Phase 6: Gitea-Cross-Builds, Paketprüfung und gesperrten Releasepfad implementieren

.gitea/workflows/publish.yml

@@ -0,0 +1,32 @@
+name: Geprüften Gitea-Entwurf freigeben
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Vorhandener Versionstag, z.B. v0.1.0'
+        required: true
+      evidence_commit:
+        description: '40-stellige Origin-Revision mit release-evidence/<tag>/'
+        required: true
+permissions:
+  contents: read
+jobs:
+  publish:
+    if: gitea.ref == 'refs/heads/main'
+    runs-on: linux-arm64
+    container: ghcr.io/rust-cross/cargo-zigbuild@sha256:82af75c41958c2af2787e8bedd912da7678a9438937e223e9d83d006d747b38b
+    steps:
+      - uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - run: sh .gitea/scripts/bootstrap.sh
+      - run: cargo build --locked --release -p tb-export --bin tb-template
+      - name: Originalpakete und revisionsgebundene Zielnachweise prüfen
+        env:
+          GITEA_SERVER_URL: ${{ gitea.server_url }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          TB_RELEASE_TOKEN: ${{ secrets.TB_RELEASE_TOKEN }}
+          TB_TAG: ${{ inputs.tag }}
+          TB_EVIDENCE_REVISION: ${{ inputs.evidence_commit }}
+        run: python3 .gitea/scripts/publish.py