switch release workflow from GitHub Actions to Forgejo Actions

The GitHub channel gave nothing but chaos (failed runs on tag push, auth issues with gh CLI on this side). Forgejo is the source of truth (cf. USER.md 'Remote setup' for the yavsc mirror setup), so move the .deb release workflow there. - Remove .github/workflows/build-and-release-deb.yml. - Add .forgejo/workflows/release.yml, mirroring the structure of yavsc/.forgejo/workflows/release.yml (single job, no Node, bash + jq + curl). amd64 and arm64 .deb built sequentially (matrix is impossible because actions/upload-artifact needs Node, which the runner image pazof/yavsc-build-env doesn't ship — same constraint as documented in MEMORY.md). - Reuse existing release on tag collision (PATCH instead of POST) to keep the /releases/tag/<tag> permalink stable — re-tag = le mal, but a re-build of the same tag should not duplicate releases.
2026-08-17 15:28:39 +01:00 · 2026-08-17 15:28:39 +01:00 · e6fd22f8a1
commit e6fd22f8a1
parent 0c45511bd9
2 changed files with 329 additions and 289 deletions
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@ -0,0 +1,329 @@
+# Build and publish a postit-debian release on the Forgejo instance.
+#
+# Triggered by a push of a git tag. Validates the tag/changelog pair,
+# builds the .deb for amd64 and arm64 (sequential cross-RID .NET
+# publishes on a single amd64 runner container — matrix is not used
+# here because the runner image pazof/yavsc-build-env has no Node,
+# so actions/upload-artifact and actions/download-artifact (which
+# require Node) cannot be used to pass the .deb files between jobs.
+# All in one job, like yavsc's .forgejo/workflows/release.yml.),
+# then publishes a Forgejo release via the REST API and uploads both
+# .deb files as assets.
+#
+# Authentication uses ${{ secrets.GITHUB_TOKEN }} (auto-provided by
+# the Forgejo runner, scoped to contents: write for the current
+# repo). A dedicated PAT (${{ secrets.RELEASE_TOKEN }}) was the
+# preferred option for least-privilege, but creating repo-level
+# secrets is currently broken on this Forgejo instance
+# (InsertEncryptedSecret fails with a UTF-8 byte-sequence error,
+# probably a text-vs-bytea column type on the secret table). Bumping
+# to Forgejo v16 should fix it; until then, the runner-provided
+# token keeps the workflow operational.
+#
+# Why bash + jq + curl, no third-party actions: the runner's docker
+# label points at pazof/yavsc-build-env, a Debian image with jq but
+# without Node.js or python3. Any action like actions/checkout,
+# rasterstate/forgejo-release-action, actions/upload-artifact,
+# actions/download-artifact, etc. fails with "executable file not
+# found in $PATH". Same constraint as yavsc's
+# .forgejo/workflows/release.yml.
+#
+# Re-tag policy (cf. AGENTS.md "Re-tag = le mal") : on push de tag
+# ou dispatch, on *réutilise* la release existante (via PATCH) au
+# lieu d'en créer une nouvelle. Un tag Git pointe vers un commit
+# fixe ; si le binaire change (rebuild après modif du packaging),
+# on met à jour la release existante plutôt que d'en multiplier
+# pour un même tag. Le permalien /releases/tag/<tag> reste stable.
+name: Forgejo Release postit-deb
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag pazof/yavsc à packager (requis en dispatch, ex. 1.0.6 ou 1.0.7-rc1).'
+        required: true
+        type: string
+      force_unstable:
+        description: 'Publier une release avec suffixe (ex. 1.0.0-rc1) malgré le fail-fast par défaut.'
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+
+jobs:
+  # Job unique : validation tag/CHANGELOG + build amd64 + build
+  # arm64 + publication via l'API REST Forgejo (pas d'actions
+  # tierces Node).
+  release:
+    runs-on: docker
+    container:
+      image: docker.io/pazof/yavsc-build-env:debian12-dotnet10-android36-v2
+    steps:
+      - name: Installer les pré-requis de build (debhelper + icônes)
+        # L'image runner fournit déjà dotnet-sdk-10.0, git, jq,
+        # curl. On ajoute les outils spécifiques au packaging
+        # Debian (debhelper, imagemagick pour les icônes .png
+        # via `convert`, librsvg2-bin pour le SVG).
