Update dependency actions/forgejo-release to v2.11.1 (#146)

Reviewed-on: https://code.forgejo.org/actions/forgejo-release/pulls/146
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>

.editorconfig

@@ -8,3 +8,6 @@ end_of_line = lf
 charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
+
+[*.yml]
+indent_size = 2

.forgejo/workflows/integration.yml

@@ -1,16 +1,24 @@
-on: [ pull_request, push ]
+on:
+  pull_request:
+  push:
+    branches:
+      - "**"
+
+env:
+  FORGEJO_VERSION: 11.0.10 # renovate: datasource=docker depName=data.forgejo.org/forgejo/forgejo
+
 jobs:
   integration:
-    runs-on: self-hosted
+    runs-on: lxc-trixie
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
 
       - id: forgejo
-        uses: https://code.forgejo.org/actions/setup-forgejo@v2.0.2
+        uses: https://code.forgejo.org/actions/setup-forgejo@v3.1.6
         with:
           user: testuser
           password: admin1234
-          image-version: 9
+          image-version: ${{ env.FORGEJO_VERSION }}
 
       - name: push self
         run: |
@@ -24,18 +32,53 @@ jobs:
 
           set -ex
           export FORGEJO="${{ steps.forgejo.outputs.url }}"
-          curl --fail -sS $FORGEJO/api/v1/repos/testuser/upload-download/releases/tags/v2.0 > /tmp/release.json
+          curl --fail -sS $FORGEJO/api/v1/repos/testuser/upload-download/releases/tags/v2.0 > /tmp/v2.json
           EXPECTED='No shell expansion should on these notes:
           - $(some_command)
           - `other_commend`
           - "double quoted" and '\''single quoted'\'' strings
           - \backslash escape
           - !exclamation_mark'
-          test "$EXPECTED" = "$(jq -r .body < /tmp/release.json)"
+          test "$EXPECTED" = "$(jq -r .body < /tmp/v2.json)"
+
+          test $(cat /tmp/v2.json | jq -r .hide_archive_links) = false
 
           curl --fail -sS $FORGEJO/api/v1/repos/testuser/upload-download/releases/tags/v1.0 > /tmp/v1.json
           cat /tmp/v1.json | jq -r .body | grep '<!--start release-notes-assistant-->'
 
+          test $(cat /tmp/v1.json | jq -r .hide_archive_links) = true
+
+      - name: testdata/release-notes-file
+        run: |
+          export LOOP_DELAY=30
+          export FORGEJO_RUNNER_LOGS="${{ steps.forgejo.outputs.runner-logs }}"
+          forgejo-test-helper.sh run_workflow testdata/release-notes-file http://testuser:admin1234@${{ steps.forgejo.outputs.host-port }} testuser release-notes-file forgejo-release "${{ steps.forgejo.outputs.token }}"
+
+          set -ex
+          export FORGEJO="${{ steps.forgejo.outputs.url }}"
+          curl --fail -sS $FORGEJO/api/v1/repos/testuser/release-notes-file/releases/tags/v1.0 > /tmp/v1.json
+          curl --fail -sS $FORGEJO/api/v1/repos/testuser/release-notes-file/releases/tags/v2.0 > /tmp/v2.json
+          curl --fail -sS $FORGEJO/api/v1/repos/testuser/release-notes-file/releases/tags/v3.0 > /tmp/v3.json
+
+          EXPECTED='# This is a Release Note
+
+          Some *formatted*,
+
+          multiline
+
+          Markdown content.
+
+          ```bash
+          echo "Even a code block"
+          ```'
+          test "$EXPECTED" = "$(jq -r .body < /tmp/v1.json)"
+
+          test "$EXPECTED" = "$(jq -r .body < /tmp/v2.json)"
+          test "I wont be there" != "$(jq -r .body < /tmp/v2.json)"
+
+          test "$EXPECTED" != "$(jq -r .body < /tmp/v3.json)"
+          test "I will be there" = "$(jq -r .body < /tmp/v3.json)"
+
       - name: testdata/upload-download-private
         run: |
           export LOOP_DELAY=30
@@ -57,5 +100,11 @@ jobs:
           export VERBOSE=true
           testdata/forgejo-release-test.sh test_run testuser otherrepo
 
-      - if: failure()
-        run: docker logs forgejo
+      - if: always()
+        name: "[RUNNER] and [FORGEJO] logs"
+        run: |
+          runner_logs="${{ steps.forgejo.outputs.runner-logs }}"
+          if test -f "$runner_logs"; then
+            sed -e 's/^/[RUNNER] /' < $runner_logs
+          fi
+          docker logs forgejo | sed -e 's/^/[FORGEJO] /'

.forgejo/workflows/release.yml

@@ -0,0 +1,23 @@
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  publish:
+    runs-on: docker
+
+    steps:
+      # needs to be in a different dir, so binary and rna cache don't conflict
+      - uses: https://data.forgejo.org/actions/checkout@v6
+        with:
+          path: forgejo-release
+
+      - name: publish release
+        uses: ./forgejo-release
+        with:
+          direction: upload
+          override: ${{ vars.OVERRIDE || 'false' }}
+          verbose: ${{ vars.VERBOSE || 'false' }}
+          release-notes-assistant: true
+          skip-assets: true

.forgejo/workflows/tests.yml

@@ -1,9 +1,26 @@
-on: [ pull_request, push ]
+on:
+  pull_request:
+  push:
+    branches:
+      - '**'
+
 jobs:
-  integration:
+  tests:
     runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:24-trixie
+
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
+
+      - name: lint action-docs
+        run: |
+          npx --yes action-docs -u
+          git diff --quiet || {
+            echo "[ERROR] Please apply the changes action-docs suggests:"
+            git diff --color=always
+            exit 1
+          }
 
       - name: Unit tests of the supporting script forgejo-release.sh
         run: |

.gitignore

@@ -1 +1,2 @@
 *~
+.idea

README.md

@@ -10,14 +10,15 @@ Upload or download the assets of a release to a Forgejo instance.
 
 | name | description | required | default |
 | --- | --- | --- | --- |
-| `url` | <p>URL of the Forgejo instance</p> | `false` | `""` |
-| `repo` | <p>owner/project relative to the URL</p> | `false` | `""` |
-| `tag` | <p>Tag of the release</p> | `false` | `""` |
+| `url` | <p>URL of the Forgejo instance</p> | `false` | `${{ env.FORGEJO_SERVER_URL }}` |
+| `repo` | <p>owner/project relative to the URL</p> | `false` | `${{ forge.repository }}` |
+| `tag` | <p>Tag of the release</p> | `false` | `${{ forge.ref_name }}` |
 | `title` | <p>Title of the release (defaults to tag)</p> | `false` | `""` |
-| `sha` | <p>SHA of the release</p> | `false` | `""` |
-| `token` | <p>Forgejo application token</p> | `true` | `""` |
-| `release-dir` | <p>Directory in whichs release assets are uploaded or downloaded</p> | `true` | `""` |
+| `sha` | <p>SHA of the release</p> | `false` | `${{ forge.sha }}` |
+| `token` | <p>Forgejo application token (must have <code>write:repository</code>)</p> | `false` | `${{ forge.token }}` |
+| `release-dir` | <p>Directory in which release assets are uploaded or downloaded</p> | `false` | `dist/release` |
 | `release-notes` | <p>Release notes</p> | `false` | `""` |
+| `release-notes-file` | <p>Path to a file containing your release notes (takes priority over <code>release-notes</code>)</p> | `false` | `""` |
 | `direction` | <p>Can either be <code>download</code> or <code>upload</code></p> | `true` | `""` |
 | `gpg-private-key` | <p>GPG Private Key to sign the release artifacts</p> | `false` | `""` |
 | `gpg-passphrase` | <p>Passphrase of the GPG Private Key</p> | `false` | `""` |
@@ -27,6 +28,8 @@ Upload or download the assets of a release to a Forgejo instance.
 | `override` | <p>Override an existing release by the same <code>{tag}</code></p> | `false` | `false` |
 | `prerelease` | <p>Mark Release as Pre-Release</p> | `false` | `false` |
 | `release-notes-assistant` | <p>Generate release notes with Release Notes Assistant</p> | `false` | `false` |
+| `hide-archive-link` | <p>Hide the archive links</p> | `false` | `false` |
+| `skip-assets` | <p>Skip uploading release assets</p> | `false` | `false` |
 <!-- action-docs-inputs source="action.yml" -->
 
 ## Examples
@@ -36,43 +39,66 @@ Upload or download the assets of a release to a Forgejo instance.
 Upload the release located in `release-dir` to the release section of a repository (`url` and `repo`):
 
 ```yaml
-on: [tag]
 jobs:
   upload-release:
-    runs-on: ubuntu-latest
+    runs-on: docker
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/forgejo-release@v2
+      - uses: actions/checkout@v4
+      - uses: actions/forgejo-release@v2.11.1
         with:
           direction: upload
-          url: https://code.forgejo.org
+          url: https://my-forgejo-instance.net
+          repo: myuser/myrepo
+          token: ${{ secrets.WRITE_TOKEN_TO_MYREPO }}
+          tag: v1.0.0
           release-dir: dist/release
           release-notes: "MY RELEASE NOTES"
 ```
 
+Upload a release with custom release notes located in a file:
+
+```yaml
+jobs:
+  upload-release:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+      - name: Generate Changelog
+        run: ./generate-changelog.sh > dist/changelog.md
+      - uses: actions/forgejo-release@v2.11.1
+        with:
+          direction: upload
+          url: https://my-forgejo-instance.net
+          repo: myuser/myrepo
+          token: ${{ secrets.WRITE_TOKEN_TO_MYREPO }}
+          tag: v13.0.2
+          release-dir: dist/release
+          release-notes-file: dist/changelog.md
+```
+
 ### Download
 
 Example downloading the forgejo release v1.21.4-0 into the working directory:
 
 ```yaml
-on: [tag]
 jobs:
   download-release:
-    runs-on: ubuntu-latest
+    runs-on: docker
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/forgejo-release@v2
+      - uses: actions/checkout@v4
+      - uses: actions/forgejo-release@v2.11.1
         with:
           direction: download
-          url: https://code.forgejo.org
-          repo: forgejo/forgejo
-          tag: v1.21.4-0
+          url: https://my-forgejo-instance.net
+          repo: myuser/myrepo
+          token: ${{ secrets.READ_TOKEN_TO_MYREPO }}
+          tag: v1.0.0
           release-dir: ./  # by default, files are downloaded into dist/release
 ```
 
 ### Real world example
 
-This action is used to [publish](https://code.forgejo.org/forgejo/release-notes-assistant/src/branch/main/.forgejo/workflows/release.yml) the release notes assistant assets.
+This action is used to [publish](https://code.forgejo.org/forgejo/release-notes-assistant/src/commit/09f2c22d80d5ee655783cfeb2c1d4bab4afec3e4/.forgejo/workflows/release.yml) the release notes assistant assets.
 
 ## Update the `input` section of the README
 
@@ -80,5 +106,5 @@ Using [action-docs](https://github.com/npalm/action-docs):
 
 ```shell
 # Edit the action.yml file and run:
-action-docs --update-readme
+npx action-docs --update-readme
 ```

action.yml

@@ -6,22 +6,28 @@ description: |
 inputs:
   url:
     description: 'URL of the Forgejo instance'
+    default: '${{ env.FORGEJO_SERVER_URL }}'
   repo:
     description: 'owner/project relative to the URL'
+    default: '${{ forge.repository }}'
   tag:
     description: 'Tag of the release'
+    default: '${{ forge.ref_name }}'
   title:
     description: 'Title of the release (defaults to tag)'
   sha:
     description: 'SHA of the release'
+    default: '${{ forge.sha }}'
   token:
-    description: 'Forgejo application token'
-    required: true
+    description: 'Forgejo application token (must have `write:repository`)'
+    default: '${{ forge.token }}'
   release-dir:
-    description: 'Directory in whichs release assets are uploaded or downloaded'
-    required: true
+    description: 'Directory in which release assets are uploaded or downloaded'
+    default: 'dist/release'
   release-notes:
     description: 'Release notes'
+  release-notes-file:
+    description: 'Path to a file containing your release notes (takes priority over `release-notes`)'
   direction:
     description: 'Can either be `download` or `upload`'
     required: true
@@ -46,17 +52,26 @@ inputs:
   release-notes-assistant:
     description: 'Generate release notes with Release Notes Assistant'
     default: 'false'
+  hide-archive-link:
+    description: 'Hide the archive links'
+    default: 'false'
+  skip-assets:
+    description: Skip uploading release assets
+    default: 'false'
 
 runs:
   using: "composite"
   steps:
-    - run: echo "${{ github.action_path }}" >> $GITHUB_PATH
+    - if: ${{ inputs.release-notes-assistant }}
+      uses: actions/cache@v4
+      with:
+        key: rna-${{ inputs.repo }}
+        path: ${{ forge.action_path }}/rna
+
+    - run: echo "${{ forge.action_path }}" >> $FORGEJO_PATH
       shell: bash
     - run: |
         export FORGEJO="${{ inputs.url }}"
-        if test -z "$FORGEJO"; then
-          export FORGEJO="${{ env.GITHUB_SERVER_URL }}"
-        fi
         # A trailing / will mean http://forgejo//api/v1 is used
         # and it always 401 as of v1.19, because of the double slash
         FORGEJO=${FORGEJO%%/}
@@ -64,17 +79,8 @@ runs:
         export HOST=${FORGEJO#*://}
 
         export REPO="${{ inputs.repo }}"
-        if test -z "$REPO"; then
-          export REPO="${{ github.repository }}"
-        fi
 
         export TAG="${{ inputs.tag }}"
-        if test -z "$TAG"; then
-          export TAG="${{ github.ref_name }}"
-          # until https://code.forgejo.org/forgejo/runner/issues/9 is fixed
-          # trim refs/tags/
-          TAG=${TAG##refs/tags/}
-        fi
 
         export TITLE="${{ inputs.title }}"
 
