Refactor GitHub Actions workflow for Gitea Packages: streamline preflight upload process, enhance authentication handling using GitHub actor, and remove redundant debug outputs for improved clarity.

.github/workflows/build-linux-amd64.yml

@@ -6,6 +6,8 @@ on:
         description: Package version (defaults to tag name or short SHA)
         required: false
   push:
+    branches:
+      - main
     tags:
       - 'v*'
 
@@ -18,7 +20,7 @@ jobs:
     steps:
       - name: Checkout repository (manual)
         env:
-          TOKEN: ${{ secrets.GITEA_TOKEN }}
+          TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: |
           set -euo pipefail
           if [ -d .git ]; then
@@ -51,6 +53,46 @@ jobs:
           apt-get install -y --no-install-recommends \
             build-essential cmake ninja-build python3 python3-venv pkg-config \
             libssl-dev curl git ca-certificates
+      - name: Preflight Gitea upload (fast-fail)
+        env:
+          GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          : "${GITEA_TOKEN:?GITEA_TOKEN secret is required}"
+          server="${GITHUB_SERVER_URL:-${{ github.server_url }}}"
+          owner="${GITHUB_REPOSITORY_OWNER:-${{ github.repository_owner }}}"
+          repo_full="${GITHUB_REPOSITORY:-${{ github.repository }}}"
+          pkg="${repo_full##*/}-preflight"
+          version="preflight-${GITHUB_RUN_ID:-0}-${GITHUB_RUN_ATTEMPT:-0}-$(date +%s)"
+          name="check.bin"
+          tmpfile="$(mktemp)"
+          printf "auth check %s\n" "$(date -u +%FT%TZ)" > "$tmpfile"
+          # Normalize server to effective scheme+host (handles http->https redirects)
+          base_no_trail="$(echo "$server" | sed 's#/*$##')"
+          # Use GET (not HEAD) to avoid servers that don't support HEAD on this endpoint
+          effective_version_url=$(curl -sS -L -o /dev/null -w '%{url_effective}' "$base_no_trail/api/v1/version" || echo "")
+          normalized_server=$(echo "$effective_version_url" | sed -E 's#^(https?://[^/]+).*$#\1#')
+          if [ -n "$normalized_server" ]; then
+            server="$normalized_server"
+          fi
+          url="$server/api/packages/$owner/generic/$pkg/$version/$name?replace=1"
+          auth_user="${ACTOR:-$owner}"
+          echo "Preflight: server=$server owner=$owner package=$pkg version=$version"
+          # Perform preflight upload using Basic auth directly
+          if curl -fS -L -X PUT \
+            -u "$auth_user:${GITEA_TOKEN}" \
+            -H "Content-Type: application/octet-stream" \
+            --upload-file "$tmpfile" "$url" >/dev/null; then
+            echo "Preflight upload succeeded, cleaning up"
+          else
+            echo "Preflight upload failed" >&2
+            exit 1
+          fi
+          # Cleanup the uploaded dummy package version (best effort)
+          curl -sS -L -o /dev/null -w "  delete -> HTTP %{http_code}\n" \
+            -u "$auth_user:${GITEA_TOKEN}" -X DELETE \
+            "$server/api/packages/$owner/generic/$pkg/$version" || true
       - name: Initialize submodules
         run: |
           set -e
@@ -94,7 +136,8 @@ jobs:
           echo "Using version: $version"
       - name: Upload to Gitea Packages (generic)
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          ACTOR: ${{ github.actor }}
         run: |
           set -euo pipefail
           : "${GITEA_TOKEN:?GITEA_TOKEN secret is required}"
@@ -125,11 +168,24 @@ jobs:
           [ -n "$pkg" ] || { echo "pkg not set" >&2; exit 1; }
           [ -n "$version" ] || { echo "version not set" >&2; exit 1; }
           [ -n "$file" ] || { echo "file not set" >&2; exit 1; }
+          # Normalize server using effective URL of /api/v1/version (handles http->https)
+          base_no_trail="$(echo "$server" | sed 's#/*$##')"
+          effective_version_url=$(curl -sS -L -o /dev/null -w '%{url_effective}' "$base_no_trail/api/v1/version" || echo "")
+          normalized_server=$(echo "$effective_version_url" | sed -E 's#^(https?://[^/]+).*$#\1#')
+          if [ -n "$normalized_server" ]; then
+            server="$normalized_server"
+          fi
+          # Use the GitHub actor as basic auth username by default
+          auth_user="${ACTOR:-$owner}"
           name="$(basename "$file")"
           url="$server/api/packages/$owner/generic/$pkg/$version/$name?replace=1"
           echo "Uploading $file to $url"
-          curl -fsSL -X PUT \
-            -H "Authorization: token ${GITEA_TOKEN}" \
+          echo "  auth user=$auth_user"
+
+          # Use Basic auth directly (works with package registry)
+          curl -fS -L -X PUT \
+            -u "$auth_user:${GITEA_TOKEN}" \
             -H "Content-Type: application/octet-stream" \
+            --retry 2 --retry-delay 2 --max-time 300 \
             --upload-file "$file" "$url"
           echo "Upload complete."