webdemo: version from contrib/version, published by ship

The demo's Makefile said VERSION := 0.1.0 by hand, so the in-browser
slosh announced a release two tags old no matter what was built into
it. It now derives from contrib/version like every other artifact,
suffixed +webdemo so the guest build names itself. And ship gains a
website step: the site (demo included) is rebuilt from the tag
checkout and published as part of a release, so the demo cannot fall
behind again.

2 files changed, 30 insertions, 6 deletions

diff --git a/contrib/ship b/contrib/ship
index e9274cd..9069481 100755
--- a/contrib/ship
+++ b/contrib/ship
@@ -17,7 +17,9 @@
 #   5. gh release           the five artifacts + SHA256SUMS on GitHub
 #   6. brew-release         pin the formula, push the tap
 #   7. arch                 bump the PKGBUILD, rebuild + sign + rsync the repo
-#   8. paperwork            commit the formula + PKGBUILD, push
+#   8. website              rebuild + publish slosh.foo, demo included, so the
+#                           in-browser slosh is the released one
+#   9. paperwork            commit the formula + PKGBUILD, push
 #
 # Every step is skipped when its result already exists, so a run that died at
 # notarization resumes where it stopped instead of rebuilding artifacts whose
@@ -178,7 +180,26 @@ else
     say "published to $ARCH_DEST for: $arches"
 fi
 
-# ── 8. the paperwork ────────────────────────────────────────────────────────
+# ── 8. the website, so the in-browser demo runs what was just released ─────
+# The demo's slosh is cross-compiled from the tree the site is built in, and
+# its version comes from contrib/version -- built from the tag checkout, the
+# demo says exactly what the release says (v0.1.2 shipped while the demo
+# still announced 0.1.0, which is the drift this step removes). Old tags
+# predate web/publish; for those the site is built from master instead,
+# which is newer than the tag, not older.
+step "website + demo"
+if git show "$tag:web/publish" >/dev/null 2>&1; then
+    git checkout -q "$tag"
+    trap 'git checkout -q master' EXIT INT TERM
+    web/publish
+    git checkout -q master
+    trap - EXIT INT TERM
+else
+    say "$tag has no web/publish -- building the site from master"
+    web/publish
+fi
+
+# ── 9. the paperwork ────────────────────────────────────────────────────────
 # The formula and the PKGBUILD pin the tag's tarball, so they can only change
 # *after* the tag exists -- they land on master behind it.
 step "paperwork"
diff --git a/web/demo/Makefile b/web/demo/Makefile
index 06d1f5b..431bb53 100644
--- a/web/demo/Makefile
+++ b/web/demo/Makefile
@@ -27,8 +27,11 @@ GUEST    := build/slosh-riscv64
 # by somebody's browser, 256 KiB at a time.
 CFLAGS   := -target $(TARGET) -std=c23 -Os -Wall -Wextra -Wno-unused-parameter \
             -MMD -MP -I$(VT_INC) -I$(ROOT)/include -Ibuild
-VERSION  := 0.1.0
-GITDESC   = $(shell cd $(ROOT) && git describe --always --dirty 2>/dev/null || echo unknown)
+# The same derivation as every other artifact (contrib/version: the tag is
+# the single source of truth), so the demo cannot fall behind a release the
+# way a hand-written number here once did. +webdemo, because this binary is
+# the riscv64 guest build and should say so when someone asks it.
+VERSION  := $(shell cd $(ROOT) && contrib/version)
 
 SITE     := build/site
 IMAGE    := build/rootfs.bin
@@ -85,8 +88,8 @@ $(VT_LIB):
 # so a new commit rebuilds and `make` twice in a row does not.
 .PHONY: FORCE
 build/version.h: FORCE | build
-	@printf '/* generated by web/demo/Makefile */\n#define SLOSH_VERSION "%s+%s"\n' \
-	  '$(VERSION)' '$(GITDESC)' > $@.tmp
+	@printf '/* generated by web/demo/Makefile */\n#define SLOSH_VERSION "%s+webdemo"\n' \
+	  '$(VERSION)' > $@.tmp
 	@cmp -s $@.tmp $@ || mv $@.tmp $@
 	@rm -f $@.tmp