Remove GitHub-only files; build releases locally

The CI and Release workflows don't run on Gogs. GoReleaser now builds
into dist/ without publishing, and the README explains attaching the
files to a release on git.monoexp.com.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -1,102 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-  schedule:
-    # Weekly, so newly published vulnerabilities in Go or a dependency
-    # show up even when nothing has changed here.
-    - cron: "17 6 * * 1"
-
-permissions:
-  contents: read
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      # The oldest Go that go.mod allows, so it keeps building there.
-      - uses: actions/setup-go@v7
-        with:
-          go-version-file: go.mod
-      - name: gofmt
-        run: |
-          unformatted=$(gofmt -l .)
-          if [ -n "$unformatted" ]; then
-            echo "These files need gofmt:"
-            echo "$unformatted"
-            exit 1
-          fi
-      - name: go vet
-        run: go vet ./...
-      - name: staticcheck
-        run: go run honnef.co/go/tools/cmd/staticcheck@2026.2.2 ./...
-
-  release-build:
-    # Builds every release binary without publishing, so a broken release
-    # config shows up on the PR rather than when a version is tagged.
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-go@v7
-        with:
-          go-version: stable
-          check-latest: true
-      - uses: goreleaser/goreleaser-action@v7
-        with:
-          version: "~> v2"
-          args: release --snapshot --clean
-
-  vulncheck:
-    # Reports known vulnerabilities in the Go standard library and the
-    # dependencies that the code actually calls.
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
-        with:
-          go-version: stable
-          check-latest: true
-      - name: govulncheck
-        run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...
-
-  test:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
-        with:
-          go-version: stable
-          check-latest: true
-      - uses: actions/setup-java@v6
-        with:
-          distribution: temurin
-          java-version: "21"
-      - name: Download epubcheck
-        shell: bash
-        run: |
-          curl -sSL -o "$RUNNER_TEMP/epubcheck.zip" \
-            https://github.com/w3c/epubcheck/releases/download/v${EPUBCHECK_VERSION}/epubcheck-${EPUBCHECK_VERSION}.zip
-          unzip -q "$RUNNER_TEMP/epubcheck.zip" -d "$RUNNER_TEMP"
-          echo "EPUBCHECK_JAR=$RUNNER_TEMP/epubcheck-${EPUBCHECK_VERSION}/epubcheck.jar" >> "$GITHUB_ENV"
-        env:
-          EPUBCHECK_VERSION: "5.2.1"
-      - name: Test
-        run: go test -race ./...
-      - name: Build
-        run: go build ./cmd/rekopub
-      - name: Build with build.cmd
-        if: runner.os == 'Windows'
-        shell: cmd
-        run: |
-          call build.cmd || exit /b 1
-          rekopub.exe -h || exit /b 1
-          rekopub.exe -VERSION || exit /b 1

.github/workflows/release.yml

@@ -1,33 +0,0 @@
-name: Release
-
-# Pushing a version tag builds the release binaries and creates a draft
-# GitHub release with them. Review the draft, then publish it.
-#   git tag v1.0.0 && git push origin v1.0.0
-on:
-  push:
-    tags: ["v*"]
-
-permissions:
-  contents: write # to create the release
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0 # goreleaser needs the tags and history for the changelog
-      # Release binaries include the Go standard library, so build them
-      # with the newest Go release to get its security fixes.
-      - uses: actions/setup-go@v7
-        with:
-          go-version: stable
-          check-latest: true
-      - name: govulncheck
-        run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...
-      - uses: goreleaser/goreleaser-action@v7
-        with:
-          version: "~> v2"
-          args: release --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.goreleaser.yaml

