ci: target this instance's nix runner

- run on the 'nix' label with Nix preinstalled; drop the installer action
- replace the inline release API calls with vpm/publish.sh
- add curl to the devShell for the publish step

.gitea/workflows/ci.yml

@@ -7,35 +7,21 @@ on:
   workflow_dispatch:
 
 jobs:
-  build:
+  nix-flake:
-    runs-on: ubuntu-latest
+    name: Nix flake checks
+    runs-on: nix
     steps:
       - uses: actions/checkout@v4
 
-      - uses: cachix/install-nix-action@v27
+      - name: Check flake
-        with:
+        run: nix flake check --print-build-logs
-          extra_nix_config: |
-            experimental-features = nix-command flakes
 
-      # Builds the cdylib and runs the cargo tests (doCheck).
+      # package.sh bundles the cdylib from ./result/lib, so link the aac package first.
       - name: Build Rust core
         run: nix build .#aac --print-build-logs
 
-      # Rehearses the VPM release: stages the C# package, bundles libaac, updates vpm/index.json.
       - name: Package VPM zip
         run: nix develop -c ./vpm/package.sh
 
-      # The Unity bundle produced by the flake itself.
       - name: Build Unity bundle
         run: nix build .#default --print-build-logs
-
-      - name: Collect artifacts
-        run: |
-          mkdir -p dist
-          cp -L result dist/animator-as-crab-bundle.zip
-          cp vpm/dist/*.zip dist/
-
-      - uses: actions/upload-artifact@v3
-        with:
-          name: animator-as-crab
-          path: dist/*.zip

.gitea/workflows/release.yml

@@ -7,21 +7,14 @@ on:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    name: Publish VPM release
-    permissions:
+    runs-on: nix
-      contents: write
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - uses: cachix/install-nix-action@v27
+      - name: Build Rust core
-        with:
-          extra_nix_config: |
-            experimental-features = nix-command flakes
-
-      # package.sh globs $root/result/lib/*, so the aac package must be linked as ./result.
-      - name: Build native library
         run: nix build .#aac --print-build-logs
 
       - name: Package VPM zip
@@ -33,35 +26,20 @@ jobs:
           SERVER: ${{ github.server_url }}
           REPO: ${{ github.repository }}
           TAG: ${{ github.ref_name }}
-        run: |
+        run: nix develop -c ./vpm/publish.sh
-          set -euo pipefail
-          manifest=csharp/dev.doloro.animator-as-crab/package.json
-          id=$(jq -r .name "$manifest")
-          version=$(jq -r .version "$manifest")
-          zip="vpm/dist/$id-$version.zip"
 
-          release=$(curl -fsS -X POST \
+      # The index carries the zip's sha256, which only exists after packaging.
-            -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
-            "$SERVER/api/v1/repos/$REPO/releases" \
-            -d "$(jq -n --arg tag "$TAG" --arg name "$id $version" \
-                   '{tag_name: $tag, name: $name, draft: false}')")
-
-          curl -fsS -X POST \
-            -H "Authorization: token $TOKEN" \
-            "$SERVER/api/v1/repos/$REPO/releases/$(jq -r .id <<<"$release")/assets?name=$(basename "$zip")" \
-            -F "attachment=@$zip"
-
-      # The index ships the zip's sha256, which only exists after packaging, so it is committed here.
       - name: Commit updated VPM index
         env:
           TOKEN: ${{ secrets.VPM_TOKEN || secrets.GITHUB_TOKEN }}
+          SERVER: ${{ github.server_url }}
+          REPO: ${{ github.repository }}
+          TAG: ${{ github.ref_name }}
         run: |
           set -euo pipefail
-          git config user.name  gitea-actions
+          git config user.name gitea-actions
           git config user.email actions@git.scug.io
           git add vpm/index.json
           git diff --cached --quiet && exit 0
-          version=$(jq -r .version csharp/dev.doloro.animator-as-crab/package.json)
+          git commit -m "vpm: index for $TAG"
-          git commit -m "vpm: index for $version"
+          git push "https://x-access-token:$TOKEN@${SERVER#https://}/${REPO}.git" HEAD:main
-          git push "https://x-access-token:$TOKEN@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" \
-            HEAD:main

flake.nix

@@ -93,6 +93,7 @@
             inputsFrom = [ aac ];
             packages = [
               rustToolchain
+              pkgs.curl
               pkgs.jq
               pkgs.zip
             ];

vpm/publish.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Creates the Gitea release for the current tag and attaches the VPM zip built by package.sh.
+#
+# Needs `curl` and `jq`: run it inside `nix develop`.
+#
+# Environment:
+#   TOKEN   required, Gitea token with repository write access
+#   SERVER  required, e.g. https://git.scug.io
+#   REPO    required, e.g. doloro/av3-animation-as-crab
+#   TAG     required, release tag
+set -euo pipefail
+
+root=$(cd "$(dirname "$0")/.." && pwd)
+manifest="$root/csharp/dev.doloro.animator-as-crab/package.json"
+
+id=$(jq -r .name "$manifest")
+version=$(jq -r .version "$manifest")
+zip="$root/vpm/dist/$id-$version.zip"
+
+zip_name=$(basename "$zip")
+[ -f "$zip" ] || { echo "missing $zip; run package.sh first" >&2; exit 1; }
+
+release=$(curl -fsS -X POST \
+  -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+  "$SERVER/api/v1/repos/$REPO/releases" \
+  -d "$(jq -n --arg tag "$TAG" --arg name "$id $version" '{tag_name: $tag, name: $name}')")
+
+asset_url="$SERVER/api/v1/repos/$REPO/releases/$(jq -r .id <<<"$release")/assets?name=$zip_name"
+
+curl -fsS -X POST \
+  -H "Authorization: token $TOKEN" \
+  "$asset_url" \
+  -F "attachment=@$zip"
+
+echo "released $TAG with $zip_name"