name: Geprüften Gitea-Entwurf freigeben
on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Vorhandener Versionstag, z.B. v1.0.0'
        required: true
      evidence_commit:
        description: '40-stellige Origin-Revision mit release-evidence/<tag>/'
        required: true
permissions:
  contents: read
jobs:
  publish:
    if: gitea.ref == 'refs/heads/main'
    runs-on: linux-arm64
    container: ghcr.io/rust-cross/cargo-zigbuild@sha256:82af75c41958c2af2787e8bedd912da7678a9438937e223e9d83d006d747b38b
    steps:
      # Vor checkout nötig: Die Cross-Images enthalten kein Node für JS-Actions.
      - name: Gepinnte Actions-Laufzeit
        run: |
          set -eu
          curl -fsSL https://nodejs.org/dist/v22.22.0/node-v22.22.0-linux-arm64.tar.xz -o /tmp/tb-node.tar.xz
          echo '1bf1eb9ee63ffc4e5d324c0b9b62cf4a289f44332dfef9607cea1a0d9596ba6f  /tmp/tb-node.tar.xz' | sha256sum -c -
          tar -xJf /tmp/tb-node.tar.xz -C /usr/local --strip-components=1
          node --version
      - uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          fetch-depth: 0
          persist-credentials: false
      - run: sh .gitea/scripts/bootstrap.sh
      - run: cargo build --locked --release -p tb-export --bin tb-template
      - name: Originalpakete und revisionsgebundene Zielnachweise prüfen
        env:
          GITEA_SERVER_URL: ${{ gitea.server_url }}
          GITEA_REPOSITORY: ${{ gitea.repository }}
          TB_RELEASE_TOKEN: ${{ secrets.TB_RELEASE_TOKEN || gitea.token }}
          TB_TAG: ${{ inputs.tag }}
          TB_EVIDENCE_REVISION: ${{ inputs.evidence_commit }}
        run: python3 .gitea/scripts/publish.py