Phase 6: Gitea-Cross-Builds, Paketprüfung und gesperrten Releasepfad implementieren

.gitea/workflows/build.yml

@@ -0,0 +1,102 @@
+name: Vierziel-Build und Pflichtabnahme
+on:
+  push:
+    branches: ['main', 'ci/**']
+    tags: ['v*']
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  checks:
+    if: gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository
+    runs-on: linux-arm64
+    container: ghcr.io/rust-cross/cargo-zigbuild@sha256:82af75c41958c2af2787e8bedd912da7678a9438937e223e9d83d006d747b38b
+    timeout-minutes: 60
+    env:
+      CARGO_BUILD_JOBS: '2'
+      TB_VBDOS_REPOSITORY: ${{ vars.TB_VBDOS_REPOSITORY }}
+      TB_VBDOS_REPO: /tmp/tb-vbdos
+      TB_RUN_URL: ${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_number }}
+    steps:
+      - uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - name: Gepinnte Werkzeuge
+        run: sh .gitea/scripts/bootstrap.sh
+      - name: Fixierten Fremdbestand bereitstellen
+        run: |
+          set -eu
+          test -n "$TB_VBDOS_REPOSITORY" || { echo 'TB_VBDOS_REPOSITORY für Pflichtabnahme fehlt'; exit 1; }
+          git init "$TB_VBDOS_REPO"
+          git -C "$TB_VBDOS_REPO" fetch --depth=1 "$TB_VBDOS_REPOSITORY" 1cdd2b32b829fe1721d0b6aecc433abc47a96fb6
+          git -C "$TB_VBDOS_REPO" checkout --detach FETCH_HEAD
+      - name: Paket- und Release-Regressionen
+        run: python3 -m unittest discover -s .gitea/scripts -p 'test_*.py'
+      - name: Workspace, Inventar, Fremdprogramme und Referenzbenchmarks
+        run: python3 .gitea/scripts/acceptance.py
+      - uses: https://gitea.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5
+        if: always()
+        with:
+          name: acceptance
+          path: acceptance/
+          if-no-files-found: error
+  build:
+    if: gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository
+    runs-on: linux-arm64
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        include:
+          - target: x86_64-pc-windows-msvc
+            image: messense/cargo-xwin@sha256:4696dd4e79edf8569fa99c4b06bd99273e0501c7adc983aa61d57945f795bef0
+          - target: aarch64-apple-darwin
+            image: ghcr.io/rust-cross/cargo-zigbuild@sha256:82af75c41958c2af2787e8bedd912da7678a9438937e223e9d83d006d747b38b
+          - target: x86_64-unknown-linux-gnu
+            image: ghcr.io/rust-cross/cargo-zigbuild@sha256:82af75c41958c2af2787e8bedd912da7678a9438937e223e9d83d006d747b38b
+          - target: aarch64-unknown-linux-gnu
+            image: ghcr.io/rust-cross/cargo-zigbuild@sha256:82af75c41958c2af2787e8bedd912da7678a9438937e223e9d83d006d747b38b
+    container: ${{ matrix.image }}
+    env:
+      TB_BUILD_IMAGE: ${{ matrix.image }}
+      TB_TARGET: ${{ matrix.target }}
+    steps:
+      - uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - run: sh .gitea/scripts/bootstrap.sh
+      - name: Bauen, Format prüfen und paketieren
+        run: python3 .gitea/scripts/build.py --target "$TB_TARGET" --output dist
+      - uses: https://gitea.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5
+        with:
+          name: packages-${{ matrix.target }}
+          path: dist/
+          if-no-files-found: error
+  stage:
+    if: startsWith(gitea.ref, 'refs/tags/v') && gitea.event_name == 'push'
+    needs: [checks, build]
+    runs-on: linux-arm64
+    container: ghcr.io/rust-cross/cargo-zigbuild@sha256:82af75c41958c2af2787e8bedd912da7678a9438937e223e9d83d006d747b38b
+    steps:
+      - uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - run: sh .gitea/scripts/bootstrap.sh
+      - uses: https://gitea.com/actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
+        with:
+          path: artifacts
+      - run: cargo build --locked --release -p tb-export --bin tb-template
+      - name: Vollständigen Releaseentwurf erstellen
+        env:
+          GITEA_SERVER_URL: ${{ gitea.server_url }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          TB_RELEASE_TOKEN: ${{ secrets.TB_RELEASE_TOKEN }}
+          TB_TAG: ${{ gitea.ref_name }}
+          TB_REVISION: ${{ gitea.sha }}
+        run: |
+          mkdir packages
+          cp artifacts/packages-*/*.7z artifacts/packages-*/*.tar.gz artifacts/packages-*/*.sha256 packages/
+          cp artifacts/acceptance/acceptance.json packages/
+          python3 .gitea/scripts/release.py stage --packages packages --tag "$TB_TAG" --revision "$TB_REVISION"

.gitea/workflows/publish.yml

@@ -0,0 +1,32 @@
+name: Geprüften Gitea-Entwurf freigeben
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Vorhandener Versionstag, z.B. v0.1.0'
+        required: true
+      evidence_commit:
+        description: '40-stellige Origin-Revision mit release-evidence/<tag>/'
+        required: true
+permissions:
+  contents: read
+jobs:
+  publish:
+    if: gitea.ref == 'refs/heads/main'
+    runs-on: linux-arm64
+    container: ghcr.io/rust-cross/cargo-zigbuild@sha256:82af75c41958c2af2787e8bedd912da7678a9438937e223e9d83d006d747b38b
+    steps:
+      - uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - run: sh .gitea/scripts/bootstrap.sh
+      - run: cargo build --locked --release -p tb-export --bin tb-template
+      - name: Originalpakete und revisionsgebundene Zielnachweise prüfen
+        env:
+          GITEA_SERVER_URL: ${{ gitea.server_url }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          TB_RELEASE_TOKEN: ${{ secrets.TB_RELEASE_TOKEN }}
+          TB_TAG: ${{ inputs.tag }}
+          TB_EVIDENCE_REVISION: ${{ inputs.evidence_commit }}
+        run: python3 .gitea/scripts/publish.py