mroberts
a829aa774f
build / build and release (push) Has been cancelled
Ports the build-and-release pipeline from .drone.yml to .gitea/workflows/release.yaml. Same three amd64 targets, same release-on-tag trigger. Actions are pinned to full commit SHAs resolved from gitea.com, the runner's action resolution host. Its mirror of actions/checkout lags upstream, so the floating v4 tag there points at a different commit than github's; only immutable version tags agree across both hosts. checkout stays on v4 and setup-go on v5 because later majors require a Node 24 runtime that act_runner images do not generally ship. Hardening driven by zizmor: workflow-level permissions denied by default with contents:write scoped to the job that publishes the release, persist-credentials disabled so the token is not left in .git/config, and the Go module cache disabled so released binaries cannot be built from restorable cache state. Behaviour changes: - sha1 checksums dropped; gitea-release-action only emits md5 and sha256 - the gitea_public_releases secret is no longer read, as the action defaults to the runner-injected repo token - Go version now comes from go.mod rather than the floating golang image Also gitignores the usergen build output, which dist/* missed. Verified: go build, go vet and go test clean; all three cross-compile targets produce binaries; actionlint and zizmor --offline report no findings. The release step itself is unverified until a tag is pushed.