@@ -1,6 +1,6 @@
-# Release builds: run by .github/workflows/release.yml when a version tag
-# (v1.0.0, v1.0.1, ...) is pushed. Check locally with:
-#   goreleaser release --snapshot --clean
+# Release builds, made locally into dist/ (see "Releasing" in README.md):
+#   goreleaser release --clean              # on a version tag
+#   goreleaser release --snapshot --clean   # test build of the current commit
 version: 2
 
 project_name: rekopub
@@ -32,10 +32,10 @@ checksum:
   name_template: checksums.txt
 
 changelog:
-  use: github
+  use: git
   sort: asc
 
 release:
-  # Created as a draft so the binaries and notes can be checked before the
-  # release is published.
-  draft: true
+  # Nothing is published: the files in dist/ are attached to a release on
+  # git.monoexp.com by hand.
+  disable: true

README.md

@@ -256,7 +256,7 @@ go test -race ./...           # with the race detector
 go vet ./... && staticcheck ./...
 ```
 
-The tests also check the generated books with [epubcheck](https://github.com/w3c/epubcheck), which needs Java. Set `EPUBCHECK_JAR` to the path of `epubcheck.jar` to turn those checks on; without it they're skipped. CI always runs them, on Linux, macOS and Windows.
+The tests also check the generated books with [epubcheck](https://github.com/w3c/epubcheck), which needs Java. Set `EPUBCHECK_JAR` to the path of `epubcheck.jar` to turn those checks on; without it they're skipped. Run them before every release.
 
 On Windows, `build.cmd` builds `rekopub.exe` and `test-examples.cmd` converts a set of real articles into `test-examples\` for checking on the devices (see [From source on Windows](#from-source-on-windows)).
 
@@ -280,16 +280,18 @@ testdata/           Saved HTML pages and images used by the tests
 
 ### Releasing
 
-Releases are built by [GoReleaser](https://goreleaser.com) from `.goreleaser.yaml`: self-contained binaries for Windows, macOS and Linux on amd64 and arm64, plus checksums. Every pull request runs a test build of all of them.
+Releases are built by [GoReleaser](https://goreleaser.com) from `.goreleaser.yaml`: self-contained binaries for Windows, macOS and Linux on amd64 and arm64, plus checksums. `goreleaser release --snapshot --clean` makes a test build of all of them without a tag.
 
-To make a release, tag the commit on `main` and push the tag:
+To make a release, update to the newest Go release (the binaries include its standard library, so they get its security fixes), check for known vulnerabilities, then tag the commit on `main`, push the tag and build:
 
