fix(ci): pass the upload file to curl, not its interpolation

.gitea/workflows/release.yml

@@ -342,7 +342,10 @@ jobs:
               my @cmd = (q{curl}, q{-sS}, q{-o}, q{/dev/null}, q{-w}, q{%{http_code}},
                 q{-H}, qq{Authorization: token $ENV{GITEA_TOKEN}},
                 q{-H}, q{Content-Type: application/octet-stream},
-                q{-X}, q{POST}, q{--data-binary}, qq{@$path},
+                # The @ must not sit inside a qq{} string: there it starts an
+                # array interpolation and the upload body collapses to empty,
+                # which Gitea stores as a 201-created zero-byte attachment.
+                q{-X}, q{POST}, q{--data-binary}, q{@} . $path,
                 qq{$ENV{GITEA_SERVER_URL}/api/v1/repos/$ENV{GITEA_REPOSITORY}/releases/$id/assets?name=$name});
               open(my $curl, q{-|}, @cmd) or die qq{curl: $!};
               my $code = <$curl>;

SECURITY.md

@@ -7,7 +7,7 @@ releases do not receive them.
 
 | Version | Supported |
 |---|---|
-| 0.34.0 | yes |
+| 0.35.0 | yes |
 | older releases | no |
 
 ## Reporting a vulnerability