Release 1.0.0: Builds ausschließlich für Release-Tags

.gitea/workflows/build.yml

@@ -1,15 +1,11 @@
-name: Vierziel-Build und Pflichtabnahme
+name: Release-Build und Pflichtabnahme
 on:
   push:
-    branches: ['main', 'ci/**']
-    tags: ['v*']
-  pull_request:
-  workflow_dispatch:
+    tags: ['v[0-9]*.[0-9]*.[0-9]*']
 permissions:
   contents: read
 jobs:
   checks:
-    if: gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository
     runs-on: linux-arm64
     container: ghcr.io/rust-cross/cargo-zigbuild@sha256:82af75c41958c2af2787e8bedd912da7678a9438937e223e9d83d006d747b38b
     timeout-minutes: 60
@@ -30,6 +26,18 @@ jobs:
       - uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           persist-credentials: false
+      - name: Release-Tag und Workspace-Version prüfen
+        env:
+          TB_TAG: ${{ gitea.ref_name }}
+          PYTHONPATH: .gitea/scripts
+        run: |
+          python3 - <<'PYTHON'
+          import os, tomllib
+          import distribution as dist
+          from release import release_version
+          version = tomllib.loads((dist.ROOT / 'Cargo.toml').read_text())['workspace']['package']['version']
+          dist.require(release_version(os.environ['TB_TAG']) == version, 'Tag und Workspace-Version weichen ab')
+          PYTHON
       - name: Gepinnte Werkzeuge
         run: sh .gitea/scripts/bootstrap.sh
       - name: Fixierten Fremdbestand bereitstellen
@@ -50,7 +58,7 @@ jobs:
           path: acceptance/
           if-no-files-found: error
   build:
-    if: gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository
+    needs: checks
     runs-on: linux-arm64
     timeout-minutes: 90
     strategy:
@@ -116,7 +124,7 @@ jobs:
         env:
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
-          TB_RELEASE_TOKEN: ${{ secrets.TB_RELEASE_TOKEN }}
+          TB_RELEASE_TOKEN: ${{ secrets.TB_RELEASE_TOKEN || gitea.token }}
           TB_TAG: ${{ gitea.ref_name }}
           TB_REVISION: ${{ gitea.sha }}
         run: |

.gitea/workflows/publish.yml

@@ -3,7 +3,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Vorhandener Versionstag, z.B. v0.1.0'
+        description: 'Vorhandener Versionstag, z.B. v1.0.0'
         required: true
       evidence_commit:
         description: '40-stellige Origin-Revision mit release-evidence/<tag>/'
@@ -34,7 +34,7 @@ jobs:
         env:
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
-          TB_RELEASE_TOKEN: ${{ secrets.TB_RELEASE_TOKEN }}
+          TB_RELEASE_TOKEN: ${{ secrets.TB_RELEASE_TOKEN || gitea.token }}
           TB_TAG: ${{ inputs.tag }}
           TB_EVIDENCE_REVISION: ${{ inputs.evidence_commit }}
         run: python3 .gitea/scripts/publish.py