fix: expose gitea token in release workflow

.gitea/workflows/release.yaml

@@ -10,8 +10,38 @@ permissions:
   contents: write
 
 jobs:
-  linux-amd64:
+  verify:
     runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Check formatting
+        shell: bash
+        run: cargo fmt --check
+
+      - name: Run tests
+        shell: bash
+        run: cargo test --locked
+
+      - name: Run clippy
+        shell: bash
+        run: cargo clippy --locked -- -D warnings
+
+      - name: Lint YAML
+        shell: bash
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cytopia/yamllint:latest \
+            -c .yamllint .
+
+  linux-amd64:
+    needs: verify
+    runs-on: [self-hosted, linux, arch, homelab]
+    env:
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4

RELEASING.md

@@ -40,7 +40,7 @@ https://gitea.forust.xyz/forust/gosleep.git
    - `sha256sum`
    - Docker, if using the YAML lint job as written
 4. Confirm Actions job token permissions allow `contents: write`.
-   The release workflow uses Gitea Actions' built-in `GITEA_TOKEN`; no extra repository secret is required.
+   The release workflow uses Gitea Actions' built-in `GITEA_TOKEN`, exposed in the workflow as `${{ secrets.GITEA_TOKEN }}`; no extra repository secret is required.
 
 ## Version Bump Checklist
 
@@ -78,13 +78,15 @@ git push origin v1.1.2
 
 The `.gitea/workflows/release.yaml` workflow will:
 
-1. Build `target/release/gosleep-timer`.
+1. Re-run release gates: `cargo fmt --check`, `cargo test --locked`, `cargo clippy --locked -- -D warnings`, and YAML lint.
-2. Package `gosleep-timer-<version>-linux-amd64.tar.gz`.
+2. Build `target/release/gosleep-timer`.
-3. Generate a SHA-256 checksum.
+3. Package `gosleep-timer-<version>-linux-amd64.tar.gz`.
-4. Create a Gitea release.
+4. Generate a SHA-256 checksum.
-5. Upload the archive and checksum as release assets.
+5. Create a Gitea release.
+6. Upload the archive and checksum as release assets.
 
 The workflow is idempotent: if the release already exists, it reuses it and replaces assets with matching names.
+If any lint or test step fails, the build and release job will not run.
 
 ## Manual Asset Build