ci: attach the orig tarball and snap to the tag release

A pushed tag only gets Gitea's automatic tree archive: a snapshot
named after the raw tag, unusable as a Debian orig (the upstream
version may not carry a hyphen — 0.2.0-rc1 parses as upstream 0.2.0,
revision rc1, where the Debian encoding of the prerelease is
0.2.0~rc1) and with no release object to hold attachments. A v* tag
now publishes a release with the dpkg-shaped orig tarball (git
archive, prefixed pkh-<version>/), the packed snap and their
checksums; prerelease tags mark the release as such, and an existing
release is reused on a tag re-push. Still nothing published beyond
this repo's release page.

.github/workflows/ci.yml

@@ -123,6 +123,71 @@ jobs:
           path: ./*.snap
           if-no-files-found: error
 
+  release:
+    # Publishes the release artifacts on a v* tag: the Debian orig
+    # tarball, the packed snap, and their checksums. Gitea's automatic
+    # per-tag archive is a git-tree snapshot named after the raw tag —
+    # not a dpkg-shaped orig (the version must not carry a hyphen; the
+    # Debian encoding of a prerelease is 0.2.0~rc1). Nothing is
+    # published beyond this repo's release page: no crates.io (see the
+    # publish job), no snap store.
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [build, snap]
+    runs-on: ubuntu-latest
+    container:
+      image: ubuntu:26.04
+      options: --privileged --cap-add SYS_ADMIN --security-opt apparmor:unconfined
+    steps:
+    - name: Set up container image
+      run: |
+        apt-get update
+        apt-get install -y nodejs curl ca-certificates git
+    - uses: actions/checkout@v6
+    - uses: actions/download-artifact@v3
+      with:
+        name: snap
+    - name: Build the orig tarball
+      run: |
+        tag="${GITHUB_REF_NAME#v}"
+        debver="${tag/-/~}"
+        git archive --format=tar.gz --prefix="pkh-${debver}/" \
+          -o "pkh_${debver}.orig.tar.gz" HEAD
+        sha256sum pkh_${debver}.orig.tar.gz pkh_*_amd64.snap > sha256sums.txt
+    - name: Create or get the release
+      id: release
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
+        tag="$GITHUB_REF_NAME"
+        case "$tag" in *-*) pre=true;; *) pre=false;; esac
+        body="{\"tag_name\":\"$tag\",\"name\":\"pkh $tag\",\"body\":\"Release artifacts for $tag: the Debian orig tarball, the packed snap and their checksums.\",\"draft\":false,\"prerelease\":$pre}"
+        release_id=$(curl -sf -X POST \
+          -H "Authorization: token $GITHUB_TOKEN" \
+          -H "Content-Type: application/json" \
+          -d "$body" "$api/releases" \
+          | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2 || true)
+        if [ -z "$release_id" ]; then
+          # Already released (e.g. a re-push of the tag): reuse it.
+          release_id=$(curl -sf "$api/releases/tags/$tag" \
+            | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
+        fi
+        [ -n "$release_id" ] || { echo "cannot resolve the release id" >&2; exit 1; }
+        echo "release_id=$release_id" >> "$GITHUB_OUTPUT"
+    - name: Upload the release assets
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        RELEASE_ID: ${{ steps.release.outputs.release_id }}
+      run: |
+        api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
+        for f in pkh_*.orig.tar.gz pkh_*_amd64.snap sha256sums.txt; do
+          echo "attaching $f"
+          curl -sf -X POST \
+            -H "Authorization: token $GITHUB_TOKEN" \
+            -F "attachment=@$f" \
+            "$api/releases/$RELEASE_ID/assets?name=$(basename "$f")"
+        done
+
   publish:
     # Publishes the crate to crates.io on a release tag (a v* tag without
     # a prerelease suffix: v0.2.0 publishes, v0.2.0-rc1 does not — release