From 911aaca355ed32b0b7740082ee15c98521b10249 Mon Sep 17 00:00:00 2001
From: mr-forust <vzlomdsisma@gmail.com>
Date: Fri, 3 Jul 2026 23:44:22 +0200
Subject: [PATCH] fix: expose gitea token in release workflow

---
 .gitea/workflows/release.yaml | 32 +++++++++++++++++++++++++++++++-
 RELEASING.md                  | 14 ++++++++------
 2 files changed, 39 insertions(+), 7 deletions(-)

diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
index 84a484d..fd779e3 100644
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -10,8 +10,38 @@ permissions:
   contents: write
 
 jobs:
-  linux-amd64:
+  verify:
     runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Check formatting
+        shell: bash
+        run: cargo fmt --check
+
+      - name: Run tests
+        shell: bash
+        run: cargo test --locked
+
+      - name: Run clippy
+        shell: bash
+        run: cargo clippy --locked -- -D warnings
+
+      - name: Lint YAML
+        shell: bash
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cytopia/yamllint:latest \
+            -c .yamllint .
+
+  linux-amd64:
+    needs: verify
+    runs-on: [self-hosted, linux, arch, homelab]
+    env:
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
diff --git a/RELEASING.md b/RELEASING.md
index 7a77107..87f5bfe 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -40,7 +40,7 @@ https://gitea.forust.xyz/forust/gosleep.git
    - `sha256sum`
    - Docker, if using the YAML lint job as written
 4. Confirm Actions job token permissions allow `contents: write`.
-   The release workflow uses Gitea Actions' built-in `GITEA_TOKEN`; no extra repository secret is required.
+   The release workflow uses Gitea Actions' built-in `GITEA_TOKEN`, exposed in the workflow as `${{ secrets.GITEA_TOKEN }}`; no extra repository secret is required.
 
 ## Version Bump Checklist
 
@@ -78,13 +78,15 @@ git push origin v1.1.2
 
 The `.gitea/workflows/release.yaml` workflow will:
 
-1. Build `target/release/gosleep-timer`.
-2. Package `gosleep-timer-<version>-linux-amd64.tar.gz`.
-3. Generate a SHA-256 checksum.
-4. Create a Gitea release.
-5. Upload the archive and checksum as release assets.
+1. Re-run release gates: `cargo fmt --check`, `cargo test --locked`, `cargo clippy --locked -- -D warnings`, and YAML lint.
+2. Build `target/release/gosleep-timer`.
+3. Package `gosleep-timer-<version>-linux-amd64.tar.gz`.
+4. Generate a SHA-256 checksum.
+5. Create a Gitea release.
+6. Upload the archive and checksum as release assets.
 
 The workflow is idempotent: if the release already exists, it reuses it and replaces assets with matching names.
+If any lint or test step fails, the build and release job will not run.
 
 ## Manual Asset Build