From d9b7a53ac2539ef887dad5ddf795ced3e7a9cc99 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Balv=C3=ADn?= <opensource@petrbalvin.org>
Date: Sun, 26 Jul 2026 23:35:30 +0200
Subject: [PATCH] ci(release): fix tag env, upgrade actions, add release
 permissions

---
 .gitea/workflows/release.yml | 41 +++++++++++++++---------------------
 .gitea/workflows/test.yml    |  9 +++++---
 pyproject.toml               |  2 +-
 3 files changed, 24 insertions(+), 28 deletions(-)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 2d45c65..3866e81 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -1,3 +1,6 @@
+# Release — Python package. Runs on version tags (v1.2.3) pushed to main.
+# Creates a Gitea release with wheel + sdist and publishes to PyPI.
+# Requires a PYPI_TOKEN secret (project-scoped upload token).
 name: Release
 
 on:
@@ -7,26 +10,27 @@ on:
 jobs:
   release:
     runs-on: fedora
+    permissions:
+      releases: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Python and uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
         with:
-          python-version: "3.14"
+          python-version: "3.14" # match requires-python in pyproject.toml
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 
       - name: Resolve and verify version
         id: version
         env:
-          REF: ${{ gitea.ref }}
+          VERSION: ${{ gitea.ref_name }}
         run: |
           set -euo pipefail
 
-          VERSION="${REF##*/}"
-          if [[ ! "$VERSION" =~ ^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$ ]]; then
-            echo "ERROR: expected a semver tag like v1.2.3, got: '$VERSION' (ref: '$REF')"
+          if ! echo "$VERSION" | grep -qE '^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$'; then
+            echo "ERROR: expected a semver tag like v1.2.3, got: '$VERSION'"
             exit 1
           fi
 
@@ -81,6 +85,7 @@ jobs:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_REF_NAME: ${{ gitea.ref_name }}
         run: |
           set -euo pipefail
           BODY="$(python -c 'import json,sys; print(json.dumps(sys.stdin.read()))' < release-body.md)"
@@ -90,18 +95,12 @@ jobs:
             -H "Content-Type: application/json" \
             -X POST \
             "${GITEA_SERVER_URL}/api/v1/repos/${GITEA_REPOSITORY}/releases" \
-            -d "{
-              \"tag_name\": \"$GITHUB_REF_NAME\",
-              \"name\": \"$GITHUB_REF_NAME\",
-              \"body\": ${BODY},
-              \"draft\": false,
-              \"prerelease\": false
-            }")"
+            -d "{\"tag_name\":\"${GITEA_REF_NAME}\",\"name\":\"${GITEA_REF_NAME}\",\"body\":${BODY},\"draft\":false,\"prerelease\":false}")"
 
           http_code="$(echo "$response" | tail -1)"
           payload="$(echo "$response" | sed '$d')"
-          echo "HTTP ${http_code}"
 
+          echo "HTTP ${http_code}"
           if [ "$http_code" != "201" ]; then
             echo "Failed to create release: ${payload}"
             exit 1
@@ -114,10 +113,10 @@ jobs:
       - name: Upload wheel and sdist assets
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          VERSION_NO_V: ${{ steps.version.outputs.version_no_v }}
-          RELEASE_ID: ${{ steps.create.outputs.release_id }}
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
+          VERSION_NO_V: ${{ steps.version.outputs.version_no_v }}
+          RELEASE_ID: ${{ steps.create.outputs.release_id }}
         run: |
           set -euo pipefail
           for ASSET in "volumen-${VERSION_NO_V}-py3-none-any.whl" \
@@ -140,13 +139,7 @@ jobs:
             fi
           done
 
-          echo "Release $GITHUB_REF_NAME is live with wheel + sdist."
-
-      # Publish to PyPI (only on tag push). Requires `PYPI_TOKEN` in repo
-      # secrets (project-scoped upload token from https://pypi.org/manage/account/publishing/).
       - name: Publish to PyPI
-        if: ${{ startsWith(gitea.ref_name, 'v') }}
         env:
           UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}
-        run: |
-          uv publish
+        run: uv publish
diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 3372506..bf4be7b 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -1,3 +1,6 @@
+# Test — Python. Runs on push and pull request to development. Never on main.
+# The 80 % coverage gate lives in pyproject.toml (addopts --cov-fail-under=80),
+# so `uv run pytest` enforces it here exactly as it does locally.
 name: Test
 
 on:
@@ -11,12 +14,12 @@ jobs:
   test:
     runs-on: fedora
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Python and uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
         with:
-          python-version: "3.14"
+          python-version: "3.14" # match requires-python in pyproject.toml
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 
diff --git a/pyproject.toml b/pyproject.toml
index 1a1c4eb..21dc7b0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -10,7 +10,7 @@ readme = "README.md"
 keywords = ["blog", "markdown", "fastapi", "cms", "static-blog", "toml", "rss", "json-feed", "engine"]
 requires-python = ">=3.14"
 license = {text = "MIT"}
-authors = [{name = "Petr Balvín", email = "petrbalvin@yandex.com"}]
+authors = [{name = "Petr Balvín", email = "opensource@petrbalvin.org"}]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Environment :: Web Environment",