[guijacquemet]

What changes

CI and docs only; no change to the extension code (Java and Groovy sources untouched).

• .github/workflows/release.yml (new). Triggers: release: published, workflow_dispatch (input tag), and pull_request limited to the files of the release machinery (a dry run, never publishes). Third-party actions pinned by SHA with the tag in a comment; permissions: contents: read at top level, contents: write only on the publish job.
  • build (Linux, Java 25, QuPath 0.7.0 pinned by version and SHA-256, cached, same setup as qupath-gui.yml): builds labconstrictor-qupath-<tag>.jar and LabConstrictorTools-all.groovy with build.sh; checks the version inside the jar; smoke test on that exact jar (QuPath 0.7.0 on Xvfb with the jar installed on its class path: the menu entry Extensions > LabConstrictor tools exists and the dialog opens); writes SHA256SUMS and the notes text (QuPath version it was built against, minimum Tools version read from LcCompat.MIN_TOOLS_VERSION = 0.3.0a1); uploads everything as the workflow artifact release-files. The tag name is validated (letters, digits, .-_) before it becomes a file name.
  • publish (only on release, needs only build): attaches the jar, LabConstrictorTools-all.groovy and SHA256SUMS to the release and appends the notes block (once; marker comment) to the release body.
  • os-smoke (best effort, fail-fast: false, continue-on-error, does not gate publish): the same jar on windows-latest and macos-latest (arm64) in the pinned QuPath 0.7.0 build of that system (Windows zip, macOS pkg; version and SHA-256 pinned), on the runner's desktop, with a tiny Tools example app registered in a scratch LC_HOME using that OS's Python. Steps: menu entry + dialog + the registered app listed, then four existing test bodies that reach OS-specific code (Copy-as-command quoting vs quote_vectors.json, trust checks, results folders, clean-up). Per-step result table in the job summary (pass / fail with reason / no gui).
• build.sh: version from LC_QUPATH_VERSION (default 0.1.0, same file names as before); the jar gets a manifest with Implementation-Title and Implementation-Version. There is no version string in the code, so the manifest is where the tag shows.
• tests/smoke_jar.groovy, tests/smoke_jar.sh (Linux), tests/smoke_os.sh, tests/ci_setup_os.sh (new).
• README.md: Install section for users (app, jar from Releases, Extensions menu; Script Editor way; Troubleshooting; honest QuPath version and system statement); Build from source shortened, with how releases and the dry run work. docs/user-guide.md: install steps point to the Releases page.

Dry run (workflow run on this branch, head e0fc776, no release created)

https://github.com/CellMigrationLab/LabConstrictor-QuPath/actions/runs/38459825466 : run conclusion success.

• Linux build job (build, version check, smoke on the exact jar, SHA256SUMS, upload): success. publish skipped (not a release), as intended.
• macOS arm64: smoke_jar pass (3 checks), quote 13, trust 31, lifecycle 28, retention 54 checks: all pass.
• Windows: smoke_jar pass (3 checks: menu entry, dialog opens, lists the app), lifecycle 28 pass. Fail: gui_test_parity_quote_body (1 check, expects POSIX-shell quoting), gui_test_parity_trust_body (8 checks: on Windows the registry owner/mode checks do not exist, a group-writable entry is accepted: the documented Windows note), gui_test_retention_body (9 checks: the body itself uses chmod and a POSIX recorder, so the prune/locking path is not exercised). Windows interpreter path: the venv's Scripts\python.exe inside the prefix is accepted and used; the conda layout (python.exe at the prefix root) is not reachable in CI.

Not verified

• The real release run (needs someone to publish a release): upload to the release and the notes edit in publish have never run. The dry run proves build, version and smoke; not gh release upload/edit.
• The jar is put on QuPath's class path for the smoke (as tests/run_gui_test.sh does), not dropped in the extensions folder/dragged onto the window.
• Windows/macOS are not tested by a person; the OS jobs inform, they do not gate. Windows clean-up/file locking while pruning is not verified.

Existing files changed

build.sh, README.md, docs/user-guide.md. No file is 600 lines or more among the new/changed files (the existing main script is untouched).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y2SN8SuEakTdiWy3F2WUqN