Split release publishing into a separate public distribution repo

Gitea has no per-release visibility override -- a repo is public or private for everything (raw files, releases, API), confirmed against Gitea's own docs/issue tracker. So manifest.json and release zips now publish to a dedicated public repo (JellyfinSyncPlus-repo) via Gitea's Contents API, while this source repo stays private. The v0.2.0.0 release already pushed under the old (source-repo-only) version of this pipeline is now stale; the next tag will publish correctly under the new split. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-09 17:21:04 +02:00
parent 6eb63449a9
commit 1d2246c5e2
5 changed files with 159 additions and 72 deletions
@@ -1,18 +1,21 @@
 #!/usr/bin/env bash
-# Builds, packages, and updates manifest.json for a tagged release. Used by
-# .github/workflows/release.yml; safe to run locally too for a dry run.
+# Builds and packages a tagged release. Used by .github/workflows/release.yml; safe to
+# run locally too for a dry run. Does NOT touch manifest.json -- that's published
+# separately to the public distribution repo by dev/publish-manifest.sh, since the zip
+# this produces gets uploaded there too (release assets on a private repo can't be made
+# public on their own in Gitea; see PLAN.md "Release distribution").
 #
 # Required env vars:
-#   VERSION      -- e.g. 0.2.0.0 (must match build.yaml's version)
-#   SERVER_URL   -- e.g. https://gitea.mrcynic.site
-#   REPO_OWNER   -- Gitea org/user the repo lives under
-#   REPO_NAME    -- Gitea repo name
+#   VERSION            -- e.g. 0.2.0.0 (must match build.yaml's version)
+#   SERVER_URL         -- e.g. https://gitea.mrcynic.site
+#   PUBLIC_REPO_OWNER   -- Gitea org/user the *public* distribution repo lives under
+#   PUBLIC_REPO_NAME    -- the public distribution repo's name (holds releases + manifest.json)
 set -euo pipefail

 : "${VERSION:?VERSION env var required, e.g. 0.2.0.0}"
 : "${SERVER_URL:?SERVER_URL env var required, e.g. https://gitea.mrcynic.site}"
-: "${REPO_OWNER:?REPO_OWNER env var required}"
-: "${REPO_NAME:?REPO_NAME env var required}"
+: "${PUBLIC_REPO_OWNER:?PUBLIC_REPO_OWNER env var required}"
+: "${PUBLIC_REPO_NAME:?PUBLIC_REPO_NAME env var required}"

 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT"
@@ -34,15 +37,17 @@ rm -f "$ZIP_PATH"
 (cd src/JellyfinSyncPlus/bin/Release/net9.0 && zip -j "$ROOT/$ZIP_PATH" JellyfinSyncPlus.dll)

 CHECKSUM=$(md5sum "$ZIP_PATH" | awk '{print $1}')
-SOURCE_URL="${SERVER_URL}/${REPO_OWNER}/${REPO_NAME}/releases/download/v${VERSION}/${ZIP_NAME}"
-
-python3 "$ROOT/dev/update_manifest.py" \
-  --build-yaml "$ROOT/build.yaml" \
-  --manifest "$ROOT/manifest.json" \
-  --version "$VERSION" \
-  --checksum "$CHECKSUM" \
-  --source-url "$SOURCE_URL"
+SOURCE_URL="${SERVER_URL}/${PUBLIC_REPO_OWNER}/${PUBLIC_REPO_NAME}/releases/download/v${VERSION}/${ZIP_NAME}"

 echo "Packaged $ZIP_PATH"
 echo "Checksum: $CHECKSUM"
 echo "Source URL: $SOURCE_URL"
+
+# For the next workflow step to pick up without re-deriving them (no-op outside CI).
+if [ -n "${GITHUB_OUTPUT:-}" ]; then
+  {
+    echo "CHECKSUM=${CHECKSUM}"
+    echo "SOURCE_URL=${SOURCE_URL}"
+    echo "ZIP_PATH=${ZIP_PATH}"
+  } >> "$GITHUB_OUTPUT"
+fi
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Fetches the current manifest.json from the public distribution repo (or starts fresh
+# if this is the first release), merges in this build's version entry, and pushes it
+# back -- all via Gitea's Contents API, so this never needs a git clone of the public
+# repo. Keeps the private source repo and the public distribution repo fully decoupled.
+#
+# Required env vars:
+#   GITEA_TOKEN, SERVER_URL, PUBLIC_REPO_OWNER, PUBLIC_REPO_NAME, VERSION, CHECKSUM, SOURCE_URL
+set -euo pipefail
+
+: "${GITEA_TOKEN:?}"
+: "${SERVER_URL:?}"
+: "${PUBLIC_REPO_OWNER:?}"
+: "${PUBLIC_REPO_NAME:?}"
+: "${VERSION:?}"
+: "${CHECKSUM:?}"
+: "${SOURCE_URL:?}"
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+API="${SERVER_URL}/api/v1/repos/${PUBLIC_REPO_OWNER}/${PUBLIC_REPO_NAME}/contents/manifest.json"
+WORKDIR=$(mktemp -d)
+trap 'rm -rf "$WORKDIR"' EXIT
+
+HTTP_CODE=$(curl -s -o "$WORKDIR/existing.json" -w "%{http_code}" \
+  -H "Authorization: token ${GITEA_TOKEN}" "${API}?ref=master")
+
+if [ "$HTTP_CODE" = "200" ]; then
+  SHA=$(python3 -c 'import json; print(json.load(open("'"$WORKDIR"'/existing.json"))["sha"])')
+  python3 -c 'import json,base64
+d = json.load(open("'"$WORKDIR"'/existing.json"))
+open("'"$WORKDIR"'/manifest.json", "wb").write(base64.b64decode(d["content"]))'
+  echo "Fetched existing manifest.json (sha ${SHA})"
+else
+  SHA=""
+  echo "[]" > "$WORKDIR/manifest.json"
+  echo "No existing manifest.json in ${PUBLIC_REPO_OWNER}/${PUBLIC_REPO_NAME} -- starting fresh (HTTP $HTTP_CODE)"
+fi
+
+python3 "$ROOT/dev/update_manifest.py" \
+  --build-yaml "$ROOT/build.yaml" \
+  --manifest "$WORKDIR/manifest.json" \
+  --version "$VERSION" \
+  --checksum "$CHECKSUM" \
+  --source-url "$SOURCE_URL"
+
+CONTENT_B64=$(base64 -w0 "$WORKDIR/manifest.json")
+
+python3 -c 'import json,sys
+body = {"content": sys.argv[1], "message": "Release " + sys.argv[2], "branch": "master"}
+if sys.argv[3]:
+    body["sha"] = sys.argv[3]
+json.dump(body, open(sys.argv[4], "w"))' "$CONTENT_B64" "$VERSION" "$SHA" "$WORKDIR/body.json"
+
+METHOD="POST"
+if [ -n "$SHA" ]; then
+  METHOD="PUT"
+fi
+
+curl -sf -X "$METHOD" \
+  -H "Authorization: token ${GITEA_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d "@$WORKDIR/body.json" \
+  "$API" > /dev/null
+
+echo "Published manifest.json version ${VERSION} to ${PUBLIC_REPO_OWNER}/${PUBLIC_REPO_NAME}"