ci(release): simplify tag pattern and bump action versions

.gitea/workflows/release.yml

@@ -1,8 +1,10 @@
+# Release — Go binaries. Runs on version tags (v1.2.3) pushed to main.
+# Builds the platform matrix, creates the Gitea release, uploads binaries.
 name: Release
 
 on:
   push:
-    tags: ["v*.*.*"]
+    tags: ["v*"]
 
 jobs:
   build:
@@ -26,33 +28,31 @@ jobs:
           - goos: freebsd
             goarch: riscv64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: "1.26"
 
       - name: Download dependencies
         run: go mod download
 
-      - name: Build
+      - name: Validate tag and build
         id: build
         env:
-          REF: ${{ gitea.ref }}
-
+          VERSION: ${{ gitea.ref_name }}
         run: |
           set -euo pipefail
 
-          VERSION="${REF##*/}"
-
-          if [[ ! "$VERSION" =~ ^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$ ]]; then
-            echo "ERROR: expected a semver tag like v1.2.3, got: '$VERSION' (ref: '$REF')"
+          if ! echo "$VERSION" | grep -qE '^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$'; then
+            echo "ERROR: expected a semver tag like v1.2.3, got: '$VERSION'"
             exit 1
           fi
 
           VERSION_NO_V="${VERSION#v}"
           echo "version_no_v=${VERSION_NO_V}" >> "$GITEA_OUTPUT"
 
+          # The tag is the source of truth — inject it into the binary.
           LDFLAGS="-s -w -X sourcedock.dev/petrbalvin/nuntius/internal/version.Version=${VERSION_NO_V}"
           mkdir -p bin
           GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} CGO_ENABLED=0 \
@@ -60,6 +60,7 @@ jobs:
               -o "bin/nuntius-${VERSION_NO_V}-${{ matrix.goos }}-${{ matrix.goarch }}" \
               ./cmd/server
 
+      # Artifacts stay on v3 — v4 detects Gitea as GHES and aborts.
       - name: Upload artifact
         uses: actions/upload-artifact@v3
         with:
@@ -67,6 +68,7 @@ jobs:
           path: bin/nuntius-${{ steps.build.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }}
           if-no-files-found: error
 
+      # Only binaries matching the runner can be smoke-tested.
       - name: Smoke test
         if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
         run: |
@@ -76,8 +78,10 @@ jobs:
   release:
     runs-on: fedora
     needs: build
+    permissions:
+      releases: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Download all artifacts
         uses: actions/download-artifact@v3
@@ -125,16 +129,15 @@ jobs:
             -d "{\"tag_name\":\"${GITEA_REF_NAME}\",\"name\":\"${GITEA_REF_NAME}\",\"body\":${BODY},\"draft\":false,\"prerelease\":false}")
 
           http_code=$(echo "$response" | tail -1)
-          body=$(echo "$response" | sed '$d')
+          payload=$(echo "$response" | sed '$d')
 
           echo "HTTP ${http_code}"
-
           if [ "$http_code" != "201" ]; then
-            echo "Failed to create release: ${body}"
+            echo "Failed to create release: ${payload}"
             exit 1
           fi
 
-          RELEASE_ID=$(echo "$body" | grep -oE '"id"[[:space:]]*:[[:space:]]*[0-9]+' | head -1 | grep -oE '[0-9]+')
+          RELEASE_ID=$(echo "$payload" | grep -oE '"id"[[:space:]]*:[[:space:]]*[0-9]+' | head -1 | grep -oE '[0-9]+')
           echo "Created release ID=${RELEASE_ID}"
           printf '%s' "${RELEASE_ID}" > release-id.txt