docs: add CI/release documentation and ignore dist directory

Add `/dist/` to `.gitignore` to exclude locally built distribution
artifacts. Document the Gitea Actions workflow, release tagging, and
branch protection setup in the README.

scripts/ci/package-release.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd -P)"
+cd -- "$repo_root"
+
+tag=${1:-}
+if [[ ! "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  printf 'captioneer: release tag must match vMAJOR.MINOR.BUG, got %q\n' "$tag" >&2
+  exit 1
+fi
+
+platform=linux-amd64
+archive_name="captioneer-${tag}-${platform}.tar.gz"
+package_name="captioneer-${tag}-${platform}"
+package_dir="dist/$package_name"
+
+rm -rf -- "$package_dir"
+rm -f -- "dist/$archive_name" "dist/$archive_name.sha256"
+mkdir -p -- "$package_dir/lib" "$package_dir/scripts"
+
+# The Sherpa Go module embeds an absolute build-machine RPATH. Add a portable
+# fallback so the bundled native libraries resolve beside the extracted tools.
+# shellcheck disable=SC2016 # $ORIGIN must remain literal for the ELF loader.
+export CGO_LDFLAGS='-Wl,-rpath,$ORIGIN/lib'
+go build -trimpath -o "$package_dir/captioneer" ./src/cmd/captioneer
+go build -trimpath -tags gtk -o "$package_dir/captioneer-desktop" ./src/cmd/captioneer-desktop
+
+sherpa_dir="$(go list -m -f '{{.Dir}}' github.com/k2-fsa/sherpa-onnx-go-linux)"
+sherpa_lib_dir="$sherpa_dir/lib/x86_64-unknown-linux-gnu"
+cp -- "$sherpa_lib_dir/libsherpa-onnx-c-api.so" "$package_dir/lib/"
+cp -- "$sherpa_lib_dir/libonnxruntime.so" "$package_dir/lib/"
+cp -- README.md LICENSE "$package_dir/"
+cp -- scripts/download-models.sh "$package_dir/scripts/"
+
+for executable in captioneer captioneer-desktop; do
+  # shellcheck disable=SC2016 # Verify the literal ELF-loader token.
+  if ! readelf -d "$package_dir/$executable" | grep -Fq '$ORIGIN/lib'; then
+    printf 'captioneer: %s is missing the portable native-library RPATH\n' "$executable" >&2
+    exit 1
+  fi
+done
+
+tar -C dist -czf "dist/$archive_name" "$package_name"
+(
+  cd -- dist
+  sha256sum "$archive_name" > "$archive_name.sha256"
+)
+
+printf '%s\n' "$repo_root/dist/$archive_name"
+printf '%s\n' "$repo_root/dist/$archive_name.sha256"

scripts/ci/publish-release.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+: "${GITEA_API_URL:?GITEA_API_URL is required}"
+: "${GITEA_REPOSITORY:?GITEA_REPOSITORY is required}"
+: "${GITEA_TOKEN:?GITEA_TOKEN is required}"
+: "${RELEASE_TAG:?RELEASE_TAG is required}"
+: "${RELEASE_NOTES:?RELEASE_NOTES is required}"
+
+if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  printf 'captioneer: release tag must match vMAJOR.MINOR.BUG, got %q\n' "$RELEASE_TAG" >&2
+  exit 1
+fi
+if (( $# == 0 )); then
+  printf 'captioneer: at least one release asset is required\n' >&2
+  exit 1
+fi
+
+for asset in "$@"; do
+  [[ -f "$asset" ]] || { printf 'captioneer: release asset not found: %s\n' "$asset" >&2; exit 1; }
+done
+
+api_base="${GITEA_API_URL%/}/repos/$GITEA_REPOSITORY"
+authorization="Authorization: token $GITEA_TOKEN"
+release_response="$(mktemp)"
+trap 'rm -f -- "$release_response"' EXIT
+
+status="$(curl --silent --show-error --output "$release_response" --write-out '%{http_code}' \
+  --header "$authorization" \
+  "$api_base/releases/tags/$RELEASE_TAG")"
+
+release_payload="$(jq -n \
+  --arg tag "$RELEASE_TAG" \
+  --arg name "Captioneer $RELEASE_TAG" \
+  --rawfile body "$RELEASE_NOTES" \
+  '{tag_name: $tag, name: $name, body: $body, draft: false, prerelease: false}')"
+
+case "$status" in
+  200)
+    release_id="$(jq -er '.id' "$release_response")"
+    curl --fail-with-body --silent --show-error \
+      --request PATCH \
+      --header "$authorization" \
+      --header 'Content-Type: application/json' \
+      --data "$release_payload" \
+      "$api_base/releases/$release_id" > "$release_response"
+    ;;
+  404)
+    curl --fail-with-body --silent --show-error \
+      --request POST \
+      --header "$authorization" \
+      --header 'Content-Type: application/json' \
+      --data "$release_payload" \
+      "$api_base/releases" > "$release_response"
+    release_id="$(jq -er '.id' "$release_response")"
+    ;;
+  *)
+    printf 'captioneer: Gitea release lookup failed with HTTP %s\n' "$status" >&2
+    cat "$release_response" >&2
+    exit 1
+    ;;
+esac
+
+for asset in "$@"; do
+  asset_name="$(basename -- "$asset")"
+  while IFS= read -r attachment_id; do
+    [[ -n "$attachment_id" ]] || continue
+    curl --fail-with-body --silent --show-error \
+      --request DELETE \
+      --header "$authorization" \
+      "$api_base/releases/$release_id/assets/$attachment_id" >/dev/null
+  done < <(jq -r --arg name "$asset_name" '.assets[]? | select(.name == $name) | .id' "$release_response")
+
+  curl --fail-with-body --silent --show-error \
+    --request POST \
+    --header "$authorization" \
+    --form "attachment=@$asset" \
+    "$api_base/releases/$release_id/assets?name=$asset_name" >/dev/null
+  printf 'Uploaded %s\n' "$asset_name"
+done

scripts/ci/test.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd -P)"
+cd -- "$repo_root"
+
+go test ./...
+go test -tags gtk ./...
+go vet ./...
+go vet -tags gtk ./...
+
+shellcheck \
+  scripts/download-models.sh \
+  scripts/distrobox/common.sh \
+  scripts/distrobox/build.sh \
+  scripts/distrobox/run.sh \
+  scripts/ci/test.sh \
+  scripts/ci/package-release.sh \
+  scripts/ci/publish-release.sh