CI: publish the builds as a download site, deploy via Coolify

The deployed image is now a small nginx site instead of a bare app
tree: the Linux app (with its runtime), a universal jar, the Android
APK, SHA256SUMS and a landing page showing the commit and build date.

- desktop: universalJar bundles the Skiko natives for Linux, macOS and
  Windows (Compose's own jar only carries the building OS's).
- Dockerfile: the build stage runs tests and builds every artifact;
  site/assemble.sh lays them out; the final stage is nginx:alpine.
- .ci: after the image is built, `main` calls the beta Coolify hook and
  `release` the production one; other branches only build.
- .dockerignore keeps local.properties and secrets out of the build.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

2 files changed, 98 insertions, 0 deletions

diff --git a/site/assemble.sh b/site/assemble.sh
new file mode 100755
index 0000000..aed5b27
--- /dev/null
+++ b/site/assemble.sh
@@ -0,0 +1,78 @@
+#!/bin/sh
+# Lays out the download site from whatever the Gradle build produced.
+#   usage: site/assemble.sh <output dir> [commit]
+# Anything that wasn't built is simply left off the page, so this also works on a partial local build.
+set -eu
+
+root=$(cd "$(dirname "$0")/.." && pwd)
+out=${1:?usage: assemble.sh <output dir> [commit]}
+commit=${2:-unknown}
+mkdir -p "$out"
+
+case $(uname -m) in x86_64|amd64) arch=x64 ;; aarch64|arm64) arch=arm64 ;; *) arch=$(uname -m) ;; esac
+sha() { if command -v sha256sum >/dev/null 2>&1; then sha256sum "$@"; else shasum -a 256 "$@"; fi; }
+size() { du -h "$1" | cut -f1 | tr -d ' '; }
+
+apk=$root/android/build/outputs/apk/debug/android-debug.apk
+jar=$root/desktop/build/libs/rookery-universal.jar
+app=$root/desktop/build/compose/binaries/main/app/rookery
+
+[ -f "$apk" ] && cp "$apk" "$out/rookery-android.apk"
+[ -f "$jar" ] && cp "$jar" "$out/rookery.jar"
+[ -d "$app" ] && tar -C "$(dirname "$app")" -czf "$out/rookery-linux-$arch.tar.gz" rookery
+
+printf '%s\n' "$commit" > "$out/commit.txt"
+(cd "$out" && sha rookery* > SHA256SUMS)
+
+row() { # file, description
+  [ -f "$out/$1" ] && printf '<tr><td><a href="%s">%s</a></td><td>%s</td><td class="n">%s</td></tr>\n' "$1" "$1" "$2" "$(size "$out/$1")"
+  return 0
+}
+
+short=$(printf '%.7s' "$commit")
+if [ "$commit" = unknown ]; then rev="$short"; else rev="<a href=\"https://code.liz.coffee/rookery.git/commit/?id=$commit\">$short</a>"; fi
+built=$(date -u +"%Y-%m-%d %H:%M UTC")
+
+cat > "$out/index.html" <<HTML
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>rookery</title>
+<style>
+  :root { --bg: black; --fg: white; --a: #c4d0c8; --h: #7d978c; --line: #3a403d; --dim: #a3ada7; }
+  body { max-width: 800px; margin: 0 auto; padding: 16px; background: var(--bg); color: var(--fg); font-family: serif; line-height: 1.5; }
+  h1, h2 { color: var(--h); margin-bottom: 8px; }
+  a { color: var(--a); }
+  table { border-collapse: collapse; width: 100%; }
+  td { border: 1px solid var(--line); padding: 4px 8px; }
+  td.n { text-align: right; white-space: nowrap; color: var(--dim); }
+  tt, code { font-family: monospace; }
+  .dim { color: var(--dim); }
+  hr { border: 0; border-top: 1px solid var(--line); margin: 20px 0; }
+</style>
+</head>
+<body>
+<h1>rookery</h1>
+<p>speedcubing timer and blindfold trainer. desktop and android.</p>
+<hr>
+<h2>downloads</h2>
+<table>
+$(row rookery-android.apk "Android 8+, debug-signed")
+$(row "rookery-linux-$arch.tar.gz" "Linux $arch, runtime included")
+$(row rookery.jar "Java 21; Linux, macOS, Windows")
+</table>
+<ul>
+  <li>apk: allow installing from this source when asked.</li>
+  <li>tar.gz: extract, then run <tt>rookery/bin/rookery</tt>.</li>
+  <li>jar: <tt>java -jar rookery.jar</tt></li>
+  <li><a href="SHA256SUMS">SHA256SUMS</a></li>
+</ul>
+<hr>
+<p class="dim">build $rev, $built</p>
+</body>
+</html>
+HTML
+
+echo "site: $(ls "$out" | tr '\n' ' ')"
diff --git a/site/nginx.conf b/site/nginx.conf
new file mode 100644
index 0000000..310d68d
--- /dev/null
+++ b/site/nginx.conf
@@ -0,0 +1,20 @@
+server {
+    listen 80;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # a new build replaces these files in place, so have clients check
+    add_header Cache-Control "no-cache";
+
+    location ~ \.apk$ {
+        default_type application/vnd.android.package-archive;
+        add_header Cache-Control "no-cache";
+    }
+    location = /SHA256SUMS {
+        default_type text/plain;
+        add_header Cache-Control "no-cache";
+    }
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}