feat: add Gitea workflow that builds package on tag push.

.gitea/workflows/release.yml

@@ -0,0 +1,25 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - '*.*.*'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Build package
+        working-directory: debian-package
+        run: ./build.sh
+
+      - name: Publish package
+        working-directory: debian-package
+        env:
+          GITEA_PACKAGES_TOKEN: ${{ secrets.CI_TOKEN }}
+        run: ./publish.sh

debian-package/build.sh

@@ -11,6 +11,7 @@ esac
 mkdir -p out
 
 $CONTAINER_RUNTIME build --build-arg HOST_UID=$(id -u) --build-arg HOST_GID=$(id -g) -t vpn-router-builder "$@" .
-$CONTAINER_RUNTIME run --rm -v "$(pwd)/out:/mnt" vpn-router-builder sh -c 'cp -p /out/* /mnt/'
+# Artifacts are streamed out as a tar archive, so no bind mount is needed.
+$CONTAINER_RUNTIME run --rm vpn-router-builder tar -cf - -C /out . | tar -xf - -C out
 
 echo "Build artifacts written to out/"

debian-package/publish.sh

@@ -8,9 +8,14 @@ case "$(uname -s)" in
     *)      printf 'ERROR: unsupported platform %s\n' "$(uname -s)" >&2; exit 1 ;;
 esac
 
+OWNER=slawek
+GITEA_URL=https://gitea.koszewscy.waw.pl
+GITEA_PACKAGES_TOKEN="${GITEA_PACKAGES_TOKEN:-$(cat ~/.gitea-packages-token)}"
+
+# Reads the changelog copied into the builder image, so no bind mount is needed.
 changelog_field() {
-    $CONTAINER_RUNTIME run --rm -v "$(pwd):/mnt" vpn-router-builder \
+    $CONTAINER_RUNTIME run --rm vpn-router-builder \
-        dpkg-parsechangelog --show-field "$1" -l /mnt/debian/changelog
+        dpkg-parsechangelog --show-field "$1" -l /build/src/debian/changelog
 }
 
 VERSION="$(changelog_field Version)"
@@ -22,6 +27,14 @@ if [ ! -f "$DEB" ]; then
     exit 1
 fi
 
-curl -v --user "slawek:$(cat ~/.gitea-packages-token)" \
+STATUS="$(curl -s -o /dev/null -w '%{http_code}' --user "$OWNER:$GITEA_PACKAGES_TOKEN" \
+    "$GITEA_URL/api/v1/packages/$OWNER/debian/$PACKAGE/$VERSION")"
+case "$STATUS" in
+    200) printf '%s %s is already published, skipping.\n' "$PACKAGE" "$VERSION"; exit 0 ;;
+    404) ;;
+    *)   printf 'ERROR: version check returned HTTP %s.\n' "$STATUS" >&2; exit 1 ;;
+esac
+
+curl --fail-with-body --user "$OWNER:$GITEA_PACKAGES_TOKEN" \
     --upload-file "$DEB" \
-    "https://gitea.koszewscy.waw.pl/api/packages/slawek/debian/pool/noble/main/upload"
+    "$GITEA_URL/api/packages/$OWNER/debian/pool/noble/main/upload"