@@ -83,8 +89,11 @@ runs:
         export PRERELEASE="${{ inputs.prerelease }}"
 
         export RELEASE_NOTES_ASSISTANT="${{ inputs.release-notes-assistant }}"
+        export RELEASE_NOTES_ASSISTANT_WORKDIR=${{ forge.action_path }}/rna
 
-        export TOKEN="${{ inputs.token }}"
+        export HIDE_ARCHIVE_LINK="${{ inputs.hide-archive-link }}"
+
+        export TOKEN=${{ inputs.token }}
 
         export RELEASE_DIR="${{ inputs.release-dir }}"
 
@@ -93,11 +102,18 @@ runs:
         EOF
         )
 
-        export SHA="${{ inputs.sha }}"
-        if test -z "$SHA"; then
-          export SHA="${{ github.sha }}"
+        RELEASENOTES_FILE="${{ inputs.release-notes-file }}"
+        if [ ! -z "$RELEASENOTES_FILE" ]; then
+          if [ ! -f "$RELEASENOTES_FILE" ]; then
+            echo "! Release notes file $RELEASENOTES_FILE does not exist."
+            exit 1
+          fi
+
+          export RELEASENOTES=$(cat "$RELEASENOTES_FILE")
         fi
 
+        export SHA="${{ inputs.sha }}"
+
         export OVERRIDE="${{ inputs.override }}"
 
         export VERBOSE="${{ inputs.verbose }}"
@@ -112,5 +128,7 @@ runs:
         echo -n "${{ inputs.gpg-passphrase }}" > $TMP_DIR/gpg-passphrase
         export GPG_PASSPHRASE="$TMP_DIR/gpg-passphrase"
 
+        export SKIP_ASSETS="${{ inputs.skip-assets }}"
+
         forgejo-release.sh ${{ inputs.direction }}
       shell: bash

forgejo-release.sh

@@ -12,54 +12,98 @@ if ${VERBOSE:-false}; then set -x; fi
 : ${DOWNLOAD_LATEST:=false}
 : ${TMP_DIR:=$(mktemp -d)}
 : ${GNUPGHOME:=$TMP_DIR}
-: ${BIN_DIR:=$TMP_DIR}
-: ${TEA_VERSION:=0.9.0}
 : ${OVERRIDE:=false}
+: ${HIDE_ARCHIVE_LINK:=false}
 : ${RETRY:=1}
 : ${DELAY:=10}
+: ${SKIP_ASSETS:=false}
+
+RELEASE_NOTES_ASSISTANT_VERSION=v1.6.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org
+
+TAG_FILE="$TMP_DIR/tag$$.json"
+TAG_URL=$(echo "$TAG" | sed 's/\//%2F/g')
 
 export GNUPGHOME
 
-setup_tea() {
-    if ! test -f $BIN_DIR/tea ; then
-	ARCH=$(dpkg --print-architecture)
-	curl -sL https://dl.gitea.io/tea/$TEA_VERSION/tea-$TEA_VERSION-linux-$ARCH > $BIN_DIR/tea
-	chmod +x $BIN_DIR/tea
+get_tag() {
+    if ! test -f "$TAG_FILE"; then
+        if api_json GET repos/$REPO/tags/"$TAG_URL" >"$TAG_FILE"; then
+            echo "tag $TAG exists"
+        else
+            echo "tag $TAG does not exists"
+        fi
+    fi
+    test -s "$TAG_FILE"
+}
+
+matched_tag() {
+    if get_tag; then
+        local sha=$(jq --raw-output .commit.sha <"$TAG_FILE")
+        test "$sha" = "$SHA"
+    else
+        return 1
     fi
 }
 
 ensure_tag() {
-    if api GET repos/$REPO/tags/$TAG > $TMP_DIR/tag.json ; then
-	local sha=$(jq --raw-output .commit.sha < $TMP_DIR/tag.json)
-	if test "$sha" != "$SHA" ; then
-	    cat $TMP_DIR/tag.json
-	    echo "the tag SHA in the $REPO repository does not match the tag SHA that triggered the build: $SHA"
-	    false
-	fi
+    if get_tag; then
+        if ! matched_tag; then
+            cat "$TAG_FILE"
+            echo "the tag SHA in the $REPO repository does not match the tag SHA that triggered the build: $SHA"
+            return 1
+        fi
     else
-	api POST repos/$REPO/tags --data-raw '{"tag_name": "'$TAG'", "target": "'$SHA'"}'
+        create_tag
+    fi
+}
+
+create_tag() {
+    api_json POST repos/$REPO/tags --data-raw '{"tag_name": "'"$TAG"'", "target": "'"$SHA"'"}' >"$TAG_FILE"
+}
+
+delete_tag() {
+    if get_tag; then
+        api_json DELETE repos/$REPO/tags/"$TAG_URL"
+        rm -f "$TAG_FILE"
     fi
 }
 
 upload_release() {
-    local assets=$(ls $RELEASE_DIR/* | sed -e 's/^/-a /')
-    if $PRERELEASE || echo "${TAG}" | grep -qi '\-rc' ; then
-        releasetype="--prerelease"
+    if $PRERELEASE || echo "${TAG}" | grep -qi '\-rc'; then
+        prerelease="true"
         echo "Uploading as Pre-Release"
     else
+        prerelease="false"
         echo "Uploading as Stable"
     fi
     ensure_tag
-    anchor=$(echo $TAG | sed -e 's/^v//' -e 's/[^a-zA-Z0-9]/-/g')
-    if ! $BIN_DIR/tea release create $assets --repo $REPO --note "$RELEASENOTES" --tag $TAG --title "$TITLE" --draft ${releasetype} >& $TMP_DIR/tea.log ; then
-        if grep --quiet 'Unknown API Error: 500' $TMP_DIR/tea.log && grep --quiet services/release/release.go:194 $TMP_DIR/tea.log ; then
-            echo "workaround v1.20 race condition https://codeberg.org/forgejo/forgejo/issues/1370"
-            sleep 10
-            $BIN_DIR/tea release create $assets --repo $REPO --note "$RELEASENOTES" --tag $TAG --title "$TITLE" --draft ${releasetype}
-        else
-            cat $TMP_DIR/tea.log
-            return 1
+    jq -n --arg title "$TITLE" --arg body "$RELEASENOTES" --arg tag "$TAG" --arg pre $prerelease '{"draft": true, "name": $title, "body": $body, "prerelease": $pre | test("true"), "tag_name": $tag }' >"$TMP_DIR"/release-payload.json
+    if ${VERBOSE:-false}; then
+        echo "Payload:"
+        cat "$TMP_DIR"/release-payload.json | jq
+    fi
+    if ! api_json POST repos/$REPO/releases -d @"$TMP_DIR"/release-payload.json >"$TMP_DIR"/release.json; then
+        if ${VERBOSE:-false}; then
+            echo "Response:"
+            cat "$TMP_DIR"/release.json | jq
         fi
+        exit 1
+    fi
+    if [ "$SKIP_ASSETS" == 'false' ]; then
+        release_id=$(jq --raw-output .id <"$TMP_DIR"/release.json)
+        for file in "$RELEASE_DIR"/*; do
+            # https://dev.to/pkutaj/how-to-use-jq-for-uri-encoding-2o5
+            # https://unix.stackexchange.com/questions/94295/shellcheck-is-advising-not-to-use-basename-why/94307#94307
+            # url encode some chars
+            asset_name="$(echo -n "${file##*/}" | jq -sRr @uri)"
+            if ! api POST "repos/$REPO/releases/$release_id/assets?name=$asset_name" -H "Content-Type: multipart/form-data" -F "attachment=@$file" >"$TMP_DIR/release-$asset_name.json"; then
+                if ${VERBOSE:-false}; then
+                    echo "Response:"
+                    cat "$TMP_DIR/release-$asset_name.json" | jq
+                fi
+                exit 1
+            fi
+        done
     fi
     maybe_use_release_note_assistant
     release_draft false
@@ -68,109 +112,115 @@ upload_release() {
 release_draft() {
     local state="$1"
 
-    local id=$(api GET repos/$REPO/releases/tags/$TAG | jq --raw-output .id)
-    api PATCH repos/$REPO/releases/$id --data-raw '{"draft": '$state'}'
+    local id=$(api_json GET repos/$REPO/releases/tags/"$TAG_URL" | jq --raw-output .id)
+
+    api_json PATCH repos/$REPO/releases/"$id" --data-raw '{"draft": '"$state"', "hide_archive_links": '$HIDE_ARCHIVE_LINK'}'
 }
 
 maybe_use_release_note_assistant() {
     if "$RELEASE_NOTES_ASSISTANT"; then
-        curl --fail -s -S -o rna https://code.forgejo.org/forgejo/release-notes-assistant/releases/download/v1.2.3/release-notes-assistant
+        curl --fail -s -S -o rna https://code.forgejo.org/forgejo/release-notes-assistant/releases/download/$RELEASE_NOTES_ASSISTANT_VERSION/release-notes-assistant
         chmod +x ./rna
-        ./rna --storage release --storage-location $TAG --forgejo-url $SCHEME://placeholder:$TOKEN@$HOST --repository $REPO --token $TOKEN release $TAG
+        mkdir -p $RELEASE_NOTES_ASSISTANT_WORKDIR
+        ./rna --workdir=$RELEASE_NOTES_ASSISTANT_WORKDIR --storage release --storage-location "$TAG" --token "$TOKEN" --forgejo-url "$SCHEME://$HOST" --repository $REPO --token "$TOKEN" release "$TAG"
     fi
 }
 
 sign_release() {
     local passphrase
     if test -s "$GPG_PASSPHRASE"; then
-	passphrase="--passphrase-file $GPG_PASSPHRASE"
+        passphrase="--passphrase-file $GPG_PASSPHRASE"
     fi
     gpg --import --no-tty --pinentry-mode loopback $passphrase "$GPG_PRIVATE_KEY"
-    for asset in $RELEASE_DIR/* ; do
-	if [[ $asset =~ .sha256$ ]] ; then
-	    continue
-	fi
-	gpg --armor --detach-sign --no-tty --pinentry-mode loopback $passphrase < $asset > $asset.asc
+    for asset in "$RELEASE_DIR"/*; do
+        if [[ $asset =~ .sha256$ ]]; then
+            continue
+        fi
+        gpg --armor --detach-sign --no-tty --pinentry-mode loopback $passphrase <"$asset" >"$asset".asc
     done
 }
 
 maybe_sign_release() {
     if test -s "$GPG_PRIVATE_KEY"; then
-	sign_release
+        sign_release
     fi
 }
 
 maybe_override() {
     if test "$OVERRIDE" = "false"; then
-	return
+        return
+    fi
+    api_json DELETE repos/$REPO/releases/tags/"$TAG_URL" >&/dev/null || true
+    if get_tag && ! matched_tag; then
+        delete_tag
     fi
-    api DELETE repos/$REPO/releases/tags/$TAG >& /dev/null || true
-    api DELETE repos/$REPO/tags/$TAG >& /dev/null || true
 }
 
 upload() {
     setup_api
-    setup_tea
-    rm -f ~/.config/tea/config.yml
-    GITEA_SERVER_TOKEN=$TOKEN $BIN_DIR/tea login add --url $FORGEJO
     maybe_sign_release
     maybe_override
     upload_release
 }
 
 setup_api() {
-    if ! which jq curl ; then
-	apt-get -qq update
-	apt-get install -y -qq jq curl
+    if ! which jq curl; then
+        apt-get -qq update
+        apt-get install -y -qq jq curl
     fi
 }
 
+api_json() {
+    api "$@" -H "Content-Type: application/json"
+}
+
 api() {
     method=$1
     shift
     path=$1
     shift
 
