Merge release workflow into the main build workflow

build-release.yml and build-main.yml ran identical steps (checkout, node,
npm install, npm run build, make appstore) and differed only in where the
package landed. Fold the v* tag trigger into build-main.yml and branch on
gitea.ref in the publishing step: main keeps the rolling latest-main
pre-release, tags get a normal release on the tag that was just pushed.

Tag deletion is now guarded - only latest-main is recreated, since deleting
a version tag would destroy the ref that triggered the run. A stale release
is still removed in both cases so moved tags republish cleanly.

Side effects: version builds are published as durable release assets with a
stable URL instead of expiring workflow artifacts, which drops the last
actions/upload-artifact usage and with it the @v3 pin forced by the GHES
restriction; and the setup-php step goes away, since make appstore only
shells out to mkdir/tar/rm.

.gitea/workflows/build-main.yml

@@ -1,9 +1,11 @@
-name: Build main artifact
+name: Build package
 
 on:
   push:
     branches:
       - main
+    tags:
+      - 'v*'
 
 jobs:
   package:
@@ -24,34 +26,55 @@ jobs:
       - name: Package appstore artifact
         run: make appstore
 
-      - name: Publish rolling "latest-main" release
+      - name: Publish release
         env:
           GITEA_API: ${{ gitea.server_url }}/api/v1
           REPO: ${{ gitea.repository }}
           TOKEN: ${{ secrets.RELEASE_TOKEN }}
           SHA: ${{ gitea.sha }}
+          REF: ${{ gitea.ref }}
         run: |
           set -e
-          TAG="latest-main"
           ASSET="build/artifacts/appstore/workflow_deck_automation.tar.gz"
 
-          # Drop any previous release+tag so the download URL always serves the newest build
-          curl -s -H "Authorization: token $TOKEN" \
-            "$GITEA_API/repos/$REPO/releases/tags/$TAG" -o /tmp/old_release.json
+          case "$REF" in
+            refs/tags/*)
+              TAG="${REF#refs/tags/}"
+              RECREATE_TAG=false
+              PRERELEASE=false
+              TITLE="$TAG"
+              BODY="Release $TAG"
+              ;;
+            *)
+              TAG="latest-main"
+              RECREATE_TAG=true
+              PRERELEASE=true
+              TITLE="Latest main build"
+              BODY="Automatisch aus $SHA gebaut - nur zum schnellen Testen/Deployen, kein offizielles Release."
+              ;;
+          esac
+
+          api() { curl -sS -H "Authorization: token $TOKEN" "$@"; }
+
+          # Always drop an existing release for this tag first: the rolling tag is
+          # rebuilt on every push, and a moved version tag has to publish the new
+          # build instead of failing on a duplicate asset name.
+          api "$GITEA_API/repos/$REPO/releases/tags/$TAG" -o /tmp/old_release.json
           OLD_ID=$(node -e "try{const j=require('/tmp/old_release.json');console.log(j.id||'')}catch(e){console.log('')}")
           if [ -n "$OLD_ID" ]; then
-            curl -s -X DELETE -H "Authorization: token $TOKEN" \
-              "$GITEA_API/repos/$REPO/releases/$OLD_ID"
+            api -X DELETE "$GITEA_API/repos/$REPO/releases/$OLD_ID"
           fi
-          curl -s -X DELETE -H "Authorization: token $TOKEN" \
-            "$GITEA_API/repos/$REPO/tags/$TAG" > /dev/null || true
 
-          # Re-create the tag+release pointing at the commit that was just built
-          curl -s -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
-            -d "{\"tag_name\":\"$TAG\",\"target_commitish\":\"$SHA\",\"name\":\"Latest main build\",\"body\":\"Automatisch aus $SHA gebaut - nur zum schnellen Testen/Deployen, kein offizielles Release.\",\"prerelease\":true}" \
+          # Only latest-main gets its tag recreated - a version tag was just pushed
+          # and must survive, otherwise this job would delete what triggered it.
+          if [ "$RECREATE_TAG" = true ]; then
+            api -X DELETE "$GITEA_API/repos/$REPO/tags/$TAG" > /dev/null || true
+          fi
+
+          api -X POST -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"$TAG\",\"target_commitish\":\"$SHA\",\"name\":\"$TITLE\",\"body\":\"$BODY\",\"prerelease\":$PRERELEASE}" \
             "$GITEA_API/repos/$REPO/releases" -o /tmp/new_release.json
           NEW_ID=$(node -e "console.log(require('/tmp/new_release.json').id)")
 
-          curl -s -X POST -H "Authorization: token $TOKEN" \
-            -F "attachment=@$ASSET" \
+          api -X POST -F "attachment=@$ASSET" \
             "$GITEA_API/repos/$REPO/releases/$NEW_ID/assets?name=workflow_deck_automation.tar.gz"