ci: publish tested module release assets

ci/package.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Builds the one canonical linux-x64-glibc Module Package pair that later jobs must consume.
+set -Eeuo pipefail
+
+root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+release="${1:-$root/build/module-package}"
+source_revision="${GITHUB_SHA:-$(git -C "$root" rev-parse HEAD 2>/dev/null || true)}"
+[[ "$source_revision" =~ ^[0-9a-f]{40}$ ]] || {
+  echo "package: no full source revision is available." >&2
+  exit 1
+}
+
+rm -rf -- "$release"
+mkdir -p -- "$release"
+pnpm --dir "$root" build
+pnpm --dir "$root" exec ekklesia-pack-module --module "$root" --target linux-x64-glibc \
+  --out "$release" --license-file "$root/LICENSE" --source-revision "$source_revision"
+
+mapfile -t archives < <(find "$release" -maxdepth 1 -type f -name 'signage-*-linux-x64-glibc.tar.gz' -print)
+[[ "${#archives[@]}" -eq 1 ]] || {
+  echo "package: expected exactly one Module Package archive." >&2
+  exit 1
+}
+archive="${archives[0]}"
+checksum="$archive.sha256"
+[[ -f "$checksum" ]] || {
+  echo "package: missing $(basename "$checksum")." >&2
+  exit 1
+}
+(cd "$release" && sha256sum --check --strict "$(basename "$checksum")")
+digest="$(sha256sum "$archive" | cut -d' ' -f1)"
+if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+  echo "sha256=$digest" >>"$GITHUB_OUTPUT"
+fi
+echo "package: canonical pair is $(basename "$archive") and $(basename "$checksum")."