ci: move the release-installer build from Gitea back to GitHub Actions

GitHub-hosted windows-latest/macos-latest replace the self-hosted act_runner
pair; node 24 + corepack pnpm are set up explicitly (hosted images do not
preinstall pnpm), and assets attach via gh release upload --clobber instead
of the Gitea-API uploader script. macOS signing falls back to ad-hoc until a
Developer ID cert + APPLE_API_ISSUER secret are provisioned on GitHub.

Claude-Session: https://claude.ai/code/session_01A6RcwHhhsFYYrNdQB4ASuP

.github/workflows/release-build.yml

@@ -1,65 +1,77 @@
 name: Build Release Installers
 
-# Builds the Windows and macOS installers whenever a release is published on
+# Builds the Windows and macOS installers whenever a release is published and
-# Gitea and attaches them to that release. Only releases whose tag points at a
+# attaches them to that release. To back-fill installers onto an older
-# commit containing this file will trigger it; to back-fill installers onto an
+# release, run this workflow manually with the release tag as input (note: a
-# older release, run this workflow manually with the release ID as input
+# manual run builds the dispatched ref's code, not the old tag's).
-# (note: a manual run builds the dispatched ref's code, not the old tag's).
 #
-# Runner facts these jobs rely on (host-mode act_runner on both machines):
+# Runs on GitHub-hosted runners (windows-latest / macos-latest). Node 24 comes
-# - windows-latest: node 24 + pnpm + git + curl on PATH; default shell is
+# from actions/setup-node; pnpm is activated via corepack and pinned by the
-#   Windows PowerShell 5.1, `shell: bash` is broken (WSL stub) - use cmd.
+# `packageManager` field in package.json.
-# - macos-latest: node 24 (nvm) + corepack on PATH, no global pnpm; Xcode and
+#
-#   notarytool installed. Signed builds additionally need:
+# macOS signing: hosted runners have no Developer ID certificate in the
-#     1. the "Developer ID Application: Yang Zhang (9PDD8M2SMS)" certificate
+# keychain, so the signing-detection step falls back to ad-hoc-signed,
-#        WITH private key imported into the runner user's login keychain, and
+# un-notarized installers with a warning. To ship signed + notarized builds
-#        (one-time, so headless codesign does not hang on a keychain prompt):
+# from hosted runners you would need to import the "Developer ID Application:
-#          security unlock-keychain ~/Library/Keychains/login.keychain-db
+# Yang Zhang (9PDD8M2SMS)" certificate (e.g. a base64 P12 secret + an import
-#          security set-key-partition-list -S apple-tool:,apple: -s \
+# step) and set the APPLE_API_ISSUER secret (App Store Connect issuer ID)
-#            ~/Library/Keychains/login.keychain-db
+# used together with the API key file in the repo.
-#     2. the APPLE_API_ISSUER repo secret (App Store Connect issuer ID) for
+#
-#        notarization, used together with the API key file in the repo.
+# (2026-08: this pipeline ran as .gitea/workflows/release-build.yml against
-#   Without these the macos job falls back to ad-hoc-signed, un-notarized
+# self-hosted runners while the GitHub account was unavailable.)
-#   installers and emits a warning.
 
 on:
   release:
     types: [published]
   workflow_dispatch:
     inputs:
-      release_id:
+      tag:
-        description: "Gitea release ID to attach installers to (back-fill)"
+        description: "Release tag to attach installers to (back-fill)"
         required: true
 
+permissions:
+  contents: write
+
+env:
+  COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
+
 jobs:
   windows:
     name: Windows installer (NSIS x64)
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - name: Enable pnpm via corepack
+        run: |
+          corepack enable pnpm
+          pnpm --version
       - name: Install dependencies
-        shell: cmd
+        run: pnpm install --frozen-lockfile
-        run: call pnpm install --frozen-lockfile
       - name: Build installer
-        shell: cmd
+        run: pnpm run package:win
-        run: call pnpm run package:win
       - name: List artifacts
-        shell: cmd
+        run: Get-ChildItem release
-        run: dir release
       - name: Upload installer to release
-        shell: cmd
         env:
-          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
-          RELEASE_ID: ${{ github.event.release.id || inputs.release_id }}
+          TAG: ${{ github.event.release.tag_name || inputs.tag }}
-        run: node scripts/ci/upload-release-assets.mjs
+        run: |
+          $exts = @('.exe', '.dmg', '.zip', '.AppImage', '.deb')
+          $files = Get-ChildItem release -File | Where-Object { $exts -contains $_.Extension }
+          if (-not $files) { throw "no uploadable artifacts found in release/" }
+          gh release upload $env:TAG @($files.FullName) --clobber
 