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends \
+              build-essential debhelper imagemagick librsvg2-bin \
+              ca-certificates
+          rm -rf /var/lib/apt/lists/*
+
+      - name: Clone du repo au tag demandé
+        env:
+          TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }}
+        run: |
+          if [[ -z "$TAG" ]]; then
+            echo "::error::No tag provided. In workflow_dispatch, set the 'tag' input."
+            exit 1
+          fi
+
+          cd /src
+          if [[ ! -d _src/.git ]]; then
+            # Clone unshallow pour préserver l'historique — utile
+            # si un futur test en a besoin. Le coût est marginal
+            # pour ce repo (< 50 commits).
+            git clone https://forgejo.pschneider.fr/notazof/postit-debian.git _src
+          fi
+
+          cd _src
+          git fetch --tags --force --prune origin
+          git checkout "$TAG"
+
+          echo "Checked out at $(git rev-parse HEAD) on tag $TAG"
+
+      - name: Valider le tag et la section CHANGELOG
+        run: |
+          cd /src/_src
+          TAG="$(git describe --tags --exact-match HEAD 2>/dev/null || git rev-parse --short HEAD)"
+          echo "Validating tag $TAG"
+
+          # Parse semver : MAJOR.MINOR.PATCH[-SUFFIX]
+          if [[ ! "$TAG" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)(-.*)?$ ]]; then
+            echo "::error::Tag '$TAG' does not match MAJOR.MINOR.PATCH[-SUFFIX] format."
+            exit 1
+          fi
+
+          MAJOR="${BASH_REMATCH[1]}"
+          MINOR="${BASH_REMATCH[2]}"
+          PATCH="${BASH_REMATCH[3]}"
+          SUFFIX="${BASH_REMATCH[4]}"
+
+          # Classification du canal par parité du patch.
+          if [[ -n "$SUFFIX" ]]; then
+            CHANNEL="unstable"
+          elif (( PATCH % 2 == 0 )); then
+            CHANNEL="stable"
+          else
+            CHANNEL="preview"
+          fi
+
+          echo "Tag $TAG classifié comme channel=$CHANNEL"
+
+          # Fail-fast sur instable sauf opt-in explicite.
+          if [[ "$CHANNEL" == "unstable" && "${FORCE_UNSTABLE:-false}" != "true" ]]; then
+            echo "::error::Tag '$TAG' is unstable (suffix '$SUFFIX'). Refusing to publish."
+            echo "Set force_unstable=true via workflow_dispatch to override."
+            exit 1
+          fi
+
+          # Lecture du CHANGELOG.md (doit exister à la racine du repo).
+          if [[ ! -f CHANGELOG.md ]]; then
+            echo "::error::CHANGELOG.md not found at repo root."
+            exit 1
+          fi
+
+          # Extraction de la section [TAG]. On garde le titre
+          # (ligne `## [TAG] - channel`) pour la vérification du
+          # canal, puis on l'exclut du body envoyé à la release.
+          BODY=$(awk -v tag="[$TAG]" '
+            /^## \[/ {
+              if (in_section) exit
+              if (index($0, tag) > 0) {
+                in_section=1
+                print
+                next
+              }
+            }
+            in_section { print }
+          ' CHANGELOG.md)
+
+          if [[ -z "$BODY" ]]; then
+            echo "::error::No section matching '## [$TAG]' found in CHANGELOG.md."
+            echo "Add a '## [$TAG] - $CHANNEL' section before tagging."
+            exit 1
+          fi
+
+          # Vérification cohérence du canal déclaré dans le titre.
+          TITLE=$(echo "$BODY" | head -1)
+          if [[ "$TITLE" != *" - $CHANNEL"* ]]; then
+            echo "::error::Section title '$TITLE' must declare suffix '- $CHANNEL' to match tag parity."
