ci(release): publish versioned artifacts

design/index.md

@@ -29,6 +29,7 @@ This OKF bundle is the product record for implemented and proposed behavior. Sto
 * [US-013 — Manage users as an administrator](us-013-admin-user-management.md) - Administrators search users and manage names and Minecraft accounts.
 * [US-014 — Receive standardized API errors](us-014-problem-details.md) - Application APIs return RFC 9457 Problem Details.
 * [US-015 — Deploy and operate securely](us-015-platform-operations.md) - Operators have reproducible builds, migrations, credentials, and security controls.
+* [US-016 — Build and publish versioned releases](us-016-automated-releases.md) - Gitea Actions publish the Velocity JAR and web and migration images.
 
 # Tracking
 

design/log.md

@@ -2,6 +2,8 @@
 
 ## 2026-08-01
 
+* **Create**: Added Gitea CI and semantic-release pipelines for downloadable Velocity JARs and versioned web and migration images.
+* **Document**: Added container deployment order, artifact names, and required repository secrets.
 * **Refine**: Corrected the Velocity Java and Gradle namespace to the repository owner's `games.dmg` reverse domain.
 * **Create**: Established the OKF v0.1 [user-story index](index.md).
 * **Document**: Captured the implemented player portal, Discord authentication, onboarding, account management, network intelligence, Velocity admission, auditing, administration, API error, and operational stories.

design/us-015-platform-operations.md

@@ -3,7 +3,7 @@ type: User Story
 title: Deploy and operate the platform securely
 description: Operators have repeatable builds, migrations, credential provisioning, configuration, and security checks.
 tags: [operations, security, database, deployment]
-timestamp: 2026-08-01T18:43:58Z
+timestamp: 2026-08-01T19:01:47Z
 story_id: US-015
 status: verified
 ---
@@ -41,3 +41,4 @@ Use `npm test`, `npm run typecheck`, `npm run lint`, `npm run build`, `npm run v
 
 - [Administrator SSO](us-011-admin-sso.md)
 - [Standardize API errors](us-014-problem-details.md)
+- [Build and publish versioned releases](us-016-automated-releases.md)

design/us-016-automated-releases.md

@@ -0,0 +1,44 @@
+---
+type: User Story
+title: Build and publish versioned releases
+description: Gitea Actions validate every change and publish semantically versioned Velocity and container artifacts.
+tags: [operations, ci, release, velocity, docker]
+timestamp: 2026-08-01T19:01:47Z
+story_id: US-016
+status: implemented
+---
+
+# User Story
+
+As a platform operator, I want automated validation and semantic releases, so that deployable web, migration, and Velocity artifacts are reproducible and downloadable.
+
+# Acceptance Criteria
+
+- [ ] Pushes and pull requests run OKF validation, linting, type checks, tests, the web build, and the Velocity build.
+- [ ] Pull requests validate conventional commit messages.
+- [ ] CI uploads the development Velocity JAR as a workflow artifact.
+- [ ] Main-branch conventional commits determine the next semantic version and create a `vMAJOR.MINOR.PATCH` tag.
+- [x] A release build embeds the semantic version in the Velocity plugin and JAR filename.
+- [ ] A public Gitea release exposes the versioned Velocity JAR as a downloadable asset.
+- [ ] Releases publish versioned and `latest` web runtime images to the Gitea registry.
+- [ ] Releases publish versioned and `latest` migration images that run versioned Drizzle migrations.
+- [x] Runtime containers use unprivileged users and exclude development source and secrets where practical.
+- [x] Operators are told which repository secrets must be configured before the first push.
+
+# Implementation
+
+- [CI workflow](../.gitea/workflows/ci.yml)
+- [Release workflow](../.gitea/workflows/release.yml)
+- [Semantic Release configuration](../.releaserc)
+- [Web and migration Docker targets](../Dockerfile)
+- [Velocity Gradle build](../plugins/velocity/build.gradle.kts)
+- [Release and deployment guide](../docs/releases.md)
+
+# Validation
+
+Local OKF, lint, typecheck, test, Next.js build, and versioned Velocity JAR checks pass. A test `1.2.3` JAR was generated with matching Velocity metadata. Workflow YAML parses successfully. Container builds and remote publication remain pending because the local Docker daemon is unavailable and the first push is intentionally paused until repository secrets are configured.
+
+# Related Stories
+
+- [Deploy and operate securely](us-015-platform-operations.md)
+- [Velocity game admission](us-009-velocity-admission.md)