ci(release): auto-publish split bundles to Gitea package registry on version tags

.gitea/workflows/release.yml — on push tag v*: assert tag==VERSION, run the governance gate (must be green), build core/devkit/platform-preview/all-in-one-demo (enterprise skipped/refused), then PUT each .tar.gz (+.sha256) to the Gitea generic package registry using ${{ secrets.GITEA_TOKEN }}. Portable via GITHUB_SERVER_URL/OWNER. Guide updated with the one-time secret setup + release flow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-08 16:06:28 +09:00
parent 6cb96ce249
commit 98d699d844
2 changed files with 104 additions and 4 deletions
@@ -0,0 +1,78 @@
+# CASAN release — build split bundles + publish to the Gitea package registry.
+# Triggers on a version tag (vX.Y.Z). Verifies the gate, builds core/devkit/platform/
+# all-in-one-demo, and uploads each artifact to the Gitea generic package registry.
+# Enterprise (Level 4) is intentionally skipped (package-release.sh refuses it).
+#
+# Requires repo/org secret: GITEA_TOKEN  (scope: write:package).
+name: CASAN Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  release:
+    runs-on: ci-runner
+    timeout-minutes: 60
+    env:
+      CASAN_CI_RUN_FRONTEND: "0"
+      CASAN_CI_RUN_BACKEND: "0"
+      CASAN_CI_RUN_INFRA_LAB: "0"
+      CASAN_CI_STEP_TIMEOUT_SEC: "1200"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Toolchain
+        run: |
+          set -euo pipefail
+          command -v python3 >/dev/null || { apt-get update && apt-get install -y python3; }
+          command -v curl >/dev/null || { apt-get update && apt-get install -y curl; }
+          python3 --version
+
+      - name: Tag must match VERSION
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF_NAME#v}"
+          FILE_VER="$(cat VERSION)"
+          echo "tag=$TAG version-file=$FILE_VER"
+          [ "$TAG" = "$FILE_VER" ] || { echo "::error::tag v$TAG != VERSION $FILE_VER — bump VERSION before tagging"; exit 1; }
+
+      - name: Verify governance gate (must be green to release)
+        run: bash packages/casan-harness/scripts/bash/ci-harness-gate.sh
+
+      - name: Build split bundles
+        run: |
+          set -euo pipefail
+          for b in core devkit platform all-in-one-demo; do
+            scripts/package-release.sh "$b"
+          done
+          # enterprise is future → refused on purpose; do not fail the release
+          scripts/package-release.sh enterprise || echo "enterprise skipped (future, expected)"
+          ls -lh dist/
+
+      - name: Publish bundles to Gitea package registry
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          [ -n "${GITEA_TOKEN:-}" ] || { echo "::error::secret GITEA_TOKEN not set (scope write:package)"; exit 1; }
+          BASE="${GITHUB_SERVER_URL:-http://localhost:3000}"
+          OWNER="${GITHUB_REPOSITORY_OWNER:-admin}"
+          V="$(cat VERSION)"
+          publish() {  # <artifact-path> <package-name> <pkg-version>
+            local f="$1" name="$2" ver="$3"
+            echo "→ $BASE/api/packages/$OWNER/generic/$name/$ver/$(basename "$f")"
+            curl -fsSL -X PUT -H "Authorization: token $GITEA_TOKEN" \
+              --upload-file "$f" \
+              "$BASE/api/packages/$OWNER/generic/$name/$ver/$(basename "$f")"
+            curl -fsSL -X PUT -H "Authorization: token $GITEA_TOKEN" \
+              --upload-file "$f.sha256" \
+              "$BASE/api/packages/$OWNER/generic/$name/$ver/$(basename "$f").sha256"
+          }
+          publish "dist/casan-core-v$V.tar.gz"            casan-core    "$V"
+          publish "dist/casan-devkit-v$V.tar.gz"          casan-devkit  "$V"
+          publish "dist/casan-platform-preview-v$V.tar.gz" casan-platform "$V-preview"
+          publish "dist/casan-all-in-one-demo-v$V.tar.gz" casan-all-in-one-demo "$V"
+          echo "Published core, devkit, platform(preview), all-in-one-demo to $BASE (owner=$OWNER, v=$V)."