Network helpers, docs hygiene, Outline sync notes

2026-07-14 19:50:42 -05:00
parent 7369b1c5e5
commit 6e3763f44f
14 changed files with 635 additions and 87 deletions
@@ -5,6 +5,7 @@ name: CI
 on:
  push:
    branches: [main]
+    tags: ['v*']
  pull_request:
    types: [opened, synchronize, reopened]

@@ -56,3 +57,81 @@ jobs:
        run: |
          docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:latest \
            detect --source /repo --no-banner --redact
+
+  # Release: only runs on `vX.Y.Z` tag push. Gates a Gitea release behind the
+  # same integrity checks as CI (never trust a bare "bump + tag") plus two
+  # consistency checks bare tagging can't give you: tag == package.json
+  # version, and CHANGELOG.md actually documents this version.
+  release:
+    runs-on: [homelab, self-hosted, linux]
+    container:
+      image: node:20-bookworm
+    if: startsWith(github.ref, 'refs/tags/v')
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install
+        run: npm ci
+      - name: Typecheck
+        run: npm run typecheck
+      - name: Unit tests
+        run: npm test
+      - name: Build
+        run: npm run build
+      - name: Verify tag matches package.json version
+        run: |
+          TAG="${GITHUB_REF#refs/tags/v}"
+          PKG_VERSION="$(node -p "require('./package.json').version")"
+          if [ "$TAG" != "$PKG_VERSION" ]; then
+            echo "::error::tag v$TAG does not match package.json version $PKG_VERSION"
+            exit 1
+          fi
+          echo "RELEASE_VERSION=$TAG" >> "$GITEA_ENV"
+      - name: Extract CHANGELOG section for this version
+        run: |
+          node -e '
+            const fs = require("fs");
+            const version = process.env.RELEASE_VERSION;
+            const text = fs.readFileSync("CHANGELOG.md", "utf8");
+            const re = new RegExp(`^## ${version.replace(/\./g, "\\.")}.*$`, "m");
+            const start = text.search(re);
+            if (start === -1) {
+              console.error(`::error::CHANGELOG.md has no "## ${version}" section — update it before tagging`);
+              process.exit(1);
+            }
+            const rest = text.slice(start);
+            const next = rest.slice(1).search(/^## /m);
+            const section = next === -1 ? rest : rest.slice(0, next + 1);
+            fs.writeFileSync("/tmp/release-notes.md", section.trim() + "\n");
+          '
+      - name: Pack npm tarball
+        run: npm pack --pack-destination /tmp
+      - name: Create Gitea release
+        run: |
+          BODY_JSON=$(node -e '
+            const fs = require("fs");
+            const body = fs.readFileSync("/tmp/release-notes.md", "utf8");
+            process.stdout.write(JSON.stringify({
+              tag_name: process.env.GITHUB_REF_NAME,
+              name: process.env.GITHUB_REF_NAME,
+              body,
+              draft: false,
+              prerelease: false,
+            }));
+          ')
+          RESPONSE=$(curl -sS -X POST \
+            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "$BODY_JSON" \
+            "https://git.levkin.ca/api/v1/repos/ilia/playkit/releases")
+          RELEASE_ID=$(node -e "console.log(JSON.parse(process.argv[1]).id)" "$RESPONSE")
+          if [ -z "$RELEASE_ID" ] || [ "$RELEASE_ID" = "undefined" ]; then
+            echo "::error::release creation failed: $RESPONSE"
+            exit 1
+          fi
+          TARBALL=$(ls /tmp/levkin-playkit-*.tgz)
+          curl -sS -X POST \
+            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -F "attachment=@${TARBALL}" \
+            "https://git.levkin.ca/api/v1/repos/ilia/playkit/releases/${RELEASE_ID}/assets"