 ```bash
-git tag v1.0.0
+go run golang.org/x/vuln/cmd/govulncheck@latest ./...
+git tag -a v1.0.0 -m "v1.0.0"
 git push origin v1.0.0
+goreleaser release --clean
 ```
 
-The Release workflow then builds everything with the newest Go release (so the binaries include its security fixes), runs [govulncheck](https://go.dev/doc/security/vuln/), and creates a **draft** release on GitHub. Check the files and the notes, then press **Publish release**. CI also runs govulncheck weekly, so a newly published vulnerability in Go or a dependency shows up even when nothing has changed here; when one does, make a new release.
+GoReleaser writes the archives and `checksums.txt` to `dist/` and publishes nothing. On git.monoexp.com, open **Releases → New Release**, choose the tag and attach the files from `dist/`. Run govulncheck now and then even when nothing has changed here, so a newly published vulnerability in Go or a dependency shows up; when one does, make a new release.
 
 See [`PLAN.md`](PLAN.md) for the full design.
 

internal/epubtest/epubtest.go

@@ -89,7 +89,7 @@ func (b *Book) AssertWellFormed(t *testing.T) {
 
 // EPUBCheck runs epubcheck on the book at path and fails the test if it
 // reports errors. Set EPUBCHECK_JAR to the path of epubcheck.jar to enable
-// it; otherwise the check is skipped. CI always sets it.
+// it; otherwise the check is skipped.
 func EPUBCheck(t *testing.T, path string) {
 	t.Helper()
 	jar := os.Getenv("EPUBCHECK_JAR")

pull-releases/001-rekopub-import/README.md

@@ -4,24 +4,25 @@ Branch `feature/rekopub-import` · no version change (the code is the same as th
 
 ## What changed
 
-- **Whole project imported** from the previous repository's latest `main`: the CLI, `internal/` packages, tests and test data, `PLAN.md`, `SECURITY.md`, `build.cmd`, `test-examples.cmd`, the GoReleaser config and the GitHub workflow files. It's a single commit with no earlier history, so the old name only survives in the old repository.
+- **Whole project imported** from the previous repository's latest `main`: the CLI, `internal/` packages, tests and test data, `PLAN.md`, `SECURITY.md`, `build.cmd`, `test-examples.cmd` and the GoReleaser config. It's a single commit with no earlier history, so the old name only survives in the old repository.
 - **Renamed to ReKoPub.** The project is called ReKoPub in prose and `rekopub` in code: the binary, `cmd/rekopub/`, the usage text, `-VERSION` output, the user agent (`compatible; rekopub`), error messages, the internal stand-in host for image URLs (`rekopub.invalid`), the build scripts, GoReleaser archive names and `.gitignore`.
 - **New module path** `git.monoexp.com/bajdev/rekopub` (Gogs answers `?go-get=1` for it), so `go install git.monoexp.com/bajdev/rekopub/cmd/rekopub@latest` works. Clone and Releases links in the README point to `git.monoexp.com/bajdev/ReKoPub`.
 - **`LICENSE`**: the Gogs template's `<year> <copyright holders>` placeholder is replaced by the project's MIT licence, `Copyright (c) 2026 bajdev`.
 - **`README.md`**: the project README replaces the Gogs placeholder, keeping its "Turn any web article into a clean EPUB for your e-ink reader" tagline.
+- **GitHub-only files removed:** the CI and Release workflows (`.github/workflows/`), which don't run on Gogs.
+- **Releases are built locally:** `.goreleaser.yaml` takes its changelog from git instead of GitHub and no longer publishes a release; it writes the archives and checksums to `dist/`. The README's "Releasing" section now says to run govulncheck, tag, run `goreleaser release --clean` and attach the files from `dist/` to a Gogs release. The lines saying CI runs epubcheck are gone.
 - **`pull-releases/`**: this record and the index, started with this PR.
 
 ## Notes
 
-These still describe GitHub and need a decision before the next release:
-
-- `.github/workflows/` (CI and Release) don't run on Gogs. The README's "Releasing" section and the "CI always runs them" line describe them.
-- `.goreleaser.yaml` takes its changelog from GitHub and creates a draft GitHub release. Gogs can't receive GoReleaser uploads, so archives would have to be built locally and attached to a Gogs release by hand.
-- `SECURITY.md` asks for reports through GitHub's Security tab, which Gogs doesn't have.
+- Without CI, nothing runs the checks automatically: gofmt, vet, staticcheck, govulncheck, epubcheck and the Windows and macOS test runs are now done by hand.
+- `SECURITY.md` still asks for reports through GitHub's Security tab, which Gogs doesn't have. It needs a contact before the next release.
+- `PLAN.md` is left as written: its CI and GitHub release lines describe how the project was originally planned.
 
 ## Testing
 
 - `gofmt -l .` is clean; `go vet ./...` passes; `go test ./...` passes (epubcheck checks skipped: no `EPUBCHECK_JAR`).
 - `go build -ldflags "-X main.version=dev" ./cmd/rekopub`, then `rekopub -VERSION` prints `rekopub dev` and `-h` shows `Usage: rekopub …`.
 - Converted `https://en.wikipedia.org/wiki/E_Ink` to `e-ink-wikipedia.epub` (309 KB). No file in the book contains the old name.
+- `goreleaser check` passes. `goreleaser release --snapshot --clean` builds all six archives (Windows, macOS and Linux on amd64 and arm64) plus `checksums.txt`, publishing nothing; each archive holds `rekopub`, `README.md` and `LICENSE`.
 - A case-insensitive search for the old name across the repository finds nothing.