+            exit 1
+          fi
+
+          RELEASE_BODY=$(echo "$BODY" | tail -n +2)
+          IS_PRERELEASE=$([ "$CHANNEL" = "stable" ] && echo false || echo true)
+
+          echo "Section CHANGELOG validée pour [$TAG] - $CHANNEL"
+
+          # Expose channel + body pour les étapes suivantes via $GITHUB_ENV.
+          echo "RELEASE_CHANNEL=$CHANNEL" >> "$GITHUB_ENV"
+          echo "RELEASE_BODY<<EOF" >> "$GITHUB_ENV"
+          echo "$RELEASE_BODY" >> "$GITHUB_ENV"
+          echo "EOF" >> "$GITHUB_ENV"
+          echo "IS_PRERELEASE=$IS_PRERELEASE" >> "$GITHUB_ENV"
+
+      - name: Build .deb amd64
+        env:
+          POSTIT_GIT_TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }}
+          POSTIT_RUNTIME: linux-x64
+        run: |
+          cd /src/_src
+          echo "→ Building amd64 for POSTIT_GIT_TAG=$POSTIT_GIT_TAG"
+          make deb POSTIT_GIT_TAG="$POSTIT_GIT_TAG" POSTIT_RUNTIME=linux-x64
+
+      - name: Build .deb arm64
+        env:
+          POSTIT_GIT_TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }}
+          POSTIT_RUNTIME: linux-arm64
+        run: |
+          cd /src/_src
+          echo "→ Building arm64 for POSTIT_GIT_TAG=$POSTIT_GIT_TAG"
+          # Cross-RID .NET depuis un hôte amd64 : standard, pas
+          # besoin de runner arm64 natif.
+          make deb POSTIT_GIT_TAG="$POSTIT_GIT_TAG" POSTIT_RUNTIME=linux-arm64
+
+      - name: Localiser les .deb produits
+        env:
+          LOOKUP_TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }}
+        run: |
+          cd /src
+          DEB_AMD64=$(find . -maxdepth 3 -name "postit_*${LOOKUP_TAG}-1_amd64.deb" \
+                      -not -path "./_src/debian/*" -printf '%p\n' | head -1)
+          DEB_ARM64=$(find . -maxdepth 3 -name "postit_*${LOOKUP_TAG}-1_arm64.deb" \
+                      -not -path "./_src/debian/*" -printf '%p\n' | head -1)
+          if [[ -z "$DEB_AMD64" || -z "$DEB_ARM64" ]]; then
+            echo "::error::Missing .deb files. amd64='$DEB_AMD64' arm64='$DEB_ARM64'"
+            ls -la /src/ 2>/dev/null || true
+            exit 1
+          fi
+          echo "DEB_AMD64=/src/$DEB_AMD64" >> "$GITHUB_ENV"
+          echo "DEB_ARM64=/src/$DEB_ARM64" >> "$GITHUB_ENV"
+          echo "✓ Found both .deb files"
+
+      - name: Publier la release Forgejo via l'API REST
+        env:
+          GITHUB_TOKEN: *** secrets.GITHUB_TOKEN }}
+          GITHUB_API_URL: ${{ github.api_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }}
+          RELEASE_BODY: ${{ env.RELEASE_BODY }}
+          IS_PRERELEASE: ${{ env.IS_PRERELEASE }}
+        run: |
+          if [[ -z "$TAG" ]]; then
+            echo "::error::No tag resolved for the API call."
+            exit 1
+          fi
+
+          # Le runner Forgejo expose l'API sur github.api_url (par
+          # défaut http://…/api/v1). On retire le suffixe /api/v1
+          # s'il est présent pour dériver la base du serveur, puis
+          # on reconstruit l'URL de l'API proprement.
+          API_BASE="${GITHUB_API_URL%/}"
+          API_BASE="${API_BASE%/api/v1}"
+
+          # 1. Vérifier si la release existe déjà pour ce tag.
+          #    Politique : on réutilise (PATCH) plutôt que d'en
+          #    créer une nouvelle — cf. note "Re-tag policy" en
+          #    tête de fichier.