   macos:
     name: macOS installers (dmg + zip, x64 + arm64)
     runs-on: macos-latest
-    env:
-      COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
     steps:
       - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
       - name: Enable pnpm via corepack
         run: |
           corepack enable pnpm
@@ -98,6 +110,13 @@ jobs:
         run: ls -la release
       - name: Upload installers to release
         env:
-          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
-          RELEASE_ID: ${{ github.event.release.id || inputs.release_id }}
+          TAG: ${{ github.event.release.tag_name || inputs.tag }}
-        run: node scripts/ci/upload-release-assets.mjs
+        run: |
+          shopt -s nullglob
+          files=(release/*.dmg release/*.zip)
+          if [ ${#files[@]} -eq 0 ]; then
+            echo "no uploadable artifacts found in release/" >&2
+            exit 1
+          fi
+          gh release upload "$TAG" "${files[@]}" --clobber

scripts/ci/upload-release-assets.mjs

@@ -1,79 +0,0 @@
-#!/usr/bin/env node
-/*
- * Attaches installer artifacts from release/ to the Gitea release that
- * triggered the workflow. The new asset is uploaded first and only then are
- * older same-named assets deleted (Gitea allows duplicate attachment names),
- * so a failed re-run never removes a previously good download.
- *
- * Required env: GITHUB_SERVER_URL, GITHUB_REPOSITORY (set by the runner),
- * GITEA_TOKEN, RELEASE_ID (set by the workflow step).
- */
-import fs from 'node:fs';
-import path from 'node:path';
-
-const server = process.env.GITHUB_SERVER_URL;
-const repo = process.env.GITHUB_REPOSITORY;
-const token = process.env.GITEA_TOKEN;
-const releaseId = process.env.RELEASE_ID;
-
-for (const [name, value] of Object.entries({ GITHUB_SERVER_URL: server, GITHUB_REPOSITORY: repo, GITEA_TOKEN: token, RELEASE_ID: releaseId })) {
-  if (!value) {
-    console.error(`missing required env var ${name}`);
-    process.exit(1);
-  }
-}
-
-const apiBase = `${server.replace(/\/$/, '')}/api/v1/repos/${repo}/releases/${releaseId}`;
-const authHeader = { Authorization: `token ${token}` };
-
-const INSTALLER_EXTS = new Set(['.exe', '.dmg', '.zip', '.AppImage', '.deb']);
-const releaseDir = path.resolve('release');
-
-const files = fs
-  .readdirSync(releaseDir, { withFileTypes: true })
-  .filter((e) => e.isFile() && INSTALLER_EXTS.has(path.extname(e.name)))
-  .map((e) => e.name)
-  .sort();
-
-if (files.length === 0) {
-  console.error(`no uploadable artifacts found in ${releaseDir}`);
-  process.exit(1);
-}
-
-const releaseRes = await fetch(apiBase, { headers: authHeader });
-if (!releaseRes.ok) {
-  console.error(`failed to fetch release ${releaseId}: ${releaseRes.status} ${await releaseRes.text()}`);
-  process.exit(1);
-}
-const existingAssets = (await releaseRes.json()).assets ?? [];
-
-for (const name of files) {
-  const filePath = path.join(releaseDir, name);
-  const sizeMb = (fs.statSync(filePath).size / 1024 / 1024).toFixed(1);
-
-  const stale = existingAssets.filter((a) => a.name === name);
-
-  const form = new FormData();
-  form.append('attachment', await fs.openAsBlob(filePath), name);
-  const res = await fetch(`${apiBase}/assets?name=${encodeURIComponent(name)}`, {
-    method: 'POST',
-    headers: authHeader,
-    body: form,
-  });
-  if (!res.ok) {
-    console.error(`failed to upload ${name}: ${res.status} ${await res.text()}`);
-    process.exit(1);
-  }
-  console.log(`uploaded ${name} (${sizeMb} MB)`);
-
-  for (const asset of stale) {
-    const del = await fetch(`${apiBase}/assets/${asset.id}`, { method: 'DELETE', headers: authHeader });
-    if (!del.ok && del.status !== 404) {
-      console.error(`failed to delete stale asset ${name} (id ${asset.id}): ${del.status} ${await del.text()}`);
-      process.exit(1);
-    }
-    console.log(`deleted stale asset ${name} (id ${asset.id})`);
-  }
-}
-
-console.log(`done: ${files.length} asset(s) attached to release ${releaseId}`);