644
--- a/.github/workflows/release-dispatch.yml
+++ b/.github/workflows/release-dispatch.yml
@@ -3,6 +3,7 @@ name: Dispatch Release to juno-std
 on:
   release:
     types: [released]
+
 env:
   JUNO_REPO: "https://github.com/CosmosContracts/juno.git"
   JUNO_DIR: "proto"
@@ -43,7 +44,7 @@ jobs:
 
             // Determine release_tag and flags based on event type or manual inputs
             const inputs = (context.payload && context.payload.inputs) || {};
-            const releaseTag = inputs.release_tag || '';
+            const releaseTag = inputs.release_tag || context.payload.release?.tag_name || '';
             const isDraft = String(inputs.is_draft || '').toLowerCase() === 'true';
             const isPrerelease = String(inputs.is_prerelease || '').toLowerCase() === 'true';
 
@@ -66,7 +67,7 @@ jobs:
                 repo: process.env.COSMOS_SDK_REPO,
                 rev: process.env.COSMOS_SDK_REV,
                 dir: process.env.COSMOS_SDK_DIR,
-                exclude_mods: ['cosmos/benchmark', 'cosmos/counter', 'cosmos/epochs', 'cosmos/protocolpool],
+                exclude_mods: ['cosmos/benchmark', 'cosmos/counter', 'cosmos/epochs', 'cosmos/protocolpool'],
               },
               wasmd: {
                 name: 'wasm',
diff --git a/RELEASES.md b/RELEASES.md
index 361e99079..ae4f64b40 100644
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -14,6 +14,20 @@ In the past, some releases have been consensus-breaking but only incremented a m
 the
 **Only patch versions, i.e. `x.x.1 -> x.x.2`, or `3.1.0 -> 3.1.1` are guaranteed to be non-consensus breaking.**
 
+## Obtaining binaries
+
+When `.github/workflows/release-binaries.yml` runs for a published GitHub release, it uploads two release assets for the tag:
+
+- `junod`
+- `junod_sha256.txt`
+
+For the existing `v30.0.0` release in `CosmosContracts/juno#1220`, maintainers can backfill those assets by running the `Release Binaries` workflow manually with `tag=v30.0.0`.
+
+Until that workflow has run for `v30.0.0`, use one of these install paths instead:
+
+- Docker: `ghcr.io/cosmoscontracts/juno:v30.0.0`
+- Source install: `git checkout v30.0.0 && make install`
+
 ## Scheduled upgrade via governance
 
 For a SoftwareUpgradeProposal via governance: