build: pin rony-llm-agent and add CI build workflow

- require github.com/VictorVargas/rony-llm-agent pinned to a pseudo-version
  (latest commit on cde9ac3); will be replaced by a tagged version once the
  dep is tagged and published
- replace directive lets 'go build' work on a fresh clone without the
  parent go.work; REMOVE this replace when the dep is public
- build.yml: builds the binary on push to main and tag push, uploads as
  artifact, and attaches to the release on tag push when one exists

CI will fail until rony-llm-agent is public — that's expected. Remove the
replace and bump the require version to the first tagged release when it is.

.github/workflows/build.yml

@@ -0,0 +1,60 @@
+name: Build
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'v*.*.*'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.26'
+          cache: true
+
+      - name: Build binary
+        run: |
+          set -euo pipefail
+          version=$(tr -d '[:space:]' < VERSION)
+          echo "Building chat-bot $version"
+          go build \
+            -trimpath \
+            -ldflags "-s -w -X main.version=$version" \
+            -o bin/chat-bot \
+            ./cmd/chat-bot
+
+      - name: Sanity check
+        run: ./bin/chat-bot version
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: chat-bot-${{ github.sha }}
+          path: bin/chat-bot
+          retention-days: 14
+
+      - name: Attach to release
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if gh release view "${{ github.ref_name }}" >/dev/null 2>&1; then
+            gh release upload "${{ github.ref_name }}" bin/chat-bot --clobber
+            echo "Attached bin/chat-bot to ${{ github.ref_name }}"
+          else
+            echo "No release for ${{ github.ref_name }} (tag has [skip-release] or release not created yet), skipping attachment"
+          fi

go.mod

@@ -3,12 +3,18 @@ module github.com/VictorVargas/rony-chat-bot
 go 1.26
 
 require (
+	github.com/VictorVargas/rony-llm-agent v0.0.0-1784272269-cde9ac3
 	github.com/go-chi/chi/v5 v5.3.1
 	github.com/spf13/cobra v1.10.2
 	gopkg.in/yaml.v3 v3.0.1
 	modernc.org/sqlite v1.53.0
 )
 
+// TODO: remove this replace when rony-llm-agent is published and the require
+// above is updated to a tagged version. The replace lets `go build` work
+// outside of `go.work` (e.g. on a fresh clone without the parent workspace).
+replace github.com/VictorVargas/rony-llm-agent => ../rony-llm-agent
+
 require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect