ap keeps every release and the raw, unstripped binaries are the bulk of
that storage. Strip symbols via the release profile and gzip -9 each
asset before upload (~2.7x smaller); the publish job and Forgejo
mirror-back pass the .gz assets through unchanged.
Assumed .gz per binary over .tar.gz -- the assets are single files, so a
tarball only adds a directory layer. Flag if a bundle (LICENSE/README) is
wanted. E2E needs a release run; piggyback on the next real tag.
Tag-triggered (v* on the Forgejo mirror) instead of a hand-made GitHub
release. Adds an aarch64-linux leg; a single publish job creates the GitHub
release and mirrors every binary back onto the matching Forgejo release via
FORGEJO_RELEASE_TOKEN. Keeps the hurl HTTP contract harness on x86_64-linux.
Assumed v* tags are the release trigger and the contract tests run once on the
deploy target (x86_64-linux); flag if either is wrong.
On a published GitHub Release, for each target (amd64 Linux, arm macOS) run
the Rust test suite and the hurl HTTP contract tests, build the release
binary on a stable toolchain, and upload it as a target-named asset on the
triggering release. Trigger is release:published per ANW-29 -- aav creates
the release and tag in the UI; the workflow never creates them.
