Release setup: tarballs, Gitea workflow, apt registry

make dist builds tarballs for linux/amd64 and linux/arm64. A pushed v*
tag runs .gitea/workflows/release.yml, which checks the tag against
VERSION and the CHANGELOG, tests, builds the tarballs and the .debs
(amd64, arm64) and publishes them with scripts/gitea-release.sh: a Gitea
release, and the .debs in the Debian registry (stable, or testing for a
release candidate). As in Housecarl and Steward; no cli-dist, Guard is
Linux only. docs/development.md has the steps, docs/install.md the apt
source.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -0,0 +1,49 @@
+# Developing Guard
+
+[AGENTS.md](../AGENTS.md) has the layout and the ground rules.
+
+## Building and testing
+
+```sh
+make            # bin/guard and its bash completion
+make test       # go vet, gofmt check, go test ./...
+make e2e        # scripts/e2e.sh: needs Docker and ../housecarl
+make deb        # dist/guard_<version>_<arch>.deb
+make dist       # dist/guard-<version>-linux-<arch>.tar.gz (amd64, arm64)
+```
+
+**Unit tests** need neither Housecarl nor a journal: the daemon tests
+ban into a fake Housecarl, the journal test runs a fake journalctl
+(`GUARD_JOURNALCTL`), and `TestPresets` runs each preset over its sample
+lines in `testdata/presets/`.
+
+**The e2e test** borrows Housecarl's lab: a router container (Debian 13,
+nftables 1.1.3, the `housecarl-nft` image that Housecarl's `make e2e`
+makes) runs housecarld built from `../housecarl` (or `HOUSECARL_SRC`),
+a LAN server runs Guard over a log file, and a host on the internet
+misbehaves. It checks a ban at the router (one port, for that server
+alone), `never_ban`, bans waiting while Housecarl is down, and Guard on
+the router banning scanners from Housecarl's log of dropped packets.
+`KEEP=1` leaves the lab running; `DOCKER_HOST` points at another Docker
+daemon.
+
+The systemd sandbox is only tested by installing the package in a
+container that runs systemd (`--privileged --cgroupns=host /sbin/init`).
+
+## Releasing
+
+As for Jarl, Steward and Housecarl:
+
+1. Move "Unreleased" in `CHANGELOG.md` under `## [<version>] - <date>`.
+   A release candidate may leave it there.
+2. Put the version in `VERSION`, and update the README's status line.
+3. Run `make test && make e2e`.
+4. Commit as "Release X", tag it `git tag -a vX -m "Guard X"`, and push.
+
+The tag starts `.gitea/workflows/release.yml`, which checks the tag
+against `VERSION` and the CHANGELOG, runs the tests, builds the tarballs
+and the `.deb`s (amd64, arm64), and publishes them
+(`scripts/gitea-release.sh`): a Gitea release with the notes and the
+files, and the `.deb`s in the owner's Debian registry, `stable` for a
+release and `testing` for a release candidate. It needs the repository
+secret `RELEASE_TOKEN` (`write:repository`, `write:package`).

docs/install.md

@@ -28,11 +28,26 @@ A watch that reads Housecarl's own log (`housecarl-drops`) also needs
 
 ## 2. The package
 
+Guard's releases publish its Debian package to the same Gitea registry
+as Jarl's, Steward's and Housecarl's: `stable` for releases, `testing`
+for release candidates. If apt already has it, `sudo apt install guard`
+is all it takes. Otherwise add it:
+
 ```sh
-sudo apt install ./guard_0.1.0_amd64.deb
+sudo install -d /etc/apt/keyrings
+sudo curl -fsSL https://gitea.adbraun.lol/api/packages/adam/debian/repository.key -o /etc/apt/keyrings/gitea-adam.asc
+echo "deb [signed-by=/etc/apt/keyrings/gitea-adam.asc] https://gitea.adbraun.lol/api/packages/adam/debian stable main" \
+  | sudo tee /etc/apt/sources.list.d/gitea-adam.list
+sudo apt update
+sudo apt install guard
 ```
 
-It makes the `guard` user (in the `adm` and `systemd-journal` groups,
+For release candidates too, add the `testing` distribution: the same
+`deb` line with `testing` instead of `stable`. The release page also has
+the `.deb` files (`sudo apt install ./guard_0.1.0_amd64.deb`) and
+tarballs for Linux amd64 and arm64.
+
+The package makes the `guard` user (in the `adm` and `systemd-journal` groups,
 to read logs), installs `guard.service` without starting it, and writes
 an example `/etc/guard/guard.yaml`.