+          echo "::group::Check existing release for tag $TAG"
+          HTTP=$(curl -sS -o /tmp/existing.json -w '%{http_code}' \
+            -H "Authorization: token $GITHUB_TOKEN" \
+            -H "Accept: application/json" \
+            "$API_BASE/api/v1/repos/$GITHUB_REPOSITORY/releases/tags/$TAG")
+          echo "GET releases/tags/$TAG -> HTTP $HTTP"
+          EXISTING_ID=""
+          if [[ "$HTTP" == "200" ]]; then
+            EXISTING_ID=$(jq -r '.id // empty' /tmp/existing.json)
+            echo "Existing release id: ${EXISTING_ID:-none}"
+          fi
+          echo "::endgroup::"
+
+          # 2. Créer ou mettre à jour la release.
+          if [[ -n "$EXISTING_ID" ]]; then
+            echo "::group::Update release id=$EXISTING_ID"
+            jq -n \
+              --arg body "$RELEASE_BODY" \
+              --argjson prerelease "$IS_PRERELEASE" \
+              '{body: $body, prerelease: $prerelease}' \
+              > /tmp/patch.json
+            HTTP=$(curl -sS -o /tmp/release.json -w '%{http_code}' \
+              -X PATCH \
+              -H "Authorization: token $GITHUB_TOKEN" \
+              -H "Content-Type: application/json" \
+              -H "Accept: application/json" \
+              --data-binary @/tmp/patch.json \
+              "$API_BASE/api/v1/repos/$GITHUB_REPOSITORY/releases/$EXISTING_ID")
+            echo "PATCH release -> HTTP $HTTP"
+            echo "::endgroup::"
+          else
+            echo "::group::Create release"
+            jq -n \
+              --arg tag "$TAG" \
+              --arg name "$TAG" \
+              --arg body "$RELEASE_BODY" \
+              --argjson prerelease "$IS_PRERELEASE" \
+              '{tag_name: $tag, name: $name, body: $body, prerelease: $prerelease}' \
+              > /tmp/post.json
+            HTTP=$(curl -sS -o /tmp/release.json -w '%{http_code}' \
+              -X POST \
+              -H "Authorization: token $GITHUB_TOKEN" \
+              -H "Content-Type: application/json" \
+              -H "Accept: application/json" \
+              --data-binary @/tmp/post.json \
+              "$API_BASE/api/v1/repos/$GITHUB_REPOSITORY/releases")
+            echo "POST release -> HTTP $HTTP"
+            echo "::endgroup::"
+          fi
+
+          if [[ "$HTTP" != "200" && "$HTTP" != "201" ]]; then
+            echo "::error::Release creation/update failed (HTTP $HTTP):"
+            cat /tmp/release.json
+            exit 1
+          fi
+
+          RELEASE_ID=$(jq -r '.id' /tmp/release.json)
+          echo "Release id=$RELEASE_ID"
+
+          # 3. Upload les .deb en assets. Le nom du fichier passe
+          #    en query string (?name=...), pas en argument
+          #    positionnel entre --data-binary et l'URL.
+          for entry in "amd64:$DEB_AMD64" "arm64:$DEB_ARM64"; do
+            arch="${entry%%:*}"
+            deb="${entry#*:}"
+            echo "::group::Upload asset for arch=$arch: $deb"
+            HTTP=$(curl -sS -o /tmp/asset.json -w '%{http_code}' \
+              -X POST \
+              -H "Authorization: token $GITHUB_TOKEN" \
+              -H "Content-Type: application/octet-stream" \
+              -H "Accept: application/json" \
+              --data-binary "@$deb" \
+              "$API_BASE/api/v1/repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID/assets?name=$(basename "$deb")")
+            echo "POST asset ($arch) -> HTTP $HTTP"
+            echo "::endgroup::"
+
+            if [[ "$HTTP" != "201" ]]; then
+              echo "::error::Asset upload failed for $arch (HTTP $HTTP):"
+              cat /tmp/asset.json
+              exit 1
+            fi
+          done
+
+          echo "Release publiée : $API_BASE/$GITHUB_REPOSITORY/releases/tag/$TAG"