ci: A release per version (tag v0.7.0, ...) instead of overwriting "latest"

- Publish release v$VERSION with its CHANGELOG.md section; never overwrite an existing version.
- Pull requests warn when VERSION is already released.
- Install URL: releases/latest/download/setup-gamescope-boot.sh (newest release).

.github/workflows/bundle.yml

@@ -1,7 +1,9 @@
-# Builds the single-file wizard (.github/tools/bundle.sh) and publishes it as the
-# asset of the rolling "latest" release, for:
-#   curl -fsSL https://github.com/theupriser/cachyos-gamescope-boot/releases/download/latest/setup-gamescope-boot.sh | bash
-# Pull requests only build and check it.
+# Builds the single-file wizard (.github/tools/bundle.sh) and publishes it as a
+# release per version: tag v$VERSION (VERSION in setup-gamescope-boot.sh),
+# with that version's CHANGELOG.md section as notes. A released version is
+# never overwritten; the newest one is marked latest, so this always gets it:
+#   curl -fsSL https://github.com/theupriser/cachyos-gamescope-boot/releases/latest/download/setup-gamescope-boot.sh | bash
+# Pull requests only build and check it, and warn when VERSION is already released.
 name: Single-file build
 
 on:
@@ -35,29 +37,38 @@ jobs:
           name: setup-gamescope-boot
           path: dist/setup-gamescope-boot.sh
 
-      - name: Publish to the "latest" release
-        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+      - name: Version
+        id: version
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           version="$(grep -oP '^VERSION=\K.*' setup-gamescope-boot.sh)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          if gh release view "v$version" >/dev/null 2>&1; then
+            echo "released=true" >> "$GITHUB_OUTPUT"
+            echo "::warning::v$version is already released and won't be overwritten. Bump VERSION in setup-gamescope-boot.sh and add a CHANGELOG.md section to release this."
+          else
+            echo "released=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish the v${{ steps.version.outputs.version }} release
+        if: >-
+          github.event_name != 'pull_request' && github.ref == 'refs/heads/main' &&
+          steps.version.outputs.released == 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
           # This version's section of CHANGELOG.md, without its heading.
-          changes="$(awk -v v="$version" '
+          changes="$(awk -v v="$VERSION" '
               $0 ~ "^## " { if (found) exit; if (index($0, "## " v " ") == 1) { found = 1; next } }
               found' CHANGELOG.md)"
-          notes="Single-file build of v$version ($(git describe --always), $(git log -1 --format=%cs)).
-          Run it with:
+          notes="Single-file build of v$VERSION ($(git describe --always), $(git log -1 --format=%cs)).
+          Run the newest version with:
 
-              curl -fsSL https://github.com/${{ github.repository }}/releases/download/latest/setup-gamescope-boot.sh | bash
+              curl -fsSL https://github.com/${{ github.repository }}/releases/latest/download/setup-gamescope-boot.sh | bash
 
-          ## Changes in v$version
+          ## Changes in v$VERSION
           $changes"
-          title="Latest single-file build (v$version)"
-          if gh release view latest >/dev/null 2>&1; then
-            gh release edit latest --title "$title" --notes "$notes"
-          else
-            gh release create latest --title "$title" --notes "$notes" --latest
-          fi
-          # Move the tag to this commit and replace the asset.
-          git tag -f latest && git push -f origin latest
-          gh release upload latest dist/setup-gamescope-boot.sh --clobber
+          gh release create "v$VERSION" dist/setup-gamescope-boot.sh \
+              --target "$GITHUB_SHA" --title "v$VERSION" --notes "$notes" --latest

AGENTS.md

@@ -35,8 +35,9 @@ gamescope and the Plasma desktop. Primary target: the Valve Steam Machine
   the entry point's `for lib in ...; do` source loop and wraps everything
   after that loop in `main()`. Keep that loop on one line, keep all logic in
   functions, and don't rely on `SCRIPT_DIR` for anything but sourcing.
-  CI (`.github/workflows/bundle.yml`) publishes the bundle to the `latest`
-  release on pushes to `main`.
+  CI (`.github/workflows/bundle.yml`) publishes the bundle as release
+  `v$VERSION` on pushes to `main`; an existing version is never overwritten,
+  so bump `VERSION` for every release.
 
 ## Conventions
 

CHANGELOG.md

@@ -44,7 +44,13 @@ Machine LED driver works on every installed kernel and survives kernel updates.
   - Fix a shellcheck warning in the bundle (a variable name shared with
     `lib/state.sh`), which would have failed the CI check.
 - `d7231eb` **chore: Move the bundle tool to .github/tools/bundle.sh**
-- **docs: Commit hashes in the changelog**
+- `5c00504` **docs: Commit hashes in the changelog**
+- **ci: A release per version (tag v0.7.0, ...) instead of overwriting "latest"**
+  - Each push to `main` publishes release `v$VERSION` with that version's
+    changelog; an already released version is never overwritten (pull requests
+    get a warning when `VERSION` wasn't bumped).
+  - Install with `.../releases/latest/download/setup-gamescope-boot.sh`, which
+    always points to the newest release.
 
 ## 0.6.2 - 2026-09-23
 

README.md

@@ -38,7 +38,7 @@ Everything you turn off is put back the way it was.
 Open **Konsole** on your Plasma desktop and run:
 
 ```bash
-curl -fsSL https://github.com/theupriser/cachyos-gamescope-boot/releases/download/latest/setup-gamescope-boot.sh | bash
+curl -fsSL https://github.com/theupriser/cachyos-gamescope-boot/releases/latest/download/setup-gamescope-boot.sh | bash
 ```
 
 That downloads and runs the latest single-file version, and works in any
@@ -334,7 +334,8 @@ gamescope-session, ...) stay installed.
 
 The single-file version is generated: on every push to `main`, GitHub
 Actions runs `.github/tools/bundle.sh`, checks the result with `bash -n` and
-shellcheck, and uploads it to the rolling `latest` release. It inlines
+shellcheck, and publishes it as a release per version (tag `v<VERSION>`,
+never overwritten; the newest is marked latest). It inlines
 `lib/*.sh` and wraps the entry point in `main()`, so bash has read the whole
 file before anything runs; when stdin is a pipe (`curl | bash`) it reattaches
 the terminal for the menu (set `WIZARD_KEEP_STDIN=1` to keep piped input).