ci: publish tested module release assets

.gitea/workflows/ci.yml

@@ -15,12 +15,16 @@ name: CI
 #
 # The server is Gitea 1.27, which honours `concurrency` cancellation; `permissions` and
 # `timeout-minutes` are declared so the workflow is correct wherever they are enforced.
+# Artifact actions v3 are deliberate: Gitea implements that protocol, while v4 refuses non-GitHub
+# servers. A tag job uses Gitea's automatic per-job token only after every required job succeeds.
 
 on:
   pull_request:
   push:
     branches:
       - main
+    tags:
+      - "v*"
 
 permissions:
   contents: read
@@ -59,7 +63,9 @@ jobs:
         run: pnpm lint
 
       - name: Check that CI cleans up every stack it starts
-        run: bash ci/check-cleanup.sh
+        run: |
+          bash ci/check-cleanup.sh
+          python3 -m unittest ci/test_release_assets.py
 
   typecheck:
     name: typecheck
@@ -150,6 +156,43 @@ jobs:
       - name: Validate the built module and its migrations
         run: pnpm validate
 
+  # Build the canonical pair once. Integration downloads these exact bytes, and a successful tag
+  # run's release job later downloads the same artifact; neither consumer is allowed to repackage.
+  package:
+    name: package
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    outputs:
+      sha256: ${{ steps.canonical.outputs.sha256 }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js at the repository's version
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: .node-version
+
+      - name: Install (frozen lockfile)
+        run: |
+          corepack enable
+          corepack install
+          pnpm install --frozen-lockfile
+
+      - name: Build the canonical Module Package pair
+        id: canonical
+        run: bash ci/package.sh
+
+      - name: Hand the canonical pair to its consumers
+        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20
+        with:
+          name: signage-module-package
+          path: build/module-package/
+          if-no-files-found: error
+          retention-days: 30
+
   # The real linux-x64-glibc Signage Module Package inside Ekklesia, end to end. The pinned platform
   # builds one generic image with no bundled module source, verifies and installs Signage into
   # persistent module storage, applies its migrations, and drives its split-origin Dashboard and
@@ -160,10 +203,12 @@ jobs:
     needs:
       - test
       - build
+      - package
     runs-on: ubuntu-latest
     timeout-minutes: 45
     env:
       DOCKER_BUILDKIT: "1"
+      EXPECTED_PACKAGE_SHA256: ${{ needs.package.outputs.sha256 }}
       # Names this job's stacks, so its final step removes exactly these (the platform's
       # scripts/lib/ci-project.sh).
       EKKLESIA_CI_JOB_KEY: signage-integration
@@ -184,6 +229,12 @@ jobs:
           corepack install
           pnpm install --frozen-lockfile
 
+      - name: Receive the canonical Module Package pair
+        uses: actions/download-artifact@ad191675b41f6a5b46da9a048cb6893812da158b # v3.1.0-node20
+        with:
+          name: signage-module-package
+          path: build/module-package/
+
       - name: Fetch the pinned Ekklesia integration harness
         run: bash ci/fetch-platform.sh
 
@@ -192,7 +243,7 @@ jobs:
       - name: Sweep stale CI stacks from the runner
         run: bash build/platform/scripts/ci-sweep.sh --stale
 
-      - name: Build, install, and run the external Signage package
+      - name: Install and run the prebuilt external Signage package
         run: bash ci/integration.sh
 
       # Whatever happened above, this job's own stacks do not outlive it. If the first step failed,
@@ -203,3 +254,70 @@ jobs:
           if [ -f build/platform/scripts/ci-sweep.sh ]; then
             bash build/platform/scripts/ci-sweep.sh --job
           fi
+
+  # Existing Signage releases and tags are created by a person. On a v* tag, attach only the
+  # package pair this run's integration consumed, plus ADR 0055's required corresponding-source
+  # material. No release or tag is created here, and an existing asset is never replaced.
+  release:
+    name: release
+    needs:
+      - lint
+      - typecheck
+      - test
+      - build
+      - package
+      - integration
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js at the repository's version
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: .node-version
+
+      - name: Install the reviewed release tooling
+        run: |
+          corepack enable
+          corepack install
+          pnpm install --frozen-lockfile
+
+      - name: Receive the exact pair integration tested
+        uses: actions/download-artifact@ad191675b41f6a5b46da9a048cb6893812da158b # v3.1.0-node20
+        with:
+          name: signage-module-package
+          path: build/release-assets/
+
+      - name: Verify tag, revision, package bytes, and public-distribution material
+        env:
+          EXPECTED_PACKAGE_SHA256: ${{ needs.package.outputs.sha256 }}
+          RELEASE_TAG: ${{ github.ref_name }}
+          RELEASE_REVISION: ${{ github.sha }}
+        run: |
+          python3 ci/release-assets.py verify-package build/release-assets "$RELEASE_TAG" "$RELEASE_REVISION"
+          package="$(find build/release-assets -maxdepth 1 -type f -name 'signage-*-linux-x64-glibc.tar.gz')"
+          pnpm exec ekklesia-corresponding-source acquire \
+            --package "$package" --cache "$RUNNER_TEMP/signage-corresponding-sources"
+          pnpm exec ekklesia-corresponding-source build \
+            --package "$package" --cache "$RUNNER_TEMP/signage-corresponding-sources" \
+            --out build/release-assets
+          source="${package%.tar.gz}-corresponding-source.tar.gz"
+          metadata="${package%.tar.gz}.redistribution.json"
+          pnpm exec ekklesia-corresponding-source verify \
+            --package "$package" --source "$source" --metadata "$metadata"
+          python3 ci/release-assets.py verify build/release-assets "$RELEASE_TAG" "$RELEASE_REVISION"
+
+      - name: Attach the exact tested package and its required source material
+        env:
+          EXPECTED_PACKAGE_SHA256: ${{ needs.package.outputs.sha256 }}
+          GITHUB_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
+          RELEASE_REVISION: ${{ github.sha }}
+        run: python3 ci/release-assets.py upload build/release-assets "$RELEASE_TAG" "$RELEASE_REVISION"