fix(release): refresh published XBPS assets

Set the existing Fenris commit identity and pass the Gitea publish token to Git without storing credentials on the runner.

.gitea/workflows/release.yml

@@ -203,9 +203,21 @@ jobs:
           esac
 
       - name: Publish XBPS to distribution repository
-        if: github.event.inputs.publish_xbps == 'true'
+        id: publish-xbps
+        if: ${{ github.event.inputs.publish_xbps == true || github.event.inputs.publish_xbps == 'true' }}
+        env:
+          GITEA_PUBLISH_TOKEN: ${{ secrets.GITEAPACKAGETOKEN }}
         run: |
           set -euo pipefail
+          if [ -z "${GITEA_PUBLISH_TOKEN}" ]; then
+            echo "::error::GITEAPACKAGETOKEN repository secret is not configured"
+            exit 1
+          fi
+          git config user.name "xavierk"
+          git config user.email "xavierk@bongbetic.com"
+          export GIT_CONFIG_COUNT=1
+          export GIT_CONFIG_KEY_0='http.https://git.bongbetic.com/.extraheader'
+          export GIT_CONFIG_VALUE_0="Authorization: token ${GITEA_PUBLISH_TOKEN}"
           VERSION=${{ steps.version.outputs.version }}
           XBPS_FILE="fenris-${VERSION}_1.x86_64.xbps"
           if [ ! -f "${XBPS_FILE}" ]; then
@@ -217,6 +229,7 @@ jobs:
             exit 1
           fi
           bash scripts/xbps-publish.sh --publish
+          echo "xbps_published=true" >> "$GITHUB_OUTPUT"
 
       - name: Track format availability
         id: formats
@@ -226,7 +239,7 @@ jobs:
           DEB_EXISTS=$([ -f "dist/fenris_${VERSION}_amd64.deb" ] && echo "true" || echo "false")
           RPM_EXISTS=$([ -f "dist/fenris-${VERSION}-1.x86_64.rpm" ] && echo "true" || echo "false")
           XBPS_EXISTS=$([ -f "fenris-${VERSION}_1.x86_64.xbps" ] && echo "true" || echo "false")
-          XBPS_PUBLISHED=$([ "${{ github.event.inputs.publish_xbps }}" = "true" ] && echo "true" || echo "false")
+          XBPS_PUBLISHED=$([ "${{ steps.publish-xbps.outputs.xbps_published }}" = "true" ] && echo "true" || echo "false")
           echo "deb_available=${DEB_EXISTS}" >> "$GITHUB_OUTPUT"
           echo "rpm_available=${RPM_EXISTS}" >> "$GITHUB_OUTPUT"
           echo "xbps_available=${XBPS_EXISTS}" >> "$GITHUB_OUTPUT"
@@ -317,7 +330,8 @@ jobs:
             "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/tags/v${VERSION}")
           RELEASE_ID=$(printf '%s' "${RELEASE_JSON}" \
             | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
-          # Attach deb, rpm, clearsigned checksums, and XBPS artifacts once.
+          PUBLISH_XBPS="${{ steps.formats.outputs.xbps_published }}"
+          # Attach package artifacts; refresh XBPS assets after publication.
           ARTIFACTS=(
             "dist/fenris_${VERSION}_amd64.deb"
             "dist/fenris-${VERSION}-1.x86_64.rpm"
@@ -335,14 +349,22 @@ jobs:
           fi
           for FILE in "${ARTIFACTS[@]}"; do
             ASSET_NAME="${FILE##*/}"
-            if python3 -c 'import json,sys; name=sys.argv[1]; sys.exit(0 if any(a.get("name") == name for a in json.load(sys.stdin).get("assets", [])) else 1)' "${ASSET_NAME}" <<<"${RELEASE_JSON}"; then
-              echo "${ASSET_NAME}: already attached"
-            else
-              curl --fail --silent --show-error -X POST \
-                -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
-                -F "attachment=@${FILE}" \
-                "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/${RELEASE_ID}/assets"
+            EXISTING_ASSET_ID=$(python3 -c 'import json,sys; name=sys.argv[1]; print(next((a["id"] for a in json.load(sys.stdin).get("assets", []) if a.get("name") == name), ""))' \
+              "${ASSET_NAME}" <<<"${RELEASE_JSON}")
+            if [ -n "${EXISTING_ASSET_ID}" ]; then
+              if [ "${PUBLISH_XBPS}" = "true" ] && [[ "${ASSET_NAME}" = "${XBPS_FILE}" || "${ASSET_NAME}" = "${XBPS_FILE}.sig2" ]]; then
+                curl --fail --silent --show-error -X DELETE \
+                  -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
+                  "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/${RELEASE_ID}/assets/${EXISTING_ASSET_ID}"
+              else
+                echo "${ASSET_NAME}: already attached"
+                continue
+              fi
             fi
+            curl --fail --silent --show-error -X POST \
+              -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
+              -F "attachment=@${FILE}" \
+              "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/${RELEASE_ID}/assets"
           done
 
       - name: Remove XBPS signing key