-    curl --fail -X $method -sS -H "Content-Type: application/json" -H "Authorization: token $TOKEN" "$@" $FORGEJO/api/v1/$path
+    curl --retry 5 --fail -X "$method" -sS -H "Authorization: token $TOKEN" "$@" $FORGEJO/api/v1/"$path"
 }
 
 wait_release() {
     local ready=false
     for i in $(seq $RETRY); do
-	if api GET repos/$REPO/releases/tags/$TAG | jq --raw-output .draft > $TMP_DIR/draft; then
-	    if test "$(cat $TMP_DIR/draft)" = "false"; then
-		ready=true
-		break
-	    fi
-	    echo "release $TAG is still a draft"
-	else
-	    echo "release $TAG does not exist yet"
-	fi
-	echo "waiting $DELAY seconds"
-	sleep $DELAY
+        if api_json GET repos/$REPO/releases/tags/"$TAG_URL" | jq --raw-output .draft >"$TMP_DIR"/draft; then
+            if test "$(cat "$TMP_DIR"/draft)" = "false"; then
+                ready=true
+                break
+            fi
+            echo "release $TAG is still a draft"
+        else
+            echo "release $TAG does not exist yet"
+        fi
+        echo "waiting $DELAY seconds"
+        sleep $DELAY
     done
-    if ! $ready ; then
-	echo "no release for $TAG"
-	return 1
+    if ! $ready; then
+        echo "no release for $TAG"
+        return 1
     fi
 }
 
 download() {
     setup_api
     (
-	mkdir -p $RELEASE_DIR
-	cd $RELEASE_DIR
-    if [[ ${DOWNLOAD_LATEST} == "true" ]] ; then
-        echo "Downloading the latest release"
-        api GET repos/$REPO/releases/latest > $TMP_DIR/assets.json
-    elif [[ ${DOWNLOAD_LATEST} == "false" ]] ; then
-        wait_release
-        echo "Downloading tagged release ${TAG}"
-	    api GET repos/$REPO/releases/tags/$TAG > $TMP_DIR/assets.json
-    fi
-	jq --raw-output '.assets[] | "\(.name) \(.browser_download_url)"' < $TMP_DIR/assets.json | while read name url ; do
-	    curl --fail -H "Authorization: token $TOKEN" -o $name -L $url
-	done
+        mkdir -p $RELEASE_DIR
+        cd $RELEASE_DIR
+        if [[ ${DOWNLOAD_LATEST} = "true" ]]; then
+            echo "Downloading the latest release"
+            api_json GET repos/$REPO/releases/latest >"$TMP_DIR"/assets.json
+        elif [[ ${DOWNLOAD_LATEST} == "false" ]]; then
+            wait_release
+            echo "Downloading tagged release ${TAG}"
+            api_json GET repos/$REPO/releases/tags/"$TAG_URL" >"$TMP_DIR"/assets.json
+        fi
+        jq --raw-output '.assets[] | "\(.browser_download_url) \(.name)"' <"$TMP_DIR"/assets.json | while read url name; do # `name` may contain whitespace, therefore, it must be last
+            url=$(echo "$url" | sed "s#/download/${TAG}/#/download/${TAG_URL}/#")
+            curl --fail -H "Authorization: token $TOKEN" -o "$name" -L "$url"
+        done
     )
 }
 

renovate.json

@@ -0,0 +1,30 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": [
+        "local>actions/renovate-config"
+    ],
+    "packageRules": [
+        {
+            "description": "separate multiple major and minor for forgejo",
+            "matchDepNames": ["code.forgejo.org/forgejo/forgejo"],
+            "separateMultipleMajor": true,
+            "separateMultipleMinor": true
+        }
+    ],
+    "customManagers": [
+        {
+            "customType": "regex",
+            "description": "update example in README.md",
+            "managerFilePatterns": [
+                "/^README.md$/"
+            ],
+            "matchStrings": [
+                "uses: actions/forgejo-release@(?<currentValue>v\\d+\\.\\d+\\.\\d+)"
+            ],
+            "datasourceTemplate": "gitea-tags",
+            "depNameTemplate": "actions/forgejo-release",
+            "versioningTemplate": "semver",
+            "registryUrlTemplate": "https://code.forgejo.org"
+        }
+    ]
+}

testdata/forgejo-release-test.sh

@@ -2,20 +2,19 @@
 # SPDX-License-Identifier: MIT
 
 set -ex
+PS4='${BASH_SOURCE[0]}:$LINENO: ${FUNCNAME[0]}:  '
 
 test_teardown() {
     setup_api
-    api DELETE repos/$REPO/releases/tags/$TAG || true
-    api DELETE repos/$REPO/tags/$TAG || true
+    api_json DELETE repos/$REPO/releases/tags/$TAG || true
+    api_json DELETE repos/$REPO/tags/$TAG || true
     rm -fr dist/release
-    setup_tea
-    $BIN_DIR/tea login delete $DOER || true
 }
 
 test_reset_repo() {
     local project="$1"
-    api DELETE repos/$REPO || true
-    api POST user/repos --data-raw '{"name":"'$project'", "auto_init":true}'
+    api_json DELETE repos/$REPO || true
+    api_json POST user/repos --data-raw '{"name":"'$project'", "auto_init":true}'
     git clone $FORGEJO/$REPO $TMP_DIR/repo
     SHA=$(git -C $TMP_DIR/repo rev-parse HEAD)
 }
@@ -38,24 +37,37 @@ test_wait_release() {
     ! wait_release
 }
 
+test_create_delete_tag() {
+    delete_tag
+
+    ! get_tag
+    create_tag
+    get_tag
+    delete_tag
+    ! get_tag
+}
+
 test_ensure_tag() {
-    api DELETE repos/$REPO/tags/$TAG || true
+    delete_tag
     #
     # idempotent
     #
     ensure_tag
-    api GET repos/$REPO/tags/$TAG > $TMP_DIR/tag1.json
+    mv $TAG_FILE $TMP_DIR/tag1.json
+
     ensure_tag
-    api GET repos/$REPO/tags/$TAG > $TMP_DIR/tag2.json
+    mv $TAG_FILE $TMP_DIR/tag2.json
+
     diff -u $TMP_DIR/tag[12].json
     #
     # sanity check on the SHA of an existing tag
     #
     (
-	SHA=12345
-	! ensure_tag
+        SHA=12345
+        ! matched_tag
+        ! ensure_tag
     )
-    api DELETE repos/$REPO/tags/$TAG
+    delete_tag
 }
 
 test_maybe_sign_release_no_gpg() {
@@ -94,8 +106,8 @@ test_maybe_sign_release_skipped() {
 }
 
 test_maybe_sign_release_verify() {
-    for file in  $RELEASE_DIR/file-one.txt  $RELEASE_DIR/file-two.txt; do
-	gpg --verify $file.asc $file
+    for file in $RELEASE_DIR/file-one.txt $RELEASE_DIR/file-two.txt; do
+        gpg --verify $file.asc $file
     done
 }
 
@@ -129,6 +141,7 @@ test_run() {
     REPO=$user/$project
     test_setup $project
     test_ensure_tag
+    test_create_delete_tag
     DELAY=0
     test_wait_release_fail
     echo "================================ TEST BEGIN"

testdata/gpg-private-no-passphrase.asc

@@ -1,81 +1,81 @@
 -----BEGIN PGP PRIVATE KEY BLOCK-----
 
-lQVYBGRwcNcBDADUZUxCbjw0hOtMaLIYhEbgYFR2Oyxz8IDJTVALuLGQbHnLM6La
-IVxGwk9CgxX8vP9pN3Fy+uX+KInV41bLGd30qPDvqCuAbAo4bAT0Sg/fN3A7fuSX
-KfUStJbY3OyQZQbHWxOpsyIziIqBMXipgFQD/IncRMhWjcQh4znnkUb+e3oj1/f1
-9eErwfgsiDsj7M/FSWolrwttd2VQah+WumhVFjvb+M4j5zI9UBNGNsVCTxQXTN5L
-MtPJuypuMzawmTvUNm7470VDgO/dCWGlZ7gshoNd2fNnFCMgTSWYu9C8zFCkFOi2
-ZiwmIQTu3QBDNXaqR7r9j1s9q4hrloEZwmTFXV+PvEczUXx+8Scq8ONZGJdjo6NL
-mp1fM5//o3Vfl0oJsQf2WS/bpyJQDZEQaKGekHJ5W4OuH9+mzDfqkkpTl/aduVN7
-uXF4AYfdZMOqNjkNpi3RAh54LKVtqaeVRzypAnjn8Vb2WHw7tQX9S4DDUtul9Pyx
-a6xqLdtJYw/PwaUAEQEAAQAL/2HSZdUSwFfQAC8o6R2xjpM4yq3JgyfC1Q3htcQw
-RFeoHlAgcBjW1JEiXS7dAPtucJQdHPs/4z2znggMtKTGPRu5034NjjuPhwWFeqKo
-mbbM6bv9LXsRr/X1hqRK3AmE/iJDKEM4ZcAmWuQ1zMUEfa14WmZAp6R1lqek575n
-grMiW5a2mVWG8TYeGBcqh1J8dxT+Qw0oGbNJEjh/KB1brUHDA77EUOzoRpNGlhn4
-j9GCalZw6NDpj/GRanFm1QFxEO5NPi5wnwzlM1+PU7jva3aHQFr8pQbgVv0bBEcR
-5Dsj1vB/+Dwv1sgSUs3qfjnWnbcpY3+j4TTRWwJTtEufqSPtZSu3/o2K3NenaQGu
-pbeDRHWMxrfIfUe65uOFgsgO5gBL0NjIh6D0pDYJUSzcxP7oPTMjBHcfjyxAjJrj
-YNlVyrHlKGMUNbjhodBS+5y5A5ugIi9N0W2DjFMFug296foGIBoVuVpqiiEJls4d
-FedKD9fhFvYh2BwqvYdQpexk4QYA5Firzcgr0By2OffnfbcxjzJR4wlHafKdTIag
-bcPYpaOJKKfchHPAIzQ++HZ147qAabpcwENL1uEz4gRpVlr4JPkcOABsSl6xezm2
-QxWTEmnrzUvmyspD858rBCGAv7/sUhP5Bj6fL4wr+N1qLu5F7Wy96yJSVn9EA5om
-q2MhfMcvgV/mjtiLjCWdyuJjFJ1vqXVg2I/yXoNmPNO6f1JpjwcZjd/140WcCIvm
-VjWHlHEgfnAZkxoBfNhvofeDqQn7BgDuHh1Ph+AjXBSvmQPA7+3DxvAe5zK1xkgs
-PEwFH6I3hfz6uQizENyTgUYP721/8Iz3jXsz8GMOJ+XGLA6tUav37mW7xP7kQTU/
-QNUt8v+eEL+Yo5/3oHjD63P6YnzAzWiUhPYziRcSUeCbD0BFtepIVXkFo3M0/U5k
-KjB/KtpuinNRaOBE6NRwyJ83cneFNKLy2Tlmf98yhSKAiuiCpzS9KVtqKrnjv7ho
-uyOoi6jyXAFLm48gR6QF8HHPmmNDMN8F+wTJgOOir8Q6FOSSLlLXbgakZnUf33j9
-7Vqn/PnFTLUmV7rmJUgfB/nHogN19ibYs2Dnfi/EC5suqqf6qr77JZD1UVZE2Zrm
-5F4AXy8ZIm0yVO/bODZ+h6PnFI/9v/8FsxAMD8Ksrte6KtLLfhbZ7xQkroSazc0q
-rAgpq6NmLtreurjSA7/yZwZ5dZq/FdEi33GQ6RtGXUTW5sblk4D/r03BkwPFr9WW
-30YpLhPFoWvJyXlEGJaUMmpJxdHcRNCPE+bDtBxUZXN0IFVzZXIgPHRlc3RAZXhh
-bXBsZS5jb20+iQHUBBMBCgA+FiEEANPZ7fb3VHPWC0w3UsTUTh9UzVQFAmRwcNcC
-GwMFCQPCZwAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQUsTUTh9UzVTbWgwA
-t0Wlo052dkF44Tq+AWn7C1duxNd8Tf8jNDkat5O1OgNL0JfXaklwAFUhf3QaWvxn
-SbtEMTryhVyW/YA2mICuilBeATLycA1ch91pKr0W3P+8pWLnAKyjCnxY1JkgypDs
-TgnBwlW1bt27qpKxlEv/UN786DGsYsWCy1j+X8k7ayO5WWjVkwfmQc/C57dv0Mxy
-ONBwLyIuYBoQ6pfzCXu3aBBaXy1dYZ4FYF4BBnyfftt3obIJo/rrXPD7aBvRVqW5
-2j4ZDbvbTi4m8aHUc2mFt9jJfa2Dla50qjz1A4QR6EYGpXhmYU48K+1jX4HVOo6B
-M2sbA7o+suuvqRzn3nl9ikLhnX9G3c9rLdSA6ePg4cHsimsEw3FQgGIBx4mLCFb7
-Oyysb2TDyGnqc8v4amIOMMpgUlIdHEIyG9lnLetNrOhRS0+TVyD8fb93DOmLqhx5
-Lf1t5qXYfCUqjwcAPTnDR62nAA5hwLD7uS3M6P98SZdmXSuzSeHoxW90yyDt5v8M
-nQVYBGRwcNcBDACcY33SG13xJ5E+BJsDPnQq8aNP6kLAnSGInoOp990+VFp6FIbz
-XPKmXiUeECRQL3MpA0qtu8qg+Pfd8PIyahtdcTYnYSlAc4768F/xDZEdniCg72nF
-+EZ8T/RTSZXGf2FYuBgMcQpH5A1dsfkjot8E5bMgrYapSPMV8yYuFCVYaoo4/Rj7
-/3Wz9suV8S8bVaTRrqLxe8sLpdxNlpwTgqLR1aGI5HqXnYWGbvbZY0LjvLIjBj88
-Tf7HsHbx497M2/u+2eKNddfWCViAcuY0kHThpAFBLkQB3t0sw18BeerQMr9McabV
-8Cmw3TkBDL3A/TqAy/AjouiY9IrnRPmqCGEqdbrvFxMru7koa/llSb1BX/yUmXNB
-Lln4DDIHRlb23aZrc94lMlIZH+c4wp4jUM5fIp33JVkXuXftVjnWXTbeGA9FhNuF
-g4UWyrXpyPeTt3L7ywIS6xd82D8V0OawLD1LyMfnfbxETYItpWRa7YrRHKp23kKG
-T4xAhyD7FkkgPhUAEQEAAQAL/j+4H+dQJD4iR4Dz4m73buCidM6WXd1aCHRAVdgW
-eEwxlW3BWFznBaz4lfoCTLFpK+xNfYt9BOoClweUaTJWXlD71DtGUMcEboDbGNRA
-GVzudU/tTHUPnDSBZUTcKgznELRTyeSj2DMDfdirr52v+ltl9c6+NSxbX0QVvnwu
-1CqKukfPA/OFGiGZ0EiHLRDfm9idZaGrtUbJLRJl57DhXNLPTtJWeYa19VYZdzWK
-xpHA6/nuTSyWgNU/Fq+nDzv78xsbtQZSX63Oi7zOcd1AANmZY5aPiun98UiGwCvX
-ieGXoliuAsSzkJgjDaRmFth0YOPNnG2MaLa1Gx3V35cN7Xs40oXkWyvbpBV0+WGH
-J5/w/KuHbfnURUQKPyJVOB/AvT5dIrrWmJpNRRpZJzOYPUsYhHo7OVWQJITaTZhc
-vlsGQFM5qt38XGwtHPTCnBu9OLz6XnL9Ei39/Wtw6avsq1DWNy7hc21WXHUMi+Dr
-MPHKBBsl7L7mgg+T1msGyu/hXwYAwJOtq+YJcrLz4AQjuZ0vIsmdhup76SHUvgHH
-EDhWlYKAF9kFctquMh6L3TJ7Ygpi13whRVZWvL/qTqhIEO2t/fIbfnVfm6JJ28cR
-CAWvh/Z0phCX3D/+EFnAbfSgjV8dbA3Nwkw3NUda+GmJWAWO4VVysNBgnaBhoU3y
-MpL+B8p+6lNOPW+R1I4heAvtZX7qAkaz0ZhTiU2iEjHWWGwXuDOs9zNpq60e/qhb
-jhQ0viriWfemT3grpPm3mqUrOImvBgDP5MCTIC7yn9bs++n6MlI3pgIwUbxlLYj9
-y7JKrZDwiqMhBBGmcJc6i6L6aPiC5ezfAln+vRnQYHYY1cfsH69SvqJLfM4GrLP5
-y+oXCPnwuVotVr6+12z7RhkasGyRTSH85cmYZYmeDsTKTdvpT9ADlPa/09iMkVtQ
-kF/P6BauMbqo2971IMTir7DsjbbXWBE6y2KhEJpmcQHKL8Bkf4g34aEg63DXPfQk
-QW8yG4DGdDrUrQzYaRtSGgaisQ28GXsGAM3WGS+mqAZReOc00ecNKKjUX5saEuU6
-IzEIvA/92JPrwyFBq6TTY28Tv9nkblAlmoVaHRPGCJAFcjbH0jmONHOzJKaOJzx/
-uT9jBZPh2/6e6dq1hmTWrrgYW4ZWHYh3SCSEQS8oc7dhiPUGJy5idVosHy1TGRdI
-4Do9X84hE8VDxrY96gCSitIwVNqxqDYnKImNYF+aEnYOJiVuzukS15uTK61w555X
-D7vdBA4XSjFpIAEvqFE4jdBWAi09oqLzHNw6iQG8BBgBCgAmFiEEANPZ7fb3VHPW
-C0w3UsTUTh9UzVQFAmRwcNcCGwwFCQPCZwAACgkQUsTUTh9UzVTCDwv/fUJxiNGZ
-VBArNvxGoCVgewjisEAHsEg/X7dXYlQgHITbtV+lajCOXesuRy5hh3L/NPVDm9Yx
-WB0oZ/sV/qM7yisvGmf6OFxSvaGPr/aQhwIdkXw42veHe32pROujpmclI4QzIV9P
-4zOFUR0JHEaaJrS50S2VMmgX5fq2vBOQY8WIo8fUncPk1byeqwz9WfunPMZ+yc4C
-KIdQ1ysd+YFq9mTwYei/ZFQFyk+X3xxoIhlMd1LkynXV/Swrv11WBxqk0HPaWgc5
-WhUrK+gniZjPQVjOyHiKhu2rCBRXO1ipDdgdBX1aRe3XzsYJt0fI2qewm7ItxPk2
-wbbrfDD3kRu19PbxZYxesKLr5Pj0suIPNI0VWp2Te6HkcRgB8+fR8DAtbOCbo8Oy
-GgK0fz3gzhvhAUxoCRayo4iGTA6W4N+sryuOdDikRIirVxgksA2LLMwQzaSqllkh
-AoH/WKXfBxOQo9qDcxdBnCkM0bZF5tgrNqYf1IN3bZr2pV4CYo3Z2JaL
-=5CPG
+lQVYBGhek70BDACvHapdTLVc35G2r/JtpIbUqPRTvAcox7phoQr2DGqjedFht+vk
+GKS9MrlBT7reFXSZb81joZAVPgONdx5jbnZfxoiBLHBlwA8RYshhnShKzxvc3oHG
+4KqzmhVWTeKznKw1YUiHvJasU02NRTm+iHZSX4/7u4TXVcJ/lIUcc36v0XXh9LbC
+Yr4mwWgu2KzyTbDV8JJ9/hfsJMl5mpleCRpLh3oqpeAgWsOmstSHj9Smg6k+0W1e
+OzmGA2cb8t1OOAVr9RfxPeRgGMmt5ljudPXmYH5+qEk0ez9ZkZLWlUjaiv7NrXNm
+QRrJRUqw86pzzlIHBfp2aV8JTGJZf+r1i3XCq9JG03J16R6aRp6ZzLj3q/yod3NR
+P213zkP1GAwgqf8EbIHuRdwzcwQwe3D6Bh2b610G9Z1JwRKLQJxRPln6i/tSVp2y
+a0W00226frooNvQVf9Xu71AEoV5m/FxpWDJUvf3uoa0xFRyt7YrZNpLcWQfafQGC
+622JqfrDwDvJu2sAEQEAAQAL/jpZSyPtZFz+zaGuvLuV36tKZKbl9wi6jDrtmyZi
++sFf3MmPrBUDtRippxrBA0XupjxeCXTSJ508XZisgT6mVuEQ2PkZopX0ydCENrp3
+0C4lFmag6WMoBxjzFXr9VrV8VdEviihYSWhAFY4l69i1xZ8q4mIBmIDbvYQfK79Q
+KH1S8NGKZb8dgbiOJzW80tul0W9nypgaq0Pu+gb/4Wx44f8atDUzsht1ws1vtus4
+nKWjJyicRbHpUAB8b8XbRaxDc9WObeK+s9Dv6nAEn3se7TBEs8P1SD7OIR6iVuJD
+DstuFtqw8ptIogssEVHKLd89R8RhHNmqYAj6fJ2+pknJ9RDqQuIp5Ell3gkZm1+G
+JOexel1dL5eaWeN+tPULs+ARPKY16QrArimznq00jrw88A4/8WyIO2vYXHIpTmWC
+vzjmv7VgfgQYnE+6Bmza1bCxFoaagWVAi1UDAAGoOF8hhHLfoHR8MtZqW0hsnA1s
+FzpNVvSfxU03dnS7fdFZfwIW0QYAxP1XG0X1KMcVqD2ZMyRcFgDHdwQAZuTOB1dj
+YjWnlj9DhIRC9wJ12VYUdtWy3NAec7zWkqMMd4AAOumPT1vCLtpA9+53jJrdYTix
+nvrvXsnOXAzlwqiVzTxa78Hshy6TlV4XnQLCNf6f/IUe8tNUQIjpo8sZERxI/0IG
+snEQRRLb6H8/poI8WA/n7XfMOzFrqx7LrGEyipXdHHkZ86o0zntyiH9sDPO5UA5u
+RGjtDv/h7lRHX6hpBl9oEEKa4HSTBgDjkuGopr6apzU/ejaws1eHUOh7fXRmlUJu
+W44o0W01v6jBAnzDARryCxV5WKVVtF5Ye8Ik5QF20S7N4a3n52HzOuczAe5jNrKf
+Ofncr0rxAKMZS+iyH3uJCNlHipv2USYn8srcs405j+nBh3Fg34ZYRyazQF5+ukjF
+2fpfMKU2ds5bjF6LMZY5ghH0EvZ3RrMgebqsgqSakq9wDD7AQ5tlgR6GKmv4eIrI
+YNXRzCy1WBoMG6sV1GmxlkBw7y/tfMkGAMu+IiOdCeK+itN8Bx87I3qz5vopNJ8g
+EMQXnh4B/xlWeOzgpZ+IXlZGgZ9puIVyD34usisYuAVbLfSjrWybsfociqow8oL3
+0JqkU65tY/KeAdfsJI8R5RuJA0mAl5V43cDs5UczAKGrAVqRROZR1Fkm9tSnlta1
+rYRXvuM8803NiVKEjsftcuJCzx5ZUknaWexMWg0rcUUlNpskeY+lRx0LmAUWS8nD
+/Mu1KxTcaFw3d6En6mG1QXw/nJK4IkgWPNvPtCZUZXN0IFVzZXIgPHRlc3RwYXNz
+cGhyYXNlQGV4YW1wbGUuY29tPokB0QQTAQoAOxYhBLfkd2sJqokFdJd/WeJ42+Ct
+0N/BBQJoXpO9AhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEOJ42+Ct
+0N/B5RIMAKKQ3g01zKA1eFa4H0JYRHxfzcZYAvgyh/2HxAYdHRnJC/JX/IC0B5Oq
+AClj5uq+mDurSBeu9vp2E56hgZDyqrJFhBxNzcMNtrHYzT6YU3oYAMgzXywNHffw
+Jem1lZjqTuFfb+xsTfcRppWh/HNjt8L8uTg4s0xtmTKb3zEDi2RMNHYvrJau/c2T
+am46Go2NsrM9qMIwJ2xm6YGeTXi3pe7sfQ4m64ewe3wYETJmjZk6RUVlDLZonwVv
+ty20Butbh1292s7wvIHhp86D3r8i9Q/dvmI7nixXJo2E79fOkymK/kcDEwedgZCP
+/xb5tizS0+2vlk5BhWw/7thxuqfUbMJw3T6ttQe+yxE1/UcbfSC1i2pRHXHnw9sp
+uNE9bc/iMbZ9ITcMmH/KLAYr0YLvnrDLPCB3Aes7L/3UmJ4ezkyzr/vQEEdAxxhU
+oKB5UfRRcXClonQGTSkyygDlwt4YSVgnZMPQZZhyNV63Yo0NyfuF43h8al5sl2AZ
+fxUpsl04VZ0FWARoXpO9AQwA3vuZO8AOOWFkVcHtAd2RZuhskK5CIlqxNGpy/GSg
+90u6NcsEy16MXh01gFkVYtNPnXYcy1pcTzG+bW3p81u3Mrsri0xVIOTSWq8LPit5
+acLDPCZ6QhrokUcMyqBlO9vy2W6ip1jOEzgYYta+My/lDVdcWXz/J573MABMgK9B
+2G9UHbq5xbcfsdwUl7+HXkty5E8bJlDtMVNjUQGijai/OCiYZI98Le9tNup33/WR
+ugyXwdWeKjjLGxn662sYcyyM8LRket9s4Z9hNIMgUpd/Pfb36PZ/bhB3MbdFwMxz
+OjFN8XY2iN15X/G2Y30Fz9j0Xs14x3kzLwrDdR0iETw0ijW10G0HIxpIH2fcrgNY
+vnuLvvZxYRuSwCSPS3alj3NOKZpD/IYdQeq8ZVfCmjq2yVxRyGDBJurzNY/REbmX
+FFLEQLFaEPKy4eqyC6nMLIum1T8QIJAZiZM161Q8fJUQZ944O6TfHEFzTU+3TGDY
+t79OLv8H7XpVBjQ6OTC0Srr3ABEBAAEAC/wMlJJZIiVLTHjeM8I87DTDYxKY+RPn
+H0nHJMhXABBq011uooUjOjLeLnSxyJThzf08a4kFWhRCLZLKVryvy7lixdeXlNdq
+sy5BCoYuXEKN2nysXJliOGVtqN4KYpFDls21Qb4whdyejfgmP2pctfOM1KRzsg8t
+O5VDooiua/ThkqpiwQGxK3tAzCNnSlmHUudpBSOJfmBbe5JrZBW5O0+KihPK/KNr
+bgox4nmf65lsr0Ayoew6AplG7qjO9mxbNySjhPHaIhB/bVuWwbOkEB3Y/itjFjpN
+MzksN69qJte7ozza6jmV+rxSylj8BCPow9zNsgYGHy/LrP7FyLFwxRUIvg1FQYj/
+SS0iNNw86x67R6yGAgGWIcjB1L7ji1FhXlbRpMuxhms/0tRds/uoghe+zsOlGVqq
+YV8krd0q2rYVPLGg/VqBhPi7/FoGnmyao1DcepQ/FHCg1AqW3hh8YHE+Htb8dwb2
+1S25r+108Es1q/OaYF0+Dfc+Wve+WMgNGKkGAOQoRmGdeTJoxdhm0TNmyR4ZB5es
+M0fjT6u7jV1A/P6UjvtsYSpr2nVxGjKVCLazLlTLJ977ZlLFJkOYE2ootjAn2CUy
+EqsF4BjWFvex3h4QSLv5SJEEj325/OqnOw3u4yAWJqd3ukwE2H7ZRgToCPPn4jTV
+6mx6DBsQIKwwgRzrntM+23/EaNgawBd0xVCiHRKn+D+YoTJ/1dni39+oafzg8th7
+LF9KAKgu23rqK7nZx/3jNl/ePvN+ECIhB1SFyQYA+jGrcEImifCS1fr6oriGIumC
+bBx4kanbb+gm5pc0kFvxCvEvdyOJRymzL9MMyWdM+dq7hYEGgkeXQSKE10wkZEuN
+40FyE1RRFQFrTimfkim1exOetk72i/HX+ZCoqrtpwesLjQ9w01gDOjX4uVfI8lNY
+JkDgXtbZ4Dx4tz4J0a9MoxJcTdmzLRUB2HtJLssTCN5s47kkrzxnPYiIBp47aM19
+p7SgBP8p4yc36UxLBnh+PdmwoxfTKz24uqElwJq/Bf9qp/im5jZOg0ckmsLhrkdO
+8RK374y/EbVdERQPpeoCd8YYqTLHVmM0d2rWInOEJU6qRxkDniFUGqL+nknEz5vt
+gdp97dQzS1morXWHEWKRK0+zEwKF8jn5erG0JXuAf/nv8Mg9wXirp+32C44NRuou
+Lc6gHzuDU+JxCo/jp+zzoZRCAvQzST6eUXeOH4p7OrVqptmvEmh/8shaTVR5oplS
+vzEvE6YQoBnGubGz5Ws86EYl5k6WG9jbzYA9owK6H6XcMIkBtgQYAQoAIBYhBLfk
+d2sJqokFdJd/WeJ42+Ct0N/BBQJoXpO9AhsMAAoJEOJ42+Ct0N/BA2YMAIPW36GV
+JIabrkO279usvW4GNW12pjJmgXXf5NQO3uFPa0RtgvjWP5rBZFqXb8EHXgX3RGqm
+kqaTfS0L8C0EnueFH9NuFP48HZ4uXWp2cOS/YBdbB/nw/b3kavppIvSJf5vT1XwY
+eMUKSXGRU7pHJuRqu1b2IDP3Jf3bOjQS7je/eoYeUBcWxa6CZu7ehj6RfLHehgHI
+g/lm7K/bZLXT9uZifxYo7lQo48a9MdxzgL/6+vQQiU7UFCMJgognNbaR5qBP8ilY
+BL1JC9Yjcrx0ple8M5S50gDqiIs3ZVs23fzh8sGOrftabI1Av0S4pzifIiEiGzg4
+zIJDmms+QvWJ0XmkVeQrl9XPdww7RKiHSdksj/8XuEwhraI4pz41CQbYu+ceE0wz
+CvJeTuwm4ybp5SZ7l8y3wcRmHEVoBfYa4dhjezM2NT3J/4MYj4SrQK5wDfaV3hNW
+FelDv0SQJtioAMa/1isFK/eyqeEwnWafWzowtELLHrz5LMzgUTxclOqsWQ==
+=t+01
 -----END PGP PRIVATE KEY BLOCK-----

testdata/gpg-private.asc

@@ -1,83 +1,17 @@
 -----BEGIN PGP PRIVATE KEY BLOCK-----
 
-lQWGBGRwcUEBDACzKYvl19Gqzdu2rwLx+Me+GvJkSemnvxdPvZhg+94uLmn+9oZp
-jmaLA8Kbjb73zfitKOdJojRKuBwyNtP7iPt85nWeWwq4LKHCQUo81Uh4lzv/0N58
-PNwFdRCHtD8MnhBRNv/kwccXyriikVbbi/dj+ISdKE7ueZ7SjgMFAa8JouiFldqZ
-uU7FgxaFxQ5o5NqTJF4XOdZQakW2A5PhLDmEMQ/fPJ5gFXPBzu+yCvAo0G6QkcJ5
-43mEOpJQwS79I1a8oS5txGiV0jP8PtyyAdIGuPW2B3oxmaNXllttYg2pnYR0Tr96
-5uMr8B2wcBdWAewH1wP0QKcKol5vxYuSwCOkwIjXtSLWMpYjtaS4FcWObUhvJiDI
-ypjLn1y2H6hW3oNT9W5nvaEgWqafdwBhF2BQJYcxAAmqIoIRY8k/JMLKuG6xdM4b
-opCCo37syvcHU4jNvXu7vr/8w7Y5Wc/yIVQARcm65DAZ3OPmIYKp8BDUnDgweUZj
-WaOWdYGB7+c8rDUAEQEAAf4HAwKdrS9IwGeeff9kQReq6FHd6Pp8KB807eqDBUAj
-BnUUtIE3iK2HJ++GohBXZemzTu4zl62krIGwWcwoqfckv9dIkWioem9JMbL7q4Jm
-6IChJ+EFvV6+I+C0lzM7L1lgKp6NZdcCnpfpSMrInVqzUqe4EbNaTDX5sN2IwdzR
-8rorZcQSL/ncDXg7vAhBtiKArtfyIPsWoxvEcPJ42ZMY3qM5p8zFmzoJsDwO2MWc
-K+UFrXJYZG43NoAOR5g7A+tHdcPLdQ/FT87tamyyULrVWnS6hDser4KlBN+Ez7bt
-GACWa2bYee+fn0VssWGhGxeV6coICmNENPRFtiQYMhvIbdS22Np+7ym6+7XJ6P0g
-f0iVi+3t3THXIJ84A/3uNnT2QG8BGmABsNzqK9TVMtHb4u8zLt6oG68WfnEumUo8
-ycm4PPstDuhd623b/aaqvD51tDsZR4GRYruM+LeHKGi6UYMCUutoUvna1aRgnz8D
-OCxz2emm+xsayz/+wo7UbD6CiTC9SPK0eAMYCghl0/wOcUFfp2hb8S7xzHg+HSEe
-vSUjM0V1Qf6l2AfsaWy1Yy/0ZtRtBNyxVkSwsmbvvUif9lXZNYsOnMSOTV4rmYwo
-QzKirhonkTkYv62GBRJZTYEVENrY9qUGrkYgCluGrVVNzFw2rTemvqX5IskMaaAZ
-EW4tSlP0fWs4DNiQQutCmKO/0FVgl1uWy2kSDEqSTE3/kT8Y+9hlj/itM9n7J4DT
-EqOhPZPit23OG5ahbGPUEODjXONmAlbwXmEUGf9KsnOaCRv2xYW9iT7fJrA7ivbV
-/DVwIprkbA6ACuSg4Fia+5DibxXh/JfSU3R9o1ugspZ9wbE8ay5GPbKrqSTT1Jlu
-JB0eY3HEDMEtVqbItedV2D7a/V5nfW3tZrIma0MyE7kAfJ3+ZqXWXww9ASLTUoZO
-wT9VFj8ktF+4fjKIHoycR8IInl56T4xhoz9CTzaHOvk8GHZF4+FX+G2/IkFdinkb
-Qbia26fGoS51o/rqzIHo4T15oBWXLSx7oHQhyyypzeRHmOKiStUI/rBnghl2Q8oJ
-xE/PUtXJDPkJHwc6cSCTV81G2kRQVh4iZg9ixJsXvNdAlB1GGOJH3VDuxPPCRq3s
-zJAPXOO28TwHyTipiw/wJ8Soyg4xpyoI2cp/CNpdo5f1mAruPr7XrdOHkl3obxRe
-OCVCmyevgg1PX9uV4JncRtsiFje+RJFuLTjkMVZLmccnUNqi/CpA5dPmHkg+0uK1
-1MVB+SJvjqr7ag+WbJuecuE84VD5Gr66CinOywfluRA+pLGdCIuxRZdTmgiVeh5S
-bH3jhXBljzhFK2I9GJ0RVKDRsdu6iOrEW7QmVGVzdCBVc2VyIDx0ZXN0cGFzc3Bo
-cmFzZUBleGFtcGxlLmNvbT6JAdQEEwEKAD4WIQTG5NstFF+myfSEwuHX3t0O/q5z
-ogUCZHBxQQIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDX3t0O
-/q5zolo2C/429RV2EhFG5EYKfLCd72ANLzUX9Kezk8tq3JDOYkRuqGF2y6HzuAcx
-DYytRoyxTkCpxiuwPnxnU76cSSxn5+UZD+0sa5OGZYMtrCVSd56dXQkK0drf+RUo
-apFLC6ufWmHox74ZIuTyPLj4YlsbSU3mE8CqVWY4Svk5W920wZDS7lrHSkXtKqh2
-QtE/7/mTXCxu1HNqfck5ROIbA0MTKX2FG+3gujjJcZBEI8nkIdvI0XouOHXLZLKq
-kh8//w1XsQeielOXO/+pQyT3lSwcZry4F112S4bMO+R12uWO6Hxwe9LoQb3gDmO5
-H9LsssdpHC+bhJnTURGixiMuyzjFSmfVzzgU2YeP69R+GHxLMwMAo/a89eWFxiZI
-6jMOx7TgYC9fg+Z8weTBq8fy8E5tT/LJm2VrBm3vuTgC4MePdBDy+AuEPyt3J2fX
-1KS2vNlASeh6ONhMk+BMVWG0KWs3GVyF2DcXUCTX1xVI9uT+eJSR7UPJ+kRnIfO0
-RzxL30Qxvw6dBYYEZHBxQQEMAMDLFiDTpnqsjH9li97yBOdG3SOu9EttdQXXopdh
-EPJDxDCBHqfZvfjHuA5gfIP8bghQsXYCnn5k6dHZHdkJ9LfJTj8Wyh2cumhxPO2e
-wbOmhQgLC54hmi0s64tj9GxM95aZk8umkTdXt+F9a4WihHGlgeCdpq+B6EQodDCU
-ysJgnlCUGgjK/ptl4PhQtsgXk/mw0oOQukoulFFkfdlLEhWYNMz0/5oAMdGLa//W
-8cjK2E5UN3/1PFF1nvzsHca/fGb1JvUwgrTjeJC4H10Vo4KvmYkpb943auoGJEJU
-QbM/A7cDQvzB1OD/UpG6vYmarXCjGe2ZrJs+RI+bXMXLfsdCveLo1DPhpF7hLD+t
-F2NI9oM/cEXuQBwl3mLOjFOn0Q1jXDD0uyzEJN7DKlnITyBV87hv2+hMGftnQwmX
-iXw8rkBeaDLl4ShG3MLCr8KpcvtgtVf9ceZxO6K0CGTj+VSfKQ34HrWEoNzNoRoM
-5dSPK6YXNRL2JizVRrAkVoRCzwARAQAB/gcDAqMHMJr6Gorz/9bZTyXQGO/oXkN8
-D+G3Gn0n0iAmsH1nBo1qo61JosRAhhO+Z286F33tS/TqcblQVCsgPYFN93qX1yoB
-RON619o3s+mF9PtSLvbUDdUa04eLarhH3RoCkkpoh+3df0xw+Jtpx2+eZibo32vb
-U0e9lIO9Kv1I11Y2xSymFTzO+hK7IKYAvP9uzYty/r0rcgotJHr4B+k5jCQHXZhW
-u0/68b7Y/JOUxKSag5r3PyyDWyJibRGi2ILwKogL5D4YdAtZYUNemmK9Is31NIs/
-6jWHedOuRsBlM46NwwJs8ybtqy0TLDQhfrn2jUY/U+BMWSV4u8Ra33PaOyqv/EeN
-hbySg2DTVnAlxzdw/z7oDPROtW1FzdFPVvOAUYOGuzlEhVAVzdhX9EfBahMIy7/B
-sSlKoFOCMOngsnFrmxAMbUW49ZoTRzAunTVFNgqQJZLHmzPiyyierNP5FzjG+wO+
-lprurp8RXFQ2KQ5hoF8Mw+F4V+mP+RAtO5P05rcp/PJafwdvxS03LZZchB3hRWQi
-pGBum37nxN4ztbduUwWk+DKgB1pkPthF+i2cKlBgNzL/bfbmJoiIZghUKIgCZoXp
-3PRwa2DM4CoFoC5FuhFV50CpqbrVeZAAK2Q3InphbdWZb5os9YqFfteLzk316zCj
-vqftiZ4C5WPqMtesLGSeXNOna8vm5AOzt8qohmrLhdoONxBqf3sbykyzU567AWtm
-P02u1JWQgGJnsRO+3j441VSK5SSmolCdDP+LspfZPCRZel+pBwlTJ6IpuFxB7zj1
-UpkfT6r//bVfriwe6rFZ0VI3BfefJLrCIrgI0V/IFu1rjcciNV1PXwAdJNNhN3X4
-4zPktSVR8u/Nz8jNgdSgXBYMkuv+QTjvzBvCMu5tP7ufXVXG6jAEJHeUh+633HGJ
-o6NTsOZFhYwLmwTh4CBplt7bclsysOQGgo3SWHO3axCWrRX9uNVq0uIKjl3CHkqW
-3dbQzFlY3raWT9q19g3cuiA8BZqh/NswIQDrOFS4pGrbTQFWY0zQZqFlHEyVCgwb
-TtbcpjOBy3O2fsbFvepYDbcTYbmcacZSZFtTMiQGt3Ga+TeGsO+VIUzNgmpLkyWS
-1QQjvqNKZnKWT6f4A7Lbj1OZqG/v4540jmOxShcHrz2Klwdrra6Ie7yERYmyPMZJ
-98r2BFk04QaYK7r9xy7hJGBDmwT0VOcJXDAVA3HJJHGltnNKke2vP95JLmyahORP
-efEsi0UPsQqkCS7iWV9ucUtKEnYzoHFSeSXU64+Cme6T+7FxJ9E2f5Ep88nz7ucg
-EwgSiWsdqzEjntq5MAr6rSSk8ZKPzRbR61exuf7tWRa1iQG8BBgBCgAmFiEExuTb
-LRRfpsn0hMLh197dDv6uc6IFAmRwcUECGwwFCQPCZwAACgkQ197dDv6uc6K7qQv/
-brSaC5ICGKIpzsIf6lIp6Wrn7smsGh9BI+dH19prXQ5lT6Iv+IFZmNiDGXtVzOOK
-Y8VgqwJmf/XwjgH2dod3X61ts3krtnZ2znCgrz08NRxG4G9ok8Fa5fLCrZBWi7UU
-4ZH63rS9optmqEMzwCwQ94U0glU8C9Hc44MVCSrrrD2+/H/PTFVr37iwBugZsDq4
-4gUTyGBYumnzTVyi2ZbJn89Amd8fl280QWSkdebmljnk4OjlTZbXkRGiIu65ggr9
-ikg11TRlPD0L9NTo8w2OtjoYXr50xL1odyNlz6RKcQlX80EjKMXvVxNE32J4JCBj
-tHrqiTDCs1bdXTh2xCvF0DatJMeUn3/WDn6UYjZzlZvZCOcjQLrPgJplJowLwd96
-YaUfZ11WNAgNy8vZjUroMNyD2J+GsLr+QZOqFRP362+Juj5MqANXAuKEQ4qzs2Fv
-/Z6cUYKuENmsNDY8ORG7ON95AFl5i0daP7+EoHDMb7+tyG54JxE4Szxhe4skRXXr
-=Ze5I
+lIYEaF6UehYJKwYBBAHaRw8BAQdAPKJ2JvwUyE7dy8bjVgBCjdRXSTw2BPl6wayP
+o0WwhvT+BwMC8CxbenuzELD/Z524BTjgiXXgPS8rnRkSqww5Swa0d4mhtTn2w0pq
+jRnHmVyLhh9n7e8GZaS9+8CFu3UWtkHgbRrzdyRg9KuFaW0ogcWA5bQmVGVzdCBV
+c2VyIDx0ZXN0cGFzc3BocmFzZUBleGFtcGxlLmNvbT6IkwQTFgoAOxYhBF3PQjaj
+rT/hLkdhdu9/tDIYmfSXBQJoXpR6AhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4H
+AheAAAoJEO9/tDIYmfSX0zsBAJ4Tay/2jNMqye9RfiEn6B5e5IO+QymL52q6bF1z
+ZNLDAP94yfwvG+7fL6W3XOTUr9unsCU9W0T0lAfFLmZY2WoeApyLBGhelHoSCisG
+AQQBl1UBBQEBB0BMy3qqyiYPkalTZNUw/VSgHEOJF0Yi6fFi+DnEWtapKAMBCAf+
+BwMCla2r1+brAiD/zuhRDXfJC1oRoEnDq/JgmsU14t6PNCPK6MPA+dmV3kCIVbjy
+A97PMx6HBSTJZYdzGY8e2XdwzrVG4vbzH2yJ55LbawgFYIh4BBgWCgAgFiEEXc9C
+NqOtP+EuR2F273+0MhiZ9JcFAmhelHoCGwwACgkQ73+0MhiZ9JeinQEAip+eryNU
+T9X80S4YilMZg7djkmGfMJnEZiKYU8TEsFQBAN2D3PDAVNKs2ZOVp1GQMDse7sQ6
+5C3faX2ZMchuKLwF
+=RH4D
 -----END PGP PRIVATE KEY BLOCK-----

testdata/nested-upload-download/.forgejo/workflows/test.yml

@@ -6,18 +6,22 @@
 #
 name: two Forgejo
 on: [push]
+
+env:
+  FORGEJO_VERSION: 11.0.9 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo
+
 jobs:
   setup-forgejo:
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
       - id: forgejo
-        uses: https://code.forgejo.org/actions/setup-forgejo@v1
+        uses: https://code.forgejo.org/actions/setup-forgejo@v3.1.6
         with:
           user: testuser
           password: admin1234
           lxc-ip-prefix: 10.0.15
-          image-version: 1.20
+          image-version: ${{ env.FORGEJO_VERSION }}
       - id: testrepo
         run: |
           url=http://testuser:admin1234@${{ steps.forgejo.outputs.host-port }}

testdata/release-notes-file/.forgejo/workflows/test.yml

@@ -0,0 +1,44 @@
+# SPDX-License-Identifier: MIT
+
+name: Upload a release with Release Notes to the project that runs the workflow
+on: [push]
+jobs:
+  upload-download:
+    runs-on: lxc-bookworm
+    steps:
+      - uses: actions/checkout@v6
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        id: release-notes-file
+        uses: SELF@vTest
+        with:
+          direction: upload
+          tag: v1.0
+          token: FORGEJO_TEST_TOKEN
+          release-dir: upload-dir
+          release-notes-file: upload-dir/RELEASE_NOTES.md
+          verbose: true
+
+      - uses: actions/checkout@v6
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        id: release-notes-file-takes-precedence
+        uses: SELF@vTest
+        with:
+          direction: upload
+          tag: v2.0
+          token: FORGEJO_TEST_TOKEN
+          release-dir: upload-dir
+          release-notes: "I wont be there"
+          release-notes-file: upload-dir/RELEASE_NOTES.md
+          verbose: true
+
+      - uses: actions/checkout@v6
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        id: release-notes
+        uses: SELF@vTest
+        with:
+          direction: upload
+          tag: v3.0
+          token: FORGEJO_TEST_TOKEN
+          release-dir: upload-dir
+          release-notes: "I will be there"
+          verbose: true

testdata/release-notes-file/.gitignore

@@ -0,0 +1 @@
+*~

testdata/release-notes-file/upload-dir/RELEASE_NOTES.md

@@ -0,0 +1,12 @@
+# This is a Release Note
+
+Some *formatted*,
+
+multiline
+
+Markdown content.
+
+```bash
+echo "Even a code block"
+```
+

testdata/release-notes-file/upload-dir/file 3.txt

@@ -0,0 +1 @@
+FILE3

testdata/release-notes-file/upload-dir/file1.txt

@@ -0,0 +1 @@
+FILE1

testdata/release-notes-file/upload-dir/file2.txt

@@ -0,0 +1 @@
+FILE2

testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml

@@ -4,100 +4,102 @@ name: Upload/download a signed release (no GPG passphrase)
 on: [push]
 env:
   gpg_private_key: |
-    -----BEGIN PGP PRIVATE KEY BLOCK-----
-    
-    lQVYBGRwcNcBDADUZUxCbjw0hOtMaLIYhEbgYFR2Oyxz8IDJTVALuLGQbHnLM6La
-    IVxGwk9CgxX8vP9pN3Fy+uX+KInV41bLGd30qPDvqCuAbAo4bAT0Sg/fN3A7fuSX
-    KfUStJbY3OyQZQbHWxOpsyIziIqBMXipgFQD/IncRMhWjcQh4znnkUb+e3oj1/f1
-    9eErwfgsiDsj7M/FSWolrwttd2VQah+WumhVFjvb+M4j5zI9UBNGNsVCTxQXTN5L
-    MtPJuypuMzawmTvUNm7470VDgO/dCWGlZ7gshoNd2fNnFCMgTSWYu9C8zFCkFOi2
-    ZiwmIQTu3QBDNXaqR7r9j1s9q4hrloEZwmTFXV+PvEczUXx+8Scq8ONZGJdjo6NL
-    mp1fM5//o3Vfl0oJsQf2WS/bpyJQDZEQaKGekHJ5W4OuH9+mzDfqkkpTl/aduVN7
-    uXF4AYfdZMOqNjkNpi3RAh54LKVtqaeVRzypAnjn8Vb2WHw7tQX9S4DDUtul9Pyx
-    a6xqLdtJYw/PwaUAEQEAAQAL/2HSZdUSwFfQAC8o6R2xjpM4yq3JgyfC1Q3htcQw
-    RFeoHlAgcBjW1JEiXS7dAPtucJQdHPs/4z2znggMtKTGPRu5034NjjuPhwWFeqKo
-    mbbM6bv9LXsRr/X1hqRK3AmE/iJDKEM4ZcAmWuQ1zMUEfa14WmZAp6R1lqek575n
-    grMiW5a2mVWG8TYeGBcqh1J8dxT+Qw0oGbNJEjh/KB1brUHDA77EUOzoRpNGlhn4
-    j9GCalZw6NDpj/GRanFm1QFxEO5NPi5wnwzlM1+PU7jva3aHQFr8pQbgVv0bBEcR
-    5Dsj1vB/+Dwv1sgSUs3qfjnWnbcpY3+j4TTRWwJTtEufqSPtZSu3/o2K3NenaQGu
-    pbeDRHWMxrfIfUe65uOFgsgO5gBL0NjIh6D0pDYJUSzcxP7oPTMjBHcfjyxAjJrj
-    YNlVyrHlKGMUNbjhodBS+5y5A5ugIi9N0W2DjFMFug296foGIBoVuVpqiiEJls4d
-    FedKD9fhFvYh2BwqvYdQpexk4QYA5Firzcgr0By2OffnfbcxjzJR4wlHafKdTIag
-    bcPYpaOJKKfchHPAIzQ++HZ147qAabpcwENL1uEz4gRpVlr4JPkcOABsSl6xezm2
-    QxWTEmnrzUvmyspD858rBCGAv7/sUhP5Bj6fL4wr+N1qLu5F7Wy96yJSVn9EA5om
-    q2MhfMcvgV/mjtiLjCWdyuJjFJ1vqXVg2I/yXoNmPNO6f1JpjwcZjd/140WcCIvm
-    VjWHlHEgfnAZkxoBfNhvofeDqQn7BgDuHh1Ph+AjXBSvmQPA7+3DxvAe5zK1xkgs
-    PEwFH6I3hfz6uQizENyTgUYP721/8Iz3jXsz8GMOJ+XGLA6tUav37mW7xP7kQTU/
-    QNUt8v+eEL+Yo5/3oHjD63P6YnzAzWiUhPYziRcSUeCbD0BFtepIVXkFo3M0/U5k
-    KjB/KtpuinNRaOBE6NRwyJ83cneFNKLy2Tlmf98yhSKAiuiCpzS9KVtqKrnjv7ho
-    uyOoi6jyXAFLm48gR6QF8HHPmmNDMN8F+wTJgOOir8Q6FOSSLlLXbgakZnUf33j9
-    7Vqn/PnFTLUmV7rmJUgfB/nHogN19ibYs2Dnfi/EC5suqqf6qr77JZD1UVZE2Zrm
-    5F4AXy8ZIm0yVO/bODZ+h6PnFI/9v/8FsxAMD8Ksrte6KtLLfhbZ7xQkroSazc0q
-    rAgpq6NmLtreurjSA7/yZwZ5dZq/FdEi33GQ6RtGXUTW5sblk4D/r03BkwPFr9WW
-    30YpLhPFoWvJyXlEGJaUMmpJxdHcRNCPE+bDtBxUZXN0IFVzZXIgPHRlc3RAZXhh
-    bXBsZS5jb20+iQHUBBMBCgA+FiEEANPZ7fb3VHPWC0w3UsTUTh9UzVQFAmRwcNcC
-    GwMFCQPCZwAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQUsTUTh9UzVTbWgwA
-    t0Wlo052dkF44Tq+AWn7C1duxNd8Tf8jNDkat5O1OgNL0JfXaklwAFUhf3QaWvxn
-    SbtEMTryhVyW/YA2mICuilBeATLycA1ch91pKr0W3P+8pWLnAKyjCnxY1JkgypDs
-    TgnBwlW1bt27qpKxlEv/UN786DGsYsWCy1j+X8k7ayO5WWjVkwfmQc/C57dv0Mxy
-    ONBwLyIuYBoQ6pfzCXu3aBBaXy1dYZ4FYF4BBnyfftt3obIJo/rrXPD7aBvRVqW5
-    2j4ZDbvbTi4m8aHUc2mFt9jJfa2Dla50qjz1A4QR6EYGpXhmYU48K+1jX4HVOo6B
-    M2sbA7o+suuvqRzn3nl9ikLhnX9G3c9rLdSA6ePg4cHsimsEw3FQgGIBx4mLCFb7
-    Oyysb2TDyGnqc8v4amIOMMpgUlIdHEIyG9lnLetNrOhRS0+TVyD8fb93DOmLqhx5
-    Lf1t5qXYfCUqjwcAPTnDR62nAA5hwLD7uS3M6P98SZdmXSuzSeHoxW90yyDt5v8M
-    nQVYBGRwcNcBDACcY33SG13xJ5E+BJsDPnQq8aNP6kLAnSGInoOp990+VFp6FIbz
-    XPKmXiUeECRQL3MpA0qtu8qg+Pfd8PIyahtdcTYnYSlAc4768F/xDZEdniCg72nF
-    +EZ8T/RTSZXGf2FYuBgMcQpH5A1dsfkjot8E5bMgrYapSPMV8yYuFCVYaoo4/Rj7
-    /3Wz9suV8S8bVaTRrqLxe8sLpdxNlpwTgqLR1aGI5HqXnYWGbvbZY0LjvLIjBj88
-    Tf7HsHbx497M2/u+2eKNddfWCViAcuY0kHThpAFBLkQB3t0sw18BeerQMr9McabV
-    8Cmw3TkBDL3A/TqAy/AjouiY9IrnRPmqCGEqdbrvFxMru7koa/llSb1BX/yUmXNB
-    Lln4DDIHRlb23aZrc94lMlIZH+c4wp4jUM5fIp33JVkXuXftVjnWXTbeGA9FhNuF
-    g4UWyrXpyPeTt3L7ywIS6xd82D8V0OawLD1LyMfnfbxETYItpWRa7YrRHKp23kKG
-    T4xAhyD7FkkgPhUAEQEAAQAL/j+4H+dQJD4iR4Dz4m73buCidM6WXd1aCHRAVdgW
-    eEwxlW3BWFznBaz4lfoCTLFpK+xNfYt9BOoClweUaTJWXlD71DtGUMcEboDbGNRA
-    GVzudU/tTHUPnDSBZUTcKgznELRTyeSj2DMDfdirr52v+ltl9c6+NSxbX0QVvnwu
-    1CqKukfPA/OFGiGZ0EiHLRDfm9idZaGrtUbJLRJl57DhXNLPTtJWeYa19VYZdzWK
-    xpHA6/nuTSyWgNU/Fq+nDzv78xsbtQZSX63Oi7zOcd1AANmZY5aPiun98UiGwCvX
-    ieGXoliuAsSzkJgjDaRmFth0YOPNnG2MaLa1Gx3V35cN7Xs40oXkWyvbpBV0+WGH
-    J5/w/KuHbfnURUQKPyJVOB/AvT5dIrrWmJpNRRpZJzOYPUsYhHo7OVWQJITaTZhc
-    vlsGQFM5qt38XGwtHPTCnBu9OLz6XnL9Ei39/Wtw6avsq1DWNy7hc21WXHUMi+Dr
-    MPHKBBsl7L7mgg+T1msGyu/hXwYAwJOtq+YJcrLz4AQjuZ0vIsmdhup76SHUvgHH
-    EDhWlYKAF9kFctquMh6L3TJ7Ygpi13whRVZWvL/qTqhIEO2t/fIbfnVfm6JJ28cR
-    CAWvh/Z0phCX3D/+EFnAbfSgjV8dbA3Nwkw3NUda+GmJWAWO4VVysNBgnaBhoU3y
-    MpL+B8p+6lNOPW+R1I4heAvtZX7qAkaz0ZhTiU2iEjHWWGwXuDOs9zNpq60e/qhb
-    jhQ0viriWfemT3grpPm3mqUrOImvBgDP5MCTIC7yn9bs++n6MlI3pgIwUbxlLYj9
-    y7JKrZDwiqMhBBGmcJc6i6L6aPiC5ezfAln+vRnQYHYY1cfsH69SvqJLfM4GrLP5
-    y+oXCPnwuVotVr6+12z7RhkasGyRTSH85cmYZYmeDsTKTdvpT9ADlPa/09iMkVtQ
-    kF/P6BauMbqo2971IMTir7DsjbbXWBE6y2KhEJpmcQHKL8Bkf4g34aEg63DXPfQk
-    QW8yG4DGdDrUrQzYaRtSGgaisQ28GXsGAM3WGS+mqAZReOc00ecNKKjUX5saEuU6
-    IzEIvA/92JPrwyFBq6TTY28Tv9nkblAlmoVaHRPGCJAFcjbH0jmONHOzJKaOJzx/
-    uT9jBZPh2/6e6dq1hmTWrrgYW4ZWHYh3SCSEQS8oc7dhiPUGJy5idVosHy1TGRdI
-    4Do9X84hE8VDxrY96gCSitIwVNqxqDYnKImNYF+aEnYOJiVuzukS15uTK61w555X
-    D7vdBA4XSjFpIAEvqFE4jdBWAi09oqLzHNw6iQG8BBgBCgAmFiEEANPZ7fb3VHPW
-    C0w3UsTUTh9UzVQFAmRwcNcCGwwFCQPCZwAACgkQUsTUTh9UzVTCDwv/fUJxiNGZ
-    VBArNvxGoCVgewjisEAHsEg/X7dXYlQgHITbtV+lajCOXesuRy5hh3L/NPVDm9Yx
-    WB0oZ/sV/qM7yisvGmf6OFxSvaGPr/aQhwIdkXw42veHe32pROujpmclI4QzIV9P
-    4zOFUR0JHEaaJrS50S2VMmgX5fq2vBOQY8WIo8fUncPk1byeqwz9WfunPMZ+yc4C
-    KIdQ1ysd+YFq9mTwYei/ZFQFyk+X3xxoIhlMd1LkynXV/Swrv11WBxqk0HPaWgc5
-    WhUrK+gniZjPQVjOyHiKhu2rCBRXO1ipDdgdBX1aRe3XzsYJt0fI2qewm7ItxPk2
-    wbbrfDD3kRu19PbxZYxesKLr5Pj0suIPNI0VWp2Te6HkcRgB8+fR8DAtbOCbo8Oy
-    GgK0fz3gzhvhAUxoCRayo4iGTA6W4N+sryuOdDikRIirVxgksA2LLMwQzaSqllkh
-    AoH/WKXfBxOQo9qDcxdBnCkM0bZF5tgrNqYf1IN3bZr2pV4CYo3Z2JaL
-    =5CPG
-    -----END PGP PRIVATE KEY BLOCK-----
+     -----BEGIN PGP PRIVATE KEY BLOCK-----
+
+     lQVYBGhek70BDACvHapdTLVc35G2r/JtpIbUqPRTvAcox7phoQr2DGqjedFht+vk
+     GKS9MrlBT7reFXSZb81joZAVPgONdx5jbnZfxoiBLHBlwA8RYshhnShKzxvc3oHG
+     4KqzmhVWTeKznKw1YUiHvJasU02NRTm+iHZSX4/7u4TXVcJ/lIUcc36v0XXh9LbC
+     Yr4mwWgu2KzyTbDV8JJ9/hfsJMl5mpleCRpLh3oqpeAgWsOmstSHj9Smg6k+0W1e
+     OzmGA2cb8t1OOAVr9RfxPeRgGMmt5ljudPXmYH5+qEk0ez9ZkZLWlUjaiv7NrXNm
+     QRrJRUqw86pzzlIHBfp2aV8JTGJZf+r1i3XCq9JG03J16R6aRp6ZzLj3q/yod3NR
+     P213zkP1GAwgqf8EbIHuRdwzcwQwe3D6Bh2b610G9Z1JwRKLQJxRPln6i/tSVp2y
+     a0W00226frooNvQVf9Xu71AEoV5m/FxpWDJUvf3uoa0xFRyt7YrZNpLcWQfafQGC
+     622JqfrDwDvJu2sAEQEAAQAL/jpZSyPtZFz+zaGuvLuV36tKZKbl9wi6jDrtmyZi
+     +sFf3MmPrBUDtRippxrBA0XupjxeCXTSJ508XZisgT6mVuEQ2PkZopX0ydCENrp3
+     0C4lFmag6WMoBxjzFXr9VrV8VdEviihYSWhAFY4l69i1xZ8q4mIBmIDbvYQfK79Q
+     KH1S8NGKZb8dgbiOJzW80tul0W9nypgaq0Pu+gb/4Wx44f8atDUzsht1ws1vtus4
+     nKWjJyicRbHpUAB8b8XbRaxDc9WObeK+s9Dv6nAEn3se7TBEs8P1SD7OIR6iVuJD
+     DstuFtqw8ptIogssEVHKLd89R8RhHNmqYAj6fJ2+pknJ9RDqQuIp5Ell3gkZm1+G
+     JOexel1dL5eaWeN+tPULs+ARPKY16QrArimznq00jrw88A4/8WyIO2vYXHIpTmWC
+     vzjmv7VgfgQYnE+6Bmza1bCxFoaagWVAi1UDAAGoOF8hhHLfoHR8MtZqW0hsnA1s
+     FzpNVvSfxU03dnS7fdFZfwIW0QYAxP1XG0X1KMcVqD2ZMyRcFgDHdwQAZuTOB1dj
+     YjWnlj9DhIRC9wJ12VYUdtWy3NAec7zWkqMMd4AAOumPT1vCLtpA9+53jJrdYTix
+     nvrvXsnOXAzlwqiVzTxa78Hshy6TlV4XnQLCNf6f/IUe8tNUQIjpo8sZERxI/0IG
+     snEQRRLb6H8/poI8WA/n7XfMOzFrqx7LrGEyipXdHHkZ86o0zntyiH9sDPO5UA5u
+     RGjtDv/h7lRHX6hpBl9oEEKa4HSTBgDjkuGopr6apzU/ejaws1eHUOh7fXRmlUJu
+     W44o0W01v6jBAnzDARryCxV5WKVVtF5Ye8Ik5QF20S7N4a3n52HzOuczAe5jNrKf
+     Ofncr0rxAKMZS+iyH3uJCNlHipv2USYn8srcs405j+nBh3Fg34ZYRyazQF5+ukjF
+     2fpfMKU2ds5bjF6LMZY5ghH0EvZ3RrMgebqsgqSakq9wDD7AQ5tlgR6GKmv4eIrI
+     YNXRzCy1WBoMG6sV1GmxlkBw7y/tfMkGAMu+IiOdCeK+itN8Bx87I3qz5vopNJ8g
+     EMQXnh4B/xlWeOzgpZ+IXlZGgZ9puIVyD34usisYuAVbLfSjrWybsfociqow8oL3
+     0JqkU65tY/KeAdfsJI8R5RuJA0mAl5V43cDs5UczAKGrAVqRROZR1Fkm9tSnlta1
+     rYRXvuM8803NiVKEjsftcuJCzx5ZUknaWexMWg0rcUUlNpskeY+lRx0LmAUWS8nD
+     /Mu1KxTcaFw3d6En6mG1QXw/nJK4IkgWPNvPtCZUZXN0IFVzZXIgPHRlc3RwYXNz
+     cGhyYXNlQGV4YW1wbGUuY29tPokB0QQTAQoAOxYhBLfkd2sJqokFdJd/WeJ42+Ct
+     0N/BBQJoXpO9AhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEOJ42+Ct
+     0N/B5RIMAKKQ3g01zKA1eFa4H0JYRHxfzcZYAvgyh/2HxAYdHRnJC/JX/IC0B5Oq
+     AClj5uq+mDurSBeu9vp2E56hgZDyqrJFhBxNzcMNtrHYzT6YU3oYAMgzXywNHffw
+     Jem1lZjqTuFfb+xsTfcRppWh/HNjt8L8uTg4s0xtmTKb3zEDi2RMNHYvrJau/c2T
+     am46Go2NsrM9qMIwJ2xm6YGeTXi3pe7sfQ4m64ewe3wYETJmjZk6RUVlDLZonwVv
+     ty20Butbh1292s7wvIHhp86D3r8i9Q/dvmI7nixXJo2E79fOkymK/kcDEwedgZCP
+     /xb5tizS0+2vlk5BhWw/7thxuqfUbMJw3T6ttQe+yxE1/UcbfSC1i2pRHXHnw9sp
+     uNE9bc/iMbZ9ITcMmH/KLAYr0YLvnrDLPCB3Aes7L/3UmJ4ezkyzr/vQEEdAxxhU
+     oKB5UfRRcXClonQGTSkyygDlwt4YSVgnZMPQZZhyNV63Yo0NyfuF43h8al5sl2AZ
+     fxUpsl04VZ0FWARoXpO9AQwA3vuZO8AOOWFkVcHtAd2RZuhskK5CIlqxNGpy/GSg
+     90u6NcsEy16MXh01gFkVYtNPnXYcy1pcTzG+bW3p81u3Mrsri0xVIOTSWq8LPit5
+     acLDPCZ6QhrokUcMyqBlO9vy2W6ip1jOEzgYYta+My/lDVdcWXz/J573MABMgK9B
+     2G9UHbq5xbcfsdwUl7+HXkty5E8bJlDtMVNjUQGijai/OCiYZI98Le9tNup33/WR
+     ugyXwdWeKjjLGxn662sYcyyM8LRket9s4Z9hNIMgUpd/Pfb36PZ/bhB3MbdFwMxz
+     OjFN8XY2iN15X/G2Y30Fz9j0Xs14x3kzLwrDdR0iETw0ijW10G0HIxpIH2fcrgNY
+     vnuLvvZxYRuSwCSPS3alj3NOKZpD/IYdQeq8ZVfCmjq2yVxRyGDBJurzNY/REbmX
+     FFLEQLFaEPKy4eqyC6nMLIum1T8QIJAZiZM161Q8fJUQZ944O6TfHEFzTU+3TGDY
+     t79OLv8H7XpVBjQ6OTC0Srr3ABEBAAEAC/wMlJJZIiVLTHjeM8I87DTDYxKY+RPn
+     H0nHJMhXABBq011uooUjOjLeLnSxyJThzf08a4kFWhRCLZLKVryvy7lixdeXlNdq
+     sy5BCoYuXEKN2nysXJliOGVtqN4KYpFDls21Qb4whdyejfgmP2pctfOM1KRzsg8t
+     O5VDooiua/ThkqpiwQGxK3tAzCNnSlmHUudpBSOJfmBbe5JrZBW5O0+KihPK/KNr
+     bgox4nmf65lsr0Ayoew6AplG7qjO9mxbNySjhPHaIhB/bVuWwbOkEB3Y/itjFjpN
+     MzksN69qJte7ozza6jmV+rxSylj8BCPow9zNsgYGHy/LrP7FyLFwxRUIvg1FQYj/
+     SS0iNNw86x67R6yGAgGWIcjB1L7ji1FhXlbRpMuxhms/0tRds/uoghe+zsOlGVqq
+     YV8krd0q2rYVPLGg/VqBhPi7/FoGnmyao1DcepQ/FHCg1AqW3hh8YHE+Htb8dwb2
+     1S25r+108Es1q/OaYF0+Dfc+Wve+WMgNGKkGAOQoRmGdeTJoxdhm0TNmyR4ZB5es
+     M0fjT6u7jV1A/P6UjvtsYSpr2nVxGjKVCLazLlTLJ977ZlLFJkOYE2ootjAn2CUy
+     EqsF4BjWFvex3h4QSLv5SJEEj325/OqnOw3u4yAWJqd3ukwE2H7ZRgToCPPn4jTV
+     6mx6DBsQIKwwgRzrntM+23/EaNgawBd0xVCiHRKn+D+YoTJ/1dni39+oafzg8th7
+     LF9KAKgu23rqK7nZx/3jNl/ePvN+ECIhB1SFyQYA+jGrcEImifCS1fr6oriGIumC
+     bBx4kanbb+gm5pc0kFvxCvEvdyOJRymzL9MMyWdM+dq7hYEGgkeXQSKE10wkZEuN
+     40FyE1RRFQFrTimfkim1exOetk72i/HX+ZCoqrtpwesLjQ9w01gDOjX4uVfI8lNY
+     JkDgXtbZ4Dx4tz4J0a9MoxJcTdmzLRUB2HtJLssTCN5s47kkrzxnPYiIBp47aM19
+     p7SgBP8p4yc36UxLBnh+PdmwoxfTKz24uqElwJq/Bf9qp/im5jZOg0ckmsLhrkdO
+     8RK374y/EbVdERQPpeoCd8YYqTLHVmM0d2rWInOEJU6qRxkDniFUGqL+nknEz5vt
+     gdp97dQzS1morXWHEWKRK0+zEwKF8jn5erG0JXuAf/nv8Mg9wXirp+32C44NRuou
+     Lc6gHzuDU+JxCo/jp+zzoZRCAvQzST6eUXeOH4p7OrVqptmvEmh/8shaTVR5oplS
+     vzEvE6YQoBnGubGz5Ws86EYl5k6WG9jbzYA9owK6H6XcMIkBtgQYAQoAIBYhBLfk
+     d2sJqokFdJd/WeJ42+Ct0N/BBQJoXpO9AhsMAAoJEOJ42+Ct0N/BA2YMAIPW36GV
+     JIabrkO279usvW4GNW12pjJmgXXf5NQO3uFPa0RtgvjWP5rBZFqXb8EHXgX3RGqm
+     kqaTfS0L8C0EnueFH9NuFP48HZ4uXWp2cOS/YBdbB/nw/b3kavppIvSJf5vT1XwY
+     eMUKSXGRU7pHJuRqu1b2IDP3Jf3bOjQS7je/eoYeUBcWxa6CZu7ehj6RfLHehgHI
+     g/lm7K/bZLXT9uZifxYo7lQo48a9MdxzgL/6+vQQiU7UFCMJgognNbaR5qBP8ilY
+     BL1JC9Yjcrx0ple8M5S50gDqiIs3ZVs23fzh8sGOrftabI1Av0S4pzifIiEiGzg4
+     zIJDmms+QvWJ0XmkVeQrl9XPdww7RKiHSdksj/8XuEwhraI4pz41CQbYu+ceE0wz
+     CvJeTuwm4ybp5SZ7l8y3wcRmHEVoBfYa4dhjezM2NT3J/4MYj4SrQK5wDfaV3hNW
+     FelDv0SQJtioAMa/1isFK/eyqeEwnWafWzowtELLHrz5LMzgUTxclOqsWQ==
+     =t+01
+     -----END PGP PRIVATE KEY BLOCK-----
 
 jobs:
   upload-gpg-no-passphrase:
-    runs-on: ubuntu-latest
+    runs-on: docker
+    container:
+      image: 'data.forgejo.org/oci/node:24-bookworm'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-upload
         uses: SELF@vTest
         with:
           direction: upload
-          tag: v1.2
-          token: FORGEJO_TOKEN
+          tag: v1.3
+          token: FORGEJO_TEST_TOKEN
           release-dir: upload-dir
           release-notes: "RELEASE NOTES"
           gpg-private-key: ${{ env.gpg_private_key }}
@@ -107,8 +109,8 @@ jobs:
         uses: SELF@vTest
         with:
           direction: download
-          tag: v1.2
-          token: FORGEJO_TOKEN
+          tag: v1.3
+          token: FORGEJO_TEST_TOKEN
           release-dir: download-dir
           verbose: true
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}

testdata/upload-download/.forgejo/workflows/gpg.yml

@@ -5,102 +5,36 @@ on: [push]
 env:
   gpg_passphrase: admin1234
   gpg_private_key: |
-    -----BEGIN PGP PRIVATE KEY BLOCK-----
-    
-    lQWGBGRwcUEBDACzKYvl19Gqzdu2rwLx+Me+GvJkSemnvxdPvZhg+94uLmn+9oZp
-    jmaLA8Kbjb73zfitKOdJojRKuBwyNtP7iPt85nWeWwq4LKHCQUo81Uh4lzv/0N58
-    PNwFdRCHtD8MnhBRNv/kwccXyriikVbbi/dj+ISdKE7ueZ7SjgMFAa8JouiFldqZ
-    uU7FgxaFxQ5o5NqTJF4XOdZQakW2A5PhLDmEMQ/fPJ5gFXPBzu+yCvAo0G6QkcJ5
-    43mEOpJQwS79I1a8oS5txGiV0jP8PtyyAdIGuPW2B3oxmaNXllttYg2pnYR0Tr96
-    5uMr8B2wcBdWAewH1wP0QKcKol5vxYuSwCOkwIjXtSLWMpYjtaS4FcWObUhvJiDI
-    ypjLn1y2H6hW3oNT9W5nvaEgWqafdwBhF2BQJYcxAAmqIoIRY8k/JMLKuG6xdM4b
-    opCCo37syvcHU4jNvXu7vr/8w7Y5Wc/yIVQARcm65DAZ3OPmIYKp8BDUnDgweUZj
-    WaOWdYGB7+c8rDUAEQEAAf4HAwKdrS9IwGeeff9kQReq6FHd6Pp8KB807eqDBUAj
-    BnUUtIE3iK2HJ++GohBXZemzTu4zl62krIGwWcwoqfckv9dIkWioem9JMbL7q4Jm
-    6IChJ+EFvV6+I+C0lzM7L1lgKp6NZdcCnpfpSMrInVqzUqe4EbNaTDX5sN2IwdzR
-    8rorZcQSL/ncDXg7vAhBtiKArtfyIPsWoxvEcPJ42ZMY3qM5p8zFmzoJsDwO2MWc
-    K+UFrXJYZG43NoAOR5g7A+tHdcPLdQ/FT87tamyyULrVWnS6hDser4KlBN+Ez7bt
-    GACWa2bYee+fn0VssWGhGxeV6coICmNENPRFtiQYMhvIbdS22Np+7ym6+7XJ6P0g
-    f0iVi+3t3THXIJ84A/3uNnT2QG8BGmABsNzqK9TVMtHb4u8zLt6oG68WfnEumUo8
-    ycm4PPstDuhd623b/aaqvD51tDsZR4GRYruM+LeHKGi6UYMCUutoUvna1aRgnz8D
-    OCxz2emm+xsayz/+wo7UbD6CiTC9SPK0eAMYCghl0/wOcUFfp2hb8S7xzHg+HSEe
-    vSUjM0V1Qf6l2AfsaWy1Yy/0ZtRtBNyxVkSwsmbvvUif9lXZNYsOnMSOTV4rmYwo
-    QzKirhonkTkYv62GBRJZTYEVENrY9qUGrkYgCluGrVVNzFw2rTemvqX5IskMaaAZ
-    EW4tSlP0fWs4DNiQQutCmKO/0FVgl1uWy2kSDEqSTE3/kT8Y+9hlj/itM9n7J4DT
-    EqOhPZPit23OG5ahbGPUEODjXONmAlbwXmEUGf9KsnOaCRv2xYW9iT7fJrA7ivbV
-    /DVwIprkbA6ACuSg4Fia+5DibxXh/JfSU3R9o1ugspZ9wbE8ay5GPbKrqSTT1Jlu
-    JB0eY3HEDMEtVqbItedV2D7a/V5nfW3tZrIma0MyE7kAfJ3+ZqXWXww9ASLTUoZO
-    wT9VFj8ktF+4fjKIHoycR8IInl56T4xhoz9CTzaHOvk8GHZF4+FX+G2/IkFdinkb
-    Qbia26fGoS51o/rqzIHo4T15oBWXLSx7oHQhyyypzeRHmOKiStUI/rBnghl2Q8oJ
-    xE/PUtXJDPkJHwc6cSCTV81G2kRQVh4iZg9ixJsXvNdAlB1GGOJH3VDuxPPCRq3s
-    zJAPXOO28TwHyTipiw/wJ8Soyg4xpyoI2cp/CNpdo5f1mAruPr7XrdOHkl3obxRe
-    OCVCmyevgg1PX9uV4JncRtsiFje+RJFuLTjkMVZLmccnUNqi/CpA5dPmHkg+0uK1
-    1MVB+SJvjqr7ag+WbJuecuE84VD5Gr66CinOywfluRA+pLGