One binary: the lint and the trainer are commands of portal

portal serve runs a site; portal lint is what iris was; portal plan,
build, report and the rest are what portal-trainer was. One source at
one version, so the three never disagree about what content means.
Both histories are merged in (subtree). The release attaches the bare
binary for a content repo's CI. The trainer's plans, intakes, engines
and reference prompt come along; its runs stay in the old repo.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt

.gitea/workflows/publish.yml

@@ -56,75 +56,12 @@ jobs:
       - name: Build
         run: SITE_NAME=${{ vars.PORTAL_SITE_NAME }} cargo leptos build --release
 
-      # The lint (uhhm/iris) is versioned as portal: this step re-pins
-      # iris to the tag being released, builds and tests it against it,
-      # and pushes the matching iris tag, which iris's own CI publishes.
-      # A portal change to something the lint reads fails the release
-      # right here. Needs IRIS_PUSH_USER (a variable) and IRIS_PUSH_TOKEN
-      # (a secret) that may push to uhhm/iris; the workflow's own token
-      # is scoped to this repo. A re-run of a tag whose iris tag already
-      # exists just builds that.
-      - name: Release iris to match
-        env:
-          # The shared cargo home is read-only for the runner, and a git
-          # dependency has to be cloned into one (same as uhhm/iris's CI).
-          CARGO_HOME: /var/local/cargo-target/iris-cargo-home
-          RUSTC_WRAPPER: /usr/bin/sccache
-          IRIS_PUSH_USER: ${{ vars.IRIS_PUSH_USER }}
-          IRIS_PUSH_TOKEN: ${{ secrets.IRIS_PUSH_TOKEN }}
-        run: |
-          set -euo pipefail
-          tag="${{ github.ref_name }}"
-          ver="${tag#v}"
-          host="${{ github.server_url }}"
-          remote="https://${IRIS_PUSH_USER}:${IRIS_PUSH_TOKEN}@${host#https://}/uhhm/iris.git"
-          # Re-pin, version, changelog: idempotent, so a retry on a fresh
-          # clone redoes exactly the same edits.
-          match() {
-            sed -i -E "s|^(portal = \{ git = \"[^\"]+\", tag = \")[^\"]+(\")|\1$tag\2|" Cargo.toml
-            sed -i -E "0,/^version = \"[^\"]+\"/s//version = \"$ver\"/" Cargo.toml
-            cargo update -q -p portal
-            awk -v h="## $ver ($(date -u +%F)) - portal $tag" -v l="- Matches portal $tag (released by portal's publish job)." \
-              'done==0 && /^## /{print h; print ""; print l; print ""; done=1} {print}' CHANGELOG.md > CHANGELOG.new
-            mv CHANGELOG.new CHANGELOG.md
-            git config user.name "portal release"
-            git config user.email "portal@uhhm.no"
-            git commit -qam "Match portal $tag"
-            git tag "$tag"
-          }
-          # Someone may push to iris main while this job builds; a push
-          # then fails as non-fast-forward, and the answer is to start
-          # over on a fresh clone, once.
-          for attempt in 1 2; do
-            cd "$GITHUB_WORKSPACE"
-            rm -rf iris-src
-            git clone -q "$host/uhhm/iris.git" iris-src
-            cd iris-src
-            if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
-              echo "iris $tag already exists, building it"
-              git checkout -q "$tag"
-              cargo build --release
-              cargo test
-              break
-            fi
-            match
-            cargo build --release
-            cargo test
-            if git push -q "$remote" main "$tag"; then
-              echo "pushed iris $tag"
-              break
-            fi
-            echo "push rejected on attempt $attempt (iris main moved), retrying on a fresh clone"
-            [ "$attempt" = 2 ] && exit 1
-          done
-
       - name: Package
         run: |
           set -euo pipefail
           tag="${{ github.ref_name }}"
           stage=$(mktemp -d)
           cp "$CARGO_TARGET_DIR/release/portal" "$stage/portal"
-          cp "$CARGO_TARGET_DIR/release/iris" "$stage/iris"
           # hash-files = true: leptos resolves hash.txt next to the running
           # binary, so it ships beside portal in the release dir.
           cp "$CARGO_TARGET_DIR/release/hash.txt" "$stage/hash.txt"
@@ -132,7 +69,10 @@ jobs:
           # not affected by CARGO_TARGET_DIR - only the plain `cargo build`
           # outputs (release/, front/) move with that override.
           cp -r target/site "$stage/site"
-          tar -C "$stage" -czf "portal-$tag.tar.gz" portal iris hash.txt site
+          tar -C "$stage" -czf "portal-$tag.tar.gz" portal hash.txt site
+          # The bare binary as well: a content repo's CI runs `portal lint`
+          # and needs nothing else from the release.
+          cp "$stage/portal" portal-bin
           rm -rf "$stage"
 
       # The run's own ephemeral token has write access to this repo -
@@ -159,4 +99,7 @@ jobs:
           curl -sf -X POST -H "$auth" \
             -F "attachment=@portal-$tag.tar.gz" \
             "$api/releases/$id/assets?name=portal-$tag.tar.gz" > /dev/null
+          curl -sf -X POST -H "$auth" \
+            -F "attachment=@portal-bin" \
+            "$api/releases/$id/assets?name=portal" > /dev/null
           echo "published $tag"