From b2c407ab6e616284450bfcc17585819bc523c225 Mon Sep 17 00:00:00 2001
From: DuProcess <273172371+DuProcess@users.noreply.github.com>
Date: Sun, 12 Jul 2026 12:21:26 -0400
Subject: [PATCH] Publish complete release artifacts to Gitea

---
 .github/workflows/ci.yml            | 33 +++++++++++++++++++++++++++++
 scripts/verify-release-artifacts.sh |  2 +-
 tests/release_scripts.rs            |  9 ++++++++
 3 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8472232..840b267 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -86,6 +86,39 @@ jobs:
             target/dosh-release/dosh-*
             !target/dosh-release/stage/**
 
+  publish-gitea-release:
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/')
+    needs: package-release
+    runs-on: ubuntu-latest
+    env:
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+      GITEA_URL: ${{ secrets.GITEA_URL || 'https://git.palav.dev' }}
+      GITEA_REPO: ${{ secrets.GITEA_REPO || 'Palav/dosh' }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: dosh-*
+          path: target/dosh-release
+          merge-multiple: true
+      - name: Verify release artifacts
+        run: sh scripts/verify-release-artifacts.sh
+      - name: Skip Gitea upload without token
+        if: env.GITEA_TOKEN == ''
+        run: echo "GITEA_TOKEN secret is not configured; release artifacts were verified but not uploaded."
+      - name: Upload Gitea release assets
+        if: env.GITEA_TOKEN != ''
+        run: |
+          set -eu
+          case "$GITHUB_REF" in
+            refs/tags/*) tag="${GITHUB_REF_NAME}" ;;
+            *)
+              version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | sed -n '1p')"
+              tag="v$version"
+              ;;
+          esac
+          scripts/upload-gitea-release.sh "$tag"
+
   remote-bench:
     runs-on: ubuntu-latest
     env:
diff --git a/scripts/verify-release-artifacts.sh b/scripts/verify-release-artifacts.sh
index 7d53fa3..8b0f154 100644
--- a/scripts/verify-release-artifacts.sh
+++ b/scripts/verify-release-artifacts.sh
@@ -25,7 +25,7 @@ artifact_version() {
 if [ "$#" -gt 0 ]; then
   artifacts="$*"
 else
-  artifacts="$out_dir/dosh-linux-x86_64.tar.gz $out_dir/dosh-macos-aarch64.tar.gz $out_dir/dosh-windows-x86_64.zip"
+  artifacts="$out_dir/dosh-linux-x86_64.tar.gz $out_dir/dosh-macos-aarch64.tar.gz $out_dir/dosh-macos-x86_64.tar.gz $out_dir/dosh-windows-x86_64.zip"
 fi
 
 failed=0
diff --git a/tests/release_scripts.rs b/tests/release_scripts.rs
index 81f5719..e40d27f 100644
--- a/tests/release_scripts.rs
+++ b/tests/release_scripts.rs
@@ -42,6 +42,15 @@ fn package_check_verifies_only_artifacts_it_builds() {
     );
 }
 
+#[test]
+fn complete_release_verifier_requires_both_macos_architectures() {
+    let verify = include_str!("../scripts/verify-release-artifacts.sh");
+    assert!(verify.contains("dosh-linux-x86_64.tar.gz"));
+    assert!(verify.contains("dosh-macos-aarch64.tar.gz"));
+    assert!(verify.contains("dosh-macos-x86_64.tar.gz"));
+    assert!(verify.contains("dosh-windows-x86_64.zip"));
+}
+
 #[test]
 fn package_release_stamps_git_build_info() {
     let package = include_str!("../scripts/package-release.sh");