cdn.uhhm.no is real: releases publish to the git-pages CDN

The advertised import URL now exists. The CDN is just a pages site
(PAGES.md pattern): DNS + allowlist TXT in terraform, _headers for CORS
and immutable caching, and the release workflow PATCHes each version's
bundle in — incremental, so old versions persist. Verified in real
Chromium importing buuh@8.0.0 from the live CDN via an import map.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014NgfSjHE11oFpoSnLVKLXd

.gitea/workflows/release.yml

@@ -42,3 +42,19 @@ jobs:
             -H "Authorization: token ${{ secrets.PACKAGES_TOKEN }}" \
             --upload-file dist-cdn/buuh.js.map \
             "https://project.uhhm.no/api/packages/uhhm/generic/buuh-cdn/${VERSION}/buuh.js.map"
+
+      - name: publish to cdn.uhhm.no (git-pages, incremental)
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          mkdir cdn
+          cp dist-cdn/buuh.js "cdn/buuh@${VERSION}.js"
+          cp dist-cdn/buuh.js.map "cdn/buuh@${VERSION}.js.map"
+          cp dist-cdn/buuh.js cdn/buuh.js
+          cp dist-cdn/buuh.js.map cdn/buuh.js.map
+          tar -czf cdn.tar.gz -C cdn .
+          # PATCH = incremental: earlier versions stay published forever
+          curl --fail -sS -X PATCH "https://cdn.uhhm.no/" \
+            -H "Content-Type: application/x-tar+gzip" \
+            -H "Forge-Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            --data-binary @cdn.tar.gz \
+            -w "cdn: %{http_code}\n"

docs/publishing.md

@@ -48,26 +48,15 @@ MIME checking). So an import map cannot point at Gitea directly.
 
 What works instead, in order of effort:
 
-**a. The single-file bundle + any static host (recommended).**
-`npm run bundle` produces `dist-cdn/buuh.js` — the whole framework as
-one minified ES module with named exports. The release workflow uploads
-it to Gitea's generic package store as the archive of record; to make it
-importable, serve a copy from any host that sends
-`text/javascript` + CORS. Since you run uhhm.no, that's a few lines of
-Caddy:
-
-```
-cdn.uhhm.no {
-  root * /srv/cdn
-  file_server
-  header Access-Control-Allow-Origin *
-  header /buuh@* Cache-Control "public, max-age=31536000, immutable"
-}
-```
-
-Drop each release in as `buuh@8.0.0.js` (a `curl` from the generic
-package URL, or an extra `scp` step in the workflow), and every project
-on earth can do:
+**a. cdn.uhhm.no — live, and it's just a pages site (recommended).**
+`https://cdn.uhhm.no/buuh@<version>.js` is real: the CDN is a git-pages
+site (see uhhm/infrastructure PAGES.md) — an A record, an allowlist TXT
+pointing at this repo, and the release workflow PATCHing each version's
+bundle in (PATCH is incremental, so old versions persist forever). A
+`_headers` file provides `Access-Control-Allow-Origin: *` everywhere,
+year-long immutable caching on versioned files, and short caching on
+`buuh.js` (the latest alias) and the index. No separate web server, no
+Caddy site config.
 
 ```html
 <script type="importmap">
@@ -78,8 +67,6 @@ on earth can do:
 </script>
 ```
 
-That is the zero-build story with your own domain on it.
-
 **b. Self-hosted esm.sh.** esm.sh is open source and can be pointed at
 a custom npm registry — run it against the Gitea endpoint and you get
 real CDN semantics (per-package URLs, versioning, bundling) for