ci: the gate uploads the release binary as a run artifact

Releases are batched, so a change on main could wait days for a package
(#87). The gate now ends by building the bare release binary as the
release workflow does, with the webview it already built embedded, and
uploading it named for the commit, kept seven days. It is the last step
so a red gate uploads nothing that could be mistaken for tested.

Closes #87

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NUx7SPonBnB3ofU4mH41WT

.gitea/workflows/ci.yaml

@@ -95,3 +95,26 @@ jobs:
         # `cargo test` regenerates ui/src/api/generated via ts-rs. A diff here
         # means an entities change was committed without its TypeScript.
         run: git diff --exit-code -- ui/src/api/generated
+
+      - name: release binary
+        # The bare binary, as the release workflow builds it, so a change
+        # can be tried on a machine before any release is cut (#87). It
+        # embeds the webview built by the gate above (tauri.conf.json's
+        # frontendDist), and it wants the GTK/WebKitGTK libraries the rpm
+        # depends on. Last, so a red gate uploads nothing to mistake for
+        # tested.
+        run: |
+          set -euo pipefail
+          cargo build --locked --release -p wallet-app
+          mkdir -p artifact
+          install -m 0755 target/release/blackbeard-wallet \
+            "artifact/blackbeard-wallet-${GITHUB_SHA::7}-x86_64-linux-gnu"
+          (cd artifact && sha256sum * > SHA256SUMS)
+          ls -l artifact
+
+      - name: upload the binary
+        uses: actions/upload-artifact@v3
+        with:
+          name: blackbeard-wallet-${{ github.sha }}-x86_64-linux-gnu
+          path: artifact/
+          retention-days: 7

readme.md

@@ -68,6 +68,9 @@ cargo test --workspace                                        # also regenerates
 
 The CI gate is `cargo fmt --check`, `cargo clippy -D warnings`, `cargo test`,
 and the webview's typecheck, lint and build. Run them before claiming done.
+A green gate on `main` also uploads the release binary as a run artifact
+(`blackbeard-wallet-<sha>-x86_64-linux-gnu`, kept seven days), so a change can
+be tried on a machine before a release is cut.
 
 ## Work