From 19567aa27323e2d53735aaf37773f1120ce50e16 Mon Sep 17 00:00:00 2001
From: Slawomir Koszewski <slawek@koszewscy.waw.pl>
Date: Fri, 23 Oct 2026 08:10:15 +0200
Subject: [PATCH] feat: add Gitea workflow that builds package on tag push.

---
 .gitea/workflows/release.yml | 25 +++++++++++++++++++++++++
 debian-package/build.sh      |  3 ++-
 debian-package/publish.sh    | 21 +++++++++++++++++----
 3 files changed, 44 insertions(+), 5 deletions(-)
 create mode 100644 .gitea/workflows/release.yml

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..f840b7a
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,25 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - '*.*.*'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Build package
+        working-directory: debian-package
+        run: ./build.sh
+
+      - name: Publish package
+        working-directory: debian-package
+        env:
+          GITEA_PACKAGES_TOKEN: ${{ secrets.CI_TOKEN }}
+        run: ./publish.sh
diff --git a/debian-package/build.sh b/debian-package/build.sh
index a8b1b7b..732ecfd 100755
--- a/debian-package/build.sh
+++ b/debian-package/build.sh
@@ -11,6 +11,7 @@ esac
 mkdir -p out
 
 $CONTAINER_RUNTIME build --build-arg HOST_UID=$(id -u) --build-arg HOST_GID=$(id -g) -t vpn-router-builder "$@" .
-$CONTAINER_RUNTIME run --rm -v "$(pwd)/out:/mnt" vpn-router-builder sh -c 'cp -p /out/* /mnt/'
+# Artifacts are streamed out as a tar archive, so no bind mount is needed.
+$CONTAINER_RUNTIME run --rm vpn-router-builder tar -cf - -C /out . | tar -xf - -C out
 
 echo "Build artifacts written to out/"
diff --git a/debian-package/publish.sh b/debian-package/publish.sh
index 8fd2cef..216fe12 100755
--- a/debian-package/publish.sh
+++ b/debian-package/publish.sh
@@ -8,9 +8,14 @@ case "$(uname -s)" in
     *)      printf 'ERROR: unsupported platform %s\n' "$(uname -s)" >&2; exit 1 ;;
 esac
 
+OWNER=slawek
+GITEA_URL=https://gitea.koszewscy.waw.pl
+GITEA_PACKAGES_TOKEN="${GITEA_PACKAGES_TOKEN:-$(cat ~/.gitea-packages-token)}"
+
+# Reads the changelog copied into the builder image, so no bind mount is needed.
 changelog_field() {
-    $CONTAINER_RUNTIME run --rm -v "$(pwd):/mnt" vpn-router-builder \
-        dpkg-parsechangelog --show-field "$1" -l /mnt/debian/changelog
+    $CONTAINER_RUNTIME run --rm vpn-router-builder \
+        dpkg-parsechangelog --show-field "$1" -l /build/src/debian/changelog
 }
 
 VERSION="$(changelog_field Version)"
@@ -22,6 +27,14 @@ if [ ! -f "$DEB" ]; then
     exit 1
 fi
 
-curl -v --user "slawek:$(cat ~/.gitea-packages-token)" \
+STATUS="$(curl -s -o /dev/null -w '%{http_code}' --user "$OWNER:$GITEA_PACKAGES_TOKEN" \
+    "$GITEA_URL/api/v1/packages/$OWNER/debian/$PACKAGE/$VERSION")"
+case "$STATUS" in
+    200) printf '%s %s is already published, skipping.\n' "$PACKAGE" "$VERSION"; exit 0 ;;
+    404) ;;
+    *)   printf 'ERROR: version check returned HTTP %s.\n' "$STATUS" >&2; exit 1 ;;
+esac
+
+curl --fail-with-body --user "$OWNER:$GITEA_PACKAGES_TOKEN" \
     --upload-file "$DEB" \
-    "https://gitea.koszewscy.waw.pl/api/packages/slawek/debian/pool/noble/main/upload"
+    "$GITEA_URL/api/packages/$OWNER/debian/pool/noble/main/upload"