Split release publishing into a separate public distribution repo

Gitea has no per-release visibility override -- a repo is public or
private for everything (raw files, releases, API), confirmed against
Gitea's own docs/issue tracker. So manifest.json and release zips now
publish to a dedicated public repo (JellyfinSyncPlus-repo) via Gitea's
Contents API, while this source repo stays private. The v0.2.0.0 release
already pushed under the old (source-repo-only) version of this pipeline
is now stale; the next tag will publish correctly under the new split.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -1,5 +1,14 @@
 name: Release Plugin
 
+# Releases are published to a *separate public* distribution repo, not this one.
+# Gitea has no way to make individual release assets public while the source repo
+# stays private -- repo visibility is all-or-nothing, confirmed against Gitea's own
+# docs/issue tracker -- so the actual plugin zip + manifest.json live in
+# PUBLIC_REPO_NAME below, kept in sync by this workflow. This (private source) repo
+# never needs to be public for Jellyfin installs to work.
+env:
+  PUBLIC_REPO_NAME: JellyfinSyncPlus-repo
+
 on:
   push:
     tags:
@@ -23,7 +32,6 @@ jobs:
         id: meta
         run: |
           echo REPO_OWNER=$(echo ${GITHUB_REPOSITORY} | awk -F"/" '{print $1}') >> $GITHUB_OUTPUT
-          echo REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F"/" '{print $2}') >> $GITHUB_OUTPUT
           echo VERSION=$(echo ${GITHUB_REF_NAME} | sed 's/^v//') >> $GITHUB_OUTPUT
           cat $GITHUB_OUTPUT
 
@@ -38,53 +46,40 @@ jobs:
           docker cp jf-extract:/usr/lib/jellyfin/bin/Emby.Server.Implementations.dll lib/jellyfin-10.11.6/
           docker rm jf-extract
 
-      - name: Build, package, update manifest
+      - name: Build and package
+        id: package
         env:
           VERSION: ${{ steps.meta.outputs.VERSION }}
           SERVER_URL: ${{ github.server_url }}
-          REPO_OWNER: ${{ steps.meta.outputs.REPO_OWNER }}
-          REPO_NAME: ${{ steps.meta.outputs.REPO_NAME }}
+          PUBLIC_REPO_OWNER: ${{ steps.meta.outputs.REPO_OWNER }}
+          PUBLIC_REPO_NAME: ${{ env.PUBLIC_REPO_NAME }}
         run: dev/package-release.sh
 
-      - name: Create Gitea release and upload zip
+      - name: Create release and upload zip on the public repo
         env:
           GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           SERVER_URL: ${{ github.server_url }}
-          REPO_OWNER: ${{ steps.meta.outputs.REPO_OWNER }}
-          REPO_NAME: ${{ steps.meta.outputs.REPO_NAME }}
+          PUBLIC_REPO_OWNER: ${{ steps.meta.outputs.REPO_OWNER }}
           VERSION: ${{ steps.meta.outputs.VERSION }}
           TAG: ${{ github.ref_name }}
+          ZIP_PATH: ${{ steps.package.outputs.ZIP_PATH }}
         run: |
           RELEASE_ID=$(curl -sf -X POST \
             -H "Authorization: token ${GITEA_TOKEN}" \
             -H "Content-Type: application/json" \
             -d "{\"tag_name\":\"${TAG}\",\"name\":\"${TAG}\",\"body\":\"See build.yaml changelog / manifest.json for this version's notes.\"}" \
-            "${SERVER_URL}/api/v1/repos/${REPO_OWNER}/${REPO_NAME}/releases" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
+            "${SERVER_URL}/api/v1/repos/${PUBLIC_REPO_OWNER}/${PUBLIC_REPO_NAME}/releases" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
           curl -sf -X POST \
             -H "Authorization: token ${GITEA_TOKEN}" \
-            -F "attachment=@release/JellyfinSyncPlus_${VERSION}.zip" \
-            "${SERVER_URL}/api/v1/repos/${REPO_OWNER}/${REPO_NAME}/releases/${RELEASE_ID}/assets?name=JellyfinSyncPlus_${VERSION}.zip"
+            -F "attachment=@${ZIP_PATH}" \
+            "${SERVER_URL}/api/v1/repos/${PUBLIC_REPO_OWNER}/${PUBLIC_REPO_NAME}/releases/${RELEASE_ID}/assets?name=JellyfinSyncPlus_${VERSION}.zip"
 
-      # manifest.json has to live at a stable URL on a normal branch (master) --
-      # that's the one URL admins add to Jellyfin once, and every future release
-      # just appends to it. The tag checkout above is detached HEAD, so switch to
-      # master to commit, carrying the just-updated manifest.json across.
-      - name: Commit updated manifest to master
+      - name: Publish manifest.json to the public repo
         env:
           GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           SERVER_URL: ${{ github.server_url }}
-          REPO_OWNER: ${{ steps.meta.outputs.REPO_OWNER }}
-          REPO_NAME: ${{ steps.meta.outputs.REPO_NAME }}
+          PUBLIC_REPO_OWNER: ${{ steps.meta.outputs.REPO_OWNER }}
           VERSION: ${{ steps.meta.outputs.VERSION }}
-        run: |
-          cp manifest.json /tmp/manifest.json
-          git fetch origin master
-          git checkout master
-          cp /tmp/manifest.json manifest.json
-          git config user.name "gitea-actions"
-          git config user.email "actions@gitea.local"
-          git add manifest.json
-          git diff --cached --quiet && echo "No manifest changes to commit" && exit 0
-          git commit -m "Release ${VERSION}"
-          HOST=$(echo "${SERVER_URL}" | sed 's#https\?://##')
-          git push "https://gitea-actions:${GITEA_TOKEN}@${HOST}/${REPO_OWNER}/${REPO_NAME}.git" HEAD:master
+          CHECKSUM: ${{ steps.package.outputs.CHECKSUM }}
+          SOURCE_URL: ${{ steps.package.outputs.SOURCE_URL }}
+        run: dev/publish-manifest.sh