handle publishes on tag

.github/workflows/build.yml

@@ -5,6 +5,7 @@ on: [push, pull_request]
 jobs:
   build:
     runs-on: ubuntu-latest
+    shell: bash
     steps:
       # dependencies
       - name: dependencies
@@ -51,9 +52,16 @@ jobs:
 
       # build
       - name: build
+        if: !startsWith(github.ref, 'refs/tags/')
         run: |
           make snapshot
 
+      # publish
+      - name: publish
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          make publish
+
       # artifacts
       - name: artifact_linux
         uses: actions/upload-artifact@v2-preview

Makefile

@@ -85,6 +85,7 @@ release: fetch ## Generate a release, but don't publish
 .PHONY: publish
 publish: fetch ## Generate a release, and publish
 		docker run --rm --privileged \
+			-e GITHUB_TOKEN="${GITHUB_TOKEN}" \
 			-e VERSION="${VERSION}" \
 			-e GIT_COMMIT="${GIT_COMMIT}" \
 			-e TIMESTAMP="${TIMESTAMP}" \