Move releases to GitHub, with one bridge release on Gitea

GitHub has no generic package registry, so releases become GitHub
release assets. The updater and install.sh read releases/latest/download
and releases/download/<v>/, plain redirects with no API rate limit.
make release publishes a draft with all assets, then makes it latest.
make release-gitea publishes the same version to the old Gitea registry
for binaries that still update from there, and refuses until GitHub
serves it. See D33.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -1,12 +1,16 @@
-# Build and publish submarine. Releases are built locally and uploaded to the
-# Gitea generic package registry (see docs/architecture.md#distribution).
+# Build and publish submarine. Releases are built locally and uploaded as
+# GitHub release assets (see docs/architecture.md#distribution).
 #
-#   make dist                      cross-compile into dist/
-#   GITEA_TOKEN=... make release   test, build and publish the tagged HEAD
+#   make dist                         cross-compile into dist/
+#   make release NOTES=FILE           test, build and publish the tagged HEAD (gh)
+#   GITEA_TOKEN=... make release-gitea  bridge only: the same version to the old Gitea registry
 
 # Settings from .env (see .env.template); `make VAR=...` on the command line wins.
 -include .env
-export GITEA_TOKEN
+export GITEA_TOKEN GH_TOKEN
+
+GITHUB_REPO ?= simonfranken/submarine
+RELEASES    := https://github.com/$(GITHUB_REPO)/releases
 
 GITEA_URL   ?= https://git.simon-franken.de
 GITEA_OWNER ?= simonfranken
@@ -17,7 +21,7 @@ LDFLAGS  := -s -w -X main.version=$(VERSION)
 PLATFORMS := linux_amd64 linux_arm64 darwin_amd64 darwin_arm64
 BINARIES  := $(addprefix dist/submarine_,$(PLATFORMS))
 
-.PHONY: build test vet dist release clean FORCE
+.PHONY: build test vet dist check-tag release release-gitea clean FORCE
 
 build:
 	go build -ldflags '$(LDFLAGS)' -o submarine ./cmd/submarine
@@ -41,11 +45,31 @@ dist/submarine_%: FORCE
 dist/checksums.txt: $(BINARIES)
 	cd dist && sha256sum $(notdir $(BINARIES)) > checksums.txt
 
-release:
-	@test -n "$$GITEA_TOKEN" || { echo "GITEA_TOKEN is not set (needs write:package)"; exit 1; }
+check-tag:
 	@echo '$(VERSION)' | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$$' || \
 		{ echo "VERSION '$(VERSION)' is not a clean tag: tag HEAD as vX.Y.Z with a clean tree"; exit 1; }
 	@test -z "$$(git status --porcelain)" || { echo "working tree is not clean"; exit 1; }
+
+# A draft gets all assets first and is published last, so releases/latest
+# never points at a release with missing files.
+release: check-tag
+	@test -n "$(NOTES)" && test -f "$(NOTES)" || { echo "NOTES=FILE with the release notes is required"; exit 1; }
+	@command -v gh >/dev/null || { echo "gh (GitHub CLI) is required"; exit 1; }
+	@gh auth status >/dev/null 2>&1 || { echo "gh is not logged in: run gh auth login or set GH_TOKEN"; exit 1; }
+	$(MAKE) clean test vet dist VERSION=$(VERSION)
+	printf '%s\n' '$(VERSION)' > dist/VERSION
+	gh release create '$(VERSION)' --repo '$(GITHUB_REPO)' --verify-tag --draft \
+		--title '$(VERSION)' --notes-file '$(NOTES)' $(BINARIES) dist/checksums.txt dist/VERSION
+	gh release edit '$(VERSION)' --repo '$(GITHUB_REPO)' --draft=false --latest
+	@echo "released $(VERSION): $(RELEASES)/tag/$(VERSION)"
+
+# Bridge release for binaries that still update from Gitea: same version,
+# old registry layout. Refuses until GitHub serves this version, so a binary
+# updated from Gitea finds its release on GitHub. Remove after the bridge.
+release-gitea: check-tag
+	@test -n "$$GITEA_TOKEN" || { echo "GITEA_TOKEN is not set (needs write:package)"; exit 1; }
+	@test "$$(curl -fsSL '$(RELEASES)/latest/download/VERSION' | tr -d '[:space:]')" = '$(VERSION)' || \
+		{ echo "GitHub does not serve $(VERSION) as latest yet: run make release first"; exit 1; }
 	$(MAKE) clean test vet dist VERSION=$(VERSION)
 	@set -e; \
 	for f in $(BINARIES) dist/checksums.txt; do \
@@ -59,7 +83,7 @@ release:
 		"$(GITEA_URL)/api/v1/packages/$(GITEA_OWNER)/generic/submarine-latest/latest" >/dev/null || true; \
 	curl -fsS -X PUT -H "Authorization: token $$GITEA_TOKEN" \
 		--upload-file dist/VERSION "$(REGISTRY)/submarine-latest/latest/VERSION" >/dev/null; \
-	echo "released $(VERSION)"
+	echo "released $(VERSION) to Gitea"
 
 clean:
 	rm -rf dist submarine