build: publish one current tarball instead of per-tag snapshots

cgit offers snapshots for every tag or for none, so colitur.git now has
cgit.snapshots=0 and 'make release-tarball' uploads the tagged archive to
a stable URL. Ten tags had meant twenty download links, nineteen of them
stale.

The target refuses to run from an untagged or dirty tree, so what is
published always matches a tag.

2 files changed, 28 insertions, 2 deletions

diff --git a/Makefile b/Makefile
index 0176f32..936cf1b 100644
--- a/Makefile
+++ b/Makefile
@@ -22,7 +22,7 @@ MAN5DIR  := $(PREFIX)/share/man/man5
 # over documenting the dune commands.
 DUNE := opam exec --
 
-.PHONY: help build test check check-schema check-templates check-citations install uninstall reinstall clean fmt man doc release
+.PHONY: release-tarball help build test check check-schema check-templates check-citations install uninstall reinstall clean fmt man doc release
 help: ## show this help
 	@grep -hE '^[a-z-]+:.*##' $(MAKEFILE_LIST) | sed -E 's/:.*## /\t/' | sort
 
@@ -153,6 +153,27 @@ install: build ## install binary, calendar data, language tables, templates, sch
 	@command -v $(COLITUR) >/dev/null 2>&1 || \
 	  echo "note: $(BINDIR) is not on PATH -- add it, or run $(BINDIR)/$(COLITUR) directly"
 
+# --- release -------------------------------------------------------------
+# cgit offers per-tag snapshots for EVERY tag or for none, and ten tags meant
+# twenty download links, nineteen of them stale. colitur.git therefore has
+# cgit.snapshots=0 and this target publishes one current tarball at a stable
+# URL instead. Run it from a tagged commit.
+RELEASE_HOST ?= vps-mail-i2p
+RELEASE_DIR  ?= /usr/local/www/cgit
+RELEASE_NAME ?= colitur-latest.tar.gz
+
+release-tarball: ## upload the current tag's tarball as the single published download
+	@v=$$(git describe --tags --exact-match 2>/dev/null) || \
+	  { echo "make release-tarball: HEAD is not tagged; tag it first" >&2; exit 1; }; \
+	test -z "$$(git status --porcelain)" || \
+	  { echo "make release-tarball: working tree is dirty" >&2; exit 1; }; \
+	echo "packaging $$v"; \
+	git archive --format=tar.gz --prefix=colitur-$${v#v}/ -o /tmp/$(RELEASE_NAME) "$$v"; \
+	scp -q /tmp/$(RELEASE_NAME) $(RELEASE_HOST):/tmp/$(RELEASE_NAME); \
+	ssh $(RELEASE_HOST) "doas install -m 644 /tmp/$(RELEASE_NAME) $(RELEASE_DIR)/$(RELEASE_NAME) && rm -f /tmp/$(RELEASE_NAME)"; \
+	rm -f /tmp/$(RELEASE_NAME); \
+	echo "published $$v to https://git.labunix.xyz/$(RELEASE_NAME)"
+
 uninstall: ## remove everything install put into PREFIX
 	-$(DUNE) dune uninstall --prefix $(PREFIX)
 	rm -f $(MANDIR)/colitur.1 $(MAN5DIR)/colitur-overlay.5 $(MAN5DIR)/colitur-templates.5 $(MAN5DIR)/colitur-config.5
@@ -207,4 +228,4 @@ release: ## cut a release: make release VERSION=0.1.0  (add its CHANGELOG line f
 	@git rev-parse -q --verify "refs/tags/v$(VERSION)" >/dev/null && \
 	  { echo "tag v$(VERSION) already exists; delete it first to re-cut" >&2; exit 2; } || true
 	git tag -a "v$(VERSION)" -m "colitur $(VERSION)"
-	@echo "tagged v$(VERSION). publish with: git push origin main v$(VERSION)"
+	@echo "tagged v$(VERSION). publish with: git push origin main v$(VERSION) && make release-tarball"
diff --git a/README.md b/README.md
index 7413eb3..165f2da 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,10 @@
 # colitur
 
+**Download:** [colitur-latest.tar.gz](https://git.labunix.xyz/colitur-latest.tar.gz)
+— always the current release. Older tags are listed on the
+[tags page](https://git.labunix.xyz/colitur.git/refs/tags) but are not offered
+for download: running a stale liturgical calendar is worse than running none.
+
 *computus liturgicus* — a safe, highly-tested, deterministic engine that computes
 and validates liturgical calendars for multiple rites, with template-driven output.