feat: Gitea CI, and releases built once, previewed and promoted as one file

ci.yml runs tools/check.sh and the container gate on every push and pull request, with no secrets. Release 1 builds a version from its release commit on master or release/*, gates it, and keeps it in a Gitea pre-release. Release 2 gates that file again on the CI runner and publishes it to canary (Preview) from the release runner. Release 3 promotes the file Preview ran, on a person's approval. Import records a release from before Gitea kept the record. All of it is tools/release-ci.sh calling the existing scripts. docs/releasing.md: tracks, branches, each step, immutability, rollback, secrets, runners, Nightly and the hardware lab as designs, the Gitea administration still to do, and what was measured to make it. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-09-29 18:47:42 -05:00
parent 583f9b1809
commit 22f25854aa
10 changed files with 1643 additions and 5 deletions
@@ -0,0 +1,38 @@
+# RECORD A RELEASE PUBLISHED BEFORE GITEA KEPT THE RECORD.
+#
+# For 0.2.6.6 and anything earlier worth recording: the package is taken
+# from the update server as it is served, checked against the SHA-256
+# given, and kept in a Gitea release tagged at the commit given. Whether
+# it is on Preview or Stable is read off the server, never assumed.
+# Nothing is built or published.
+name: Release - import an existing release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'A version already on the update server'
+        required: true
+      sha256:
+        description: 'Its SHA-256'
+        required: true
+      commit:
+        description: 'The full commit it was built from'
+        required: true
+
+jobs:
+  import:
+    name: record it
+    runs-on: ekklesia-ci
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Import
+        env:
+          VERSION: ${{ github.event.inputs.version }}
+          SHA256: ${{ github.event.inputs.sha256 }}
+          COMMIT: ${{ github.event.inputs.commit }}
+          GITEA_TOKEN: ${{ secrets.RELEASE_API_TOKEN || github.token }}
+        run: RELEASE_CI_WORK="$RUNNER_TEMP/release" tools/release-ci.sh import "$VERSION" "$SHA256" "$COMMIT"