From 92b7308497cc7c31efe017c377f1c2f1d3d23be3 Mon Sep 17 00:00:00 2001
From: Federico Meloni <madb4ron@gmail.com>
Date: Sun, 30 Aug 2026 21:28:44 +0200
Subject: [PATCH 1/2] run physval only on tags

---
 .github/workflows/build.yaml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index c02613b..8dea5fe 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -4,8 +4,11 @@ on:
   # Build/publish the image when changes land on main; run on pull requests (so
   # the required checks report on PRs); allow manual runs via the "Run workflow"
   # button. No push trigger on other branches -- use dispatch for those.
+  # Release tags run the same build, plus the full physics validation and the
+  # Pages deployment (both gated on refs/tags below).
   push:
     branches: [main]
+    tags: ['v*']
   workflow_dispatch:
   pull_request:
 
@@ -107,12 +110,11 @@ jobs:
   # ------------------------------------------------------ physics validation --
   physics-validation:
     # Run the sim -> digi -> reco -> plot chain against the freshly published
-    # multi-arch sim image after merges, manual builds, and same-repository pull
-    # requests. Pull requests also get the quicker validation above.
+    # multi-arch sim image. This is the expensive, full matrix, so it only runs
+    # for release tags; pushes to main and pull requests get the quick pion-only
+    # physics-fast job above instead.
     needs: manifest-sim
-    # Skip on fork PRs: the image isn't pushed there, so there is nothing to pull
-    # and validate (fork PRs build the image but cannot push it).
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+    if: ${{ startsWith(github.ref, 'refs/tags/') }}
     strategy:
       fail-fast: false
       matrix:
@@ -128,8 +130,9 @@ jobs:
       pdg: ${{ matrix.pdg }}
 
   deploy-pages:
+    # Publishes the plots produced by physics-validation, so it is tag-only too.
     needs: physics-validation
-    if: github.ref == 'refs/heads/main'
+    if: ${{ startsWith(github.ref, 'refs/tags/') }}
     runs-on: ubuntu-latest
     permissions:
       pages: write

From e9611f7d6164602bb465b24a309eeb88be900413 Mon Sep 17 00:00:00 2001
From: Federico Meloni <madb4ron@gmail.com>
Date: Sun, 30 Aug 2026 21:49:44 +0200
Subject: [PATCH 2/2] auto-upload histos on tag

---
 .github/workflows/build.yaml                  | 32 +++++++++++++++++++
 .../physics-validation-template.yaml          | 27 ++++++++++++++++
 2 files changed, 59 insertions(+)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 8dea5fe..3b6dd27 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -129,6 +129,38 @@ jobs:
       image: ${{ needs.manifest-sim.outputs.image }}
       pdg: ${{ matrix.pdg }}
 
+  # ------------------------------------------------------------ release assets --
+  release-assets:
+    # Attach the per-particle histogram files from physics-validation to the
+    # release for this tag. Tag-only, like the job it consumes.
+    needs: physics-validation
+    if: ${{ startsWith(github.ref, 'refs/tags/') }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Collect histogram files
+        uses: actions/download-artifact@v8
+        with:
+          pattern: histos-*
+          path: histos
+          merge-multiple: true
+      - name: Upload histograms as release assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          ls -l histos
+          # A release published from the GitHub UI already exists by the time the
+          # tag push lands here; a tag pushed with plain `git push` has none, so
+          # create one in that case. --clobber makes re-runs idempotent.
+          if ! gh release view "${TAG}" >/dev/null 2>&1; then
+            echo "No release for ${TAG} yet -- creating one."
+            gh release create "${TAG}" --verify-tag --generate-notes
+          fi
+          gh release upload "${TAG}" histos/*.root --clobber
+
   deploy-pages:
     # Publishes the plots produced by physics-validation, so it is tag-only too.
     needs: physics-validation
diff --git a/.github/workflows/physics-validation-template.yaml b/.github/workflows/physics-validation-template.yaml
index 74ece1a..814f228 100644
--- a/.github/workflows/physics-validation-template.yaml
+++ b/.github/workflows/physics-validation-template.yaml
@@ -303,6 +303,33 @@ jobs:
             submission.json
             plot_work/**/metrics_*.json
           if-no-files-found: error
+      - name: Stage histogram files for the release
+        # make_plots.sh writes plot_work/<particle>/<settings-tag>/histos_<study>.root.
+        # Release assets share one flat namespace across the whole matrix, and the
+        # study names repeat per particle (histos_tracks.root for muon, electron
+        # and pion alike), so stamp the particle into each name before uploading.
+        env:
+          PARTICLE: ${{ needs.meta.outputs.particle }}
+        run: |
+          mkdir -p histos
+          shopt -s nullglob
+          n=0
+          for f in plot_work/"${PARTICLE}"/*/histos_*.root; do
+            base="$(basename "${f}" .root)"
+            cp "${f}" "histos/${base}_${PARTICLE}.root"
+            n=$((n + 1))
+          done
+          if [ "${n}" -eq 0 ]; then
+            echo "ERROR: the studies wrote no histos_*.root under plot_work/${PARTICLE}" >&2
+            exit 1
+          fi
+          ls -l histos
+      - name: Upload histogram files
+        uses: actions/upload-artifact@v7
+        with:
+          name: histos-${{ needs.meta.outputs.particle }}
+          path: histos
+          if-no-files-found: error
       - name: Upload plots (per-particle Pages fragment)
         uses: actions/upload-artifact@v7
         with: