Add GitHub CI (with release archive automation)

Runs on:
- commit push and tag push (meaning this runs twice when making a
  release)
- pull request
- manual run (needs write access), in which case a nightly archive
  artifact is producted with the run
- release publish: properly makes and publishes the release archive

.github/workflows/build.yaml

@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  push: # Note: will run on tags push too
+  pull_request:
+  workflow_dispatch: # manual run
+  workflow_call:
+    outputs:
+      VERSTRING:
+        description: Version string
+        value: ${{ jobs.build.outputs.VERSTRING }}
+
+jobs:
+  build:
+    name: Build boot.3dsx
+    runs-on: ubuntu-latest
+    outputs:
+      VERSTRING: ${{ steps.verstring.outputs.VERSTRING }}
+    container:
+      image: devkitpro/devkitarm
+      options: --user 1001 # runner user, for git safedir
+    steps:
+    - name: Checkout repo
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive # we currently don't use submodules, but just in case...
+        fetch-depth: 0 # deep clone (for git describe)
+        fetch-tags: true
+    - name: Set version string
+      id: verstring
+      run: |
+        VERSTRING=$(git describe --tags --match "v[0-9]*" --abbrev=7 | sed 's/-[0-9]*-g/-/')
+        echo "VERSTRING=$VERSTRING" | tee -a $GITHUB_OUTPUT
+    - name: Build
+      run: make -j$(nproc --all)
+    - name: Publish boot.3dsx (only on manual run or release)
+      if: github.event_name == 'workflow_dispatch' || github.event_name == 'release'
+      uses: actions/upload-artifact@v4
+      with:
+        # This produces a zip with boot.3dsx inside for security reasons
+        # For publish_release this is presented as boot.3dsx however
+        name: 3ds-hbmenu-${{ steps.verstring.outputs.VERSTRING }}
+        path: boot.3dsx

.github/workflows/release.yaml

@@ -0,0 +1,32 @@
+name: Release CI
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    name: Build boot.3dsx
+    uses: ./.github/workflows/build.yaml
+  publish_release:
+    name: Publish release archive
+    needs: build
+    runs-on: ubuntu-latest
+    env:
+      VERSTRING: ${{ needs.build.outputs.VERSTRING }}
+    steps:
+    - name: Download cacert.pem
+      run: mkdir -p config/ssl && curl -sSfL "https://curl.se/ca/cacert.pem" -o config/ssl/cacert.pem
+    - name: Download build artifact from previous job
+      uses: actions/download-artifact@v4
+      with:
+        name: 3ds-hbmenu-${{ env.VERSTRING }}
+    - name: Bundle release archive
+      run: zip "3ds-hbmenu-$VERSTRING.zip" -r config boot.3dsx
+    - name: Publish release archive
+      uses: softprops/action-gh-release@v1
+      if: startsWith(github.ref, 'refs/tags/')
+      with:
+        files: "./3ds-hbmenu-${{ env.VERSTRING }}.zip"
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -1,4 +1,5 @@
 .*/
+!.github/
 build/
 *.t3x
 *.3dsx