build(release): 客户端与服务端分开打包，macOS 提供 dmg 安装镜像

- 服务端：portrelay-server-<版本>-linux-{amd64,arm64}.tar.gz（含 deploy/ 安装脚本）
- 客户端：PortRelay-<版本>.dmg（通用版本），以及 Linux / Windows 的 portrelay-agent 压缩包
- make dmg 打包安装镜像；Release 说明按客户端 / 服务端列出下载项

.github/release-notes.md

@@ -0,0 +1,33 @@
+
+## 下载 · Downloads
+
+### 客户端 · Client
+
+装在能访问内网服务的电脑上，用来创建通道、邀请同事。
+Install it on a machine that can reach your internal services.
+
+| 平台 Platform | 文件 File |
+| --- | --- |
+| macOS（Apple Silicon / Intel） | [PortRelay-{{VERSION}}.dmg]({{DOWNLOAD}}/PortRelay-{{VERSION}}.dmg) |
+| Linux x86_64 | [portrelay-agent-{{VERSION}}-linux-amd64.tar.gz]({{DOWNLOAD}}/portrelay-agent-{{VERSION}}-linux-amd64.tar.gz) |
+| Linux ARM64 | [portrelay-agent-{{VERSION}}-linux-arm64.tar.gz]({{DOWNLOAD}}/portrelay-agent-{{VERSION}}-linux-arm64.tar.gz) |
+| Windows x86_64 | [portrelay-agent-{{VERSION}}-windows-amd64.zip]({{DOWNLOAD}}/portrelay-agent-{{VERSION}}-windows-amd64.zip) |
+
+macOS 是菜单栏 App：打开 dmg，把 PortRelay 拖进「应用程序」。App 未经 Apple 公证，首次打开请在 Finder 里右键选择「打开」。Linux / Windows 是命令行 Agent，运行后在浏览器里打开管理面板。
+On macOS, open the dmg and drag PortRelay to Applications. The app is not notarized, so right-click it and choose Open the first time. On Linux and Windows, run the agent and use the web panel it opens.
+
+### 服务端 · Server (edge gateway)
+
+部署在同事和客户端都能连到的 Linux 机器上。
+Deploy it on a Linux host that both teammates and the client can reach.
+
+| 方式 Method | 文件 File |
+| --- | --- |
+| 二进制 + systemd · x86_64 | [portrelay-server-{{VERSION}}-linux-amd64.tar.gz]({{DOWNLOAD}}/portrelay-server-{{VERSION}}-linux-amd64.tar.gz) |
+| 二进制 + systemd · ARM64 | [portrelay-server-{{VERSION}}-linux-arm64.tar.gz]({{DOWNLOAD}}/portrelay-server-{{VERSION}}-linux-arm64.tar.gz) |
+| Docker | `{{IMAGE}}:{{VERSION}}` |
+
+解压后运行 `sudo ./deploy/install-server.sh ./portrelay-server`，再次运行即可升级。
+Unpack and run `sudo ./deploy/install-server.sh ./portrelay-server`; run it again to upgrade.
+
+校验文件 Checksums：`SHA256SUMS`

.github/workflows/release.yml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   binaries:
-    name: Server & agent binaries
+    name: Server & agent archives
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -31,24 +31,22 @@ jobs:
             dist/*.zip
 
   macos-app:
-    name: macOS app
+    name: macOS app (dmg)
     runs-on: macos-15
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
-      - name: Build universal app
+      - name: Build universal dmg
         run: |
           VERSION=${GITHUB_REF_NAME#v}
           case "$VERSION" in [0-9]*) ;; *) VERSION=0.0.0-${GITHUB_SHA::7} ;; esac
-          UNIVERSAL=1 VERSION=$VERSION ./build-app.sh
-          mkdir -p dist
-          ditto -c -k --sequesterRsrc --keepParent PortRelay.app "dist/PortRelay-$VERSION-macos-universal.zip"
+          UNIVERSAL=1 make dmg VERSION=$VERSION
       - uses: actions/upload-artifact@v4
         with:
           name: macos-app
-          path: dist/*.zip
+          path: dist/*.dmg
 
   docker:
     name: Docker image
@@ -88,13 +86,27 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
+      - uses: actions/checkout@v4
       - uses: actions/download-artifact@v4
         with:
           path: dist
           merge-multiple: true
       - name: Checksums
         run: cd dist && sha256sum * > SHA256SUMS
+      # 说明 = 标签注释正文（本次更新）+ 下载说明（区分客户端与服务端）+ 自动生成的变更列表
+      - name: Release notes
+        run: |
+          git fetch --force origin "refs/tags/$GITHUB_REF_NAME:refs/tags/$GITHUB_REF_NAME"
+          body=$(git tag -l --format='%(contents:body)' "$GITHUB_REF_NAME")
+          {
+            if [ -n "$body" ]; then printf "## 本次更新 · What's new\n\n%s\n\n" "$body"; fi
+            sed -e "s|{{VERSION}}|${GITHUB_REF_NAME#v}|g" \
+                -e "s|{{DOWNLOAD}}|https://github.com/$GITHUB_REPOSITORY/releases/download/$GITHUB_REF_NAME|g" \
+                -e "s|{{IMAGE}}|ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/portrelay-server|g" \
+                .github/release-notes.md
+          } > "$RUNNER_TEMP/notes.md"
+          cat "$RUNNER_TEMP/notes.md"
       - name: Create release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release create "$GITHUB_REF_NAME" dist/* --repo "$GITHUB_REPOSITORY" --title "$GITHUB_REF_NAME" --generate-notes
+        run: gh release create "$GITHUB_REF_NAME" dist/* --repo "$GITHUB_REPOSITORY" --title "$GITHUB_REF_NAME" --notes-file "$RUNNER_TEMP/notes.md" --generate-notes