release: the PC stick image, and a Gitea release anyone can download from (#126)

- scripts/nightly.sh images builds the PC's USB stick too (make boot_image
  TARGET=PC -> pc-stick.img.xz, in SHA256SUMS); publish sends it to Nexus
  as classifier pc-stick. pc stays the ISO QEMU boots.
- scripts/nightly.sh gitea-release <tag>: the tag as a Gitea release -- a
  pre-release for -alpha.N and the like -- notes from the tag's message with
  the checksums, the images, SHA256SUMS, the documents and the StarshipOS
  Root CA's certificate attached; run again, it adds only what is missing.
  release.yml runs it after the Nexus publish, with the secret RELEASE_TOKEN.

Tested here: images builds pc-stick.img.xz (785 KB); gitea-release against
a stand-in Gitea API made a pre-release with the notes and ten files, and a
second run added nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

.gitea/workflows/nightly.yml

@@ -6,6 +6,7 @@
 #
 #   org.starship:kernelImage:<LITHOS_VERSION>-SNAPSHOT, starshipos-snapshots
 #     classifier pc      StarshipOS.iso   amd64, UEFI -- the ISO the amd64 acceptance boot booted
+#     classifier pc-stick pc-stick.img.xz a PC's USB stick, for any UEFI PC (make boot_image TARGET=PC)
 #     classifier raspi5  raspi5.img.xz    Raspberry Pi 5, for Raspberry Pi Imager
 #     classifier milkv   MilkV.img.xz     Milk-V Mars
 #     classifier logs    logs.tar.gz      this run's serial logs and DoE CSVs (the proof log is in

.gitea/workflows/release.yml

@@ -2,9 +2,14 @@
 # acceptance protocol, the proofs, the board images -- and the documents, and publishes both to
 # starshipos-releases at that version:
 #
-#   org.starship:kernelImage:<version>     classifiers pc, raspi5, milkv, logs (nightly.yml)
+#   org.starship:kernelImage:<version>     classifiers pc, pc-stick, raspi5, milkv, logs (nightly.yml)
 #   org.starship:documentation:<version>   classifiers book, vol1, vol2, vol3, api (nightly-docs.yml)
 #
+# and makes the tag a Gitea release -- a pre-release for v<x.y.z>-alpha.N and the like -- with the
+# images, SHA256SUMS, the documents and the StarshipOS Root CA's certificate attached, for anyone
+# to download (#126; scripts/nightly.sh gitea-release). Needs the secret RELEASE_TOKEN: a token
+# that may write the repository.
+#
 # The tag must name the version the tree says it is: v<LITHOS_VERSION> (kernel/Makefile). A tag
 # that does not is refused before anything is built. A release repository takes a version once.
 name: Release
@@ -84,6 +89,11 @@ jobs:
           scripts/nightly.sh publish https://nexus.starshipos-f18.org/repository/starshipos-releases
           scripts/nightly.sh publish-docs https://nexus.starshipos-f18.org/repository/starshipos-releases
 
+      - name: Gitea release              # the downloads anyone can fetch (#126): no Nexus login
+        env:
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}   # a token that may write the repository
+        run: scripts/nightly.sh gitea-release "${{ github.ref_name }}"
+
       - name: Keep the release
         uses: actions/upload-artifact@v3
         with: