Upload release assets via the Gitea API instead of artifacts + gh

The release ran on Gitea Actions, where it failed at actions/upload-artifact@v4:
the v4 artifact backend (and the GitHub REST API that `gh release create` uses)
are not available on Gitea/GHES, so both the artifact handoff and the publish
job were dead ends there.

Reworked so each build job uploads its archive straight to the release through
Gitea's native API (`/api/v1/repos/<repo>/releases`) with curl: create the
release for the tag if absent (races between matrix jobs are resolved by reading
the id back by tag), then POST the archive as an asset. The separate publish
job, download-artifact and `gh` are gone. The id is parsed with grep, so the
runner needs only curl and coreutils — no jq, no third-party release action.
Uses the Gitea-injected GITHUB_TOKEN, GITHUB_SERVER_URL and GITHUB_REPOSITORY;
a tag with a pre-release suffix (e.g. -rc.2) is marked prerelease.

This targets Gitea by design; it no longer runs as-is on github.com (different
API), which is fine — the GitHub build is being retired. Build and package
steps, the musl/zig setup and the target matrix are unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -1,15 +1,20 @@
 name: Release
 
 # Build the agent for every supported target on a version tag and attach the
-# archives to a GitHub release. Linux is a fully static musl binary (built with
+# archives to a release. Linux is a fully static musl binary (built with
 # cargo-zigbuild) so one artifact runs on any distro — Arch, Alpine, NixOS, old
 # glibc systems alike — and can then be repackaged however a distro prefers.
+#
+# Targeted at Gitea Actions: the release assets are uploaded straight to the
+# Gitea release API with curl, rather than through actions/upload-artifact and
+# `gh`, because the v4 artifact backend and the GitHub REST API are not
+# available there. The only runner tools it needs are curl and coreutils.
 on:
   push:
     tags: ["v*"]
 
 permissions:
-  contents: read
+  contents: write
 
 env:
   CARGO_TERM_COLOR: always
@@ -66,11 +71,11 @@ jobs:
         uses: mlugg/setup-zig@v2
         with:
           # Pin a real, archived Zig release. Left unpinned the action resolves
-          # to the newest version it knows of (a yet-unreleased 0.16.0-dev here),
-          # whose tarball 404s on ziglang.org while the community mirrors flake —
-          # exactly the failure this build hit. A concrete release always has a
-          # permanent official URL, so the download succeeds even if mirrors are
-          # down, and the version stays compatible with cargo-zigbuild.
+          # to the newest version it knows of (a yet-unreleased 0.16.0-dev),
+          # whose tarball 404s on ziglang.org while the community mirrors flake.
+          # A concrete release always has a permanent official URL, so the
+          # download succeeds even if mirrors are down, and the version stays
+          # compatible with cargo-zigbuild.
           version: 0.14.1
       - name: Install cargo-zigbuild
         if: matrix.zig
@@ -125,32 +130,46 @@ jobs:
             tar -C dist/pkg -czf "${archive}" "${{ matrix.asset }}"
           fi
 
-      - uses: actions/upload-artifact@v4
-        with:
-          name: ${{ matrix.asset }}
-          path: ${{ matrix.asset }}-*.*
-          if-no-files-found: error
-
-  publish:
-    name: Publish release
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-
-      - name: Create release and upload assets
+      - name: Upload the archive to the release
+        shell: bash
         env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ github.ref_name }}
+          # Gitea injects this with write access to the current repository.
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          set -euo pipefail
-          gh release create "$RELEASE_TAG" artifacts/*/* \
-            --title "tsunagi ${RELEASE_TAG}" \
-            --generate-notes \
-            --verify-tag
+          set -u
+
+          version="${GITHUB_REF_NAME#v}"
+          archive="${{ matrix.asset }}-${version}.${{ matrix.archive }}"
+          tag="${GITHUB_REF_NAME}"
+          api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
+          auth="Authorization: token ${TOKEN}"
+
+          prerelease=false
+          case "$tag" in *-*) prerelease=true ;; esac
+
+          # The release id for this tag, or empty if there is no release yet.
+          # Parsed with grep so the job needs no jq on the runner image.
+          get_id() {
+            curl -fsSL -H "$auth" "$api/releases/tags/$tag" 2>/dev/null \
+              | grep -o '"id":[0-9]*' | head -n1 | cut -d: -f2
+          }
+
+          # Create the release if it is not there. Several matrix jobs can race
+          # here, so a create that loses the race is ignored and the id is then
+          # read back by tag.
+          id="$(get_id)"
+          if [ -z "$id" ]; then
+            curl -fsS -X POST -H "$auth" -H 'Content-Type: application/json' \
+              -d "{\"tag_name\":\"$tag\",\"name\":\"tsunagi $tag\",\"prerelease\":$prerelease}" \
+              "$api/releases" >/dev/null 2>&1 || true
+            id="$(get_id)"
+          fi
+          if [ -z "$id" ]; then
+            echo "could not create or find a release for $tag at $api" >&2
+            exit 1
+          fi
+
+          curl -fsS -X POST -H "$auth" \
+            -F "attachment=@${archive}" \
+            "$api/releases/$id/assets?name=${archive}" >/dev/null
+          echo "uploaded $archive to release $tag (id $id)"