ci: separate manual release publishing

.gitea/workflows/ci.yml

@@ -16,15 +16,13 @@ name: CI
 # The server is Gitea 1.27, which honours `concurrency` cancellation; `permissions` and
 # `timeout-minutes` are declared so the workflow is correct wherever they are enforced.
 # Artifact actions v3 are deliberate: Gitea implements that protocol, while v4 refuses non-GitHub
-# servers. A tag job uses Gitea's automatic per-job token only after every required job succeeds.
+# servers. This workflow never publishes or mutates a release; publishing is a separate manual gate.
 
 on:
   pull_request:
   push:
     branches:
       - main
-    tags:
-      - "v*"
 
 permissions:
   contents: read
@@ -156,8 +154,7 @@ jobs:
       - name: Validate the built module and its migrations
         run: pnpm validate
 
-  # Build the canonical pair once. Integration downloads these exact bytes, and a successful tag
-  # run's release job later downloads the same artifact; neither consumer is allowed to repackage.
+  # Build the canonical pair once. Integration downloads these exact bytes and may not repackage.
   package:
     name: package
     runs-on: ubuntu-latest
@@ -254,70 +251,3 @@ jobs:
           if [ -f build/platform/scripts/ci-sweep.sh ]; then
             bash build/platform/scripts/ci-sweep.sh --job
           fi
-
-  # Existing Signage releases and tags are created by a person. On a v* tag, attach only the
-  # package pair this run's integration consumed, plus ADR 0055's required corresponding-source
-  # material. No release or tag is created here, and an existing asset is never replaced.
-  release:
-    name: release
-    needs:
-      - lint
-      - typecheck
-      - test
-      - build
-      - package
-      - integration
-    if: startsWith(github.ref, 'refs/tags/v')
-    permissions:
-      contents: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Node.js at the repository's version
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version-file: .node-version
-
-      - name: Install the reviewed release tooling
-        run: |
-          corepack enable
-          corepack install
-          pnpm install --frozen-lockfile
-
-      - name: Receive the exact pair integration tested
-        uses: actions/download-artifact@ad191675b41f6a5b46da9a048cb6893812da158b # v3.1.0-node20
-        with:
-          name: signage-module-package
-          path: build/release-assets/
-
-      - name: Verify tag, revision, package bytes, and public-distribution material
-        env:
-          EXPECTED_PACKAGE_SHA256: ${{ needs.package.outputs.sha256 }}
-          RELEASE_TAG: ${{ github.ref_name }}
-          RELEASE_REVISION: ${{ github.sha }}
-        run: |
-          python3 ci/release-assets.py verify-package build/release-assets "$RELEASE_TAG" "$RELEASE_REVISION"
-          package="$(find build/release-assets -maxdepth 1 -type f -name 'signage-*-linux-x64-glibc.tar.gz')"
-          pnpm exec ekklesia-corresponding-source acquire \
-            --package "$package" --cache "$RUNNER_TEMP/signage-corresponding-sources"
-          pnpm exec ekklesia-corresponding-source build \
-            --package "$package" --cache "$RUNNER_TEMP/signage-corresponding-sources" \
-            --out build/release-assets
-          source="${package%.tar.gz}-corresponding-source.tar.gz"
-          metadata="${package%.tar.gz}.redistribution.json"
-          pnpm exec ekklesia-corresponding-source verify \
-            --package "$package" --source "$source" --metadata "$metadata"
-          python3 ci/release-assets.py verify build/release-assets "$RELEASE_TAG" "$RELEASE_REVISION"
-
-      - name: Attach the exact tested package and its required source material
-        env:
-          EXPECTED_PACKAGE_SHA256: ${{ needs.package.outputs.sha256 }}
-          GITHUB_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ github.ref_name }}
-          RELEASE_REVISION: ${{ github.sha }}
-        run: python3 ci/release-assets.py upload build/release-assets "$RELEASE_TAG" "$RELEASE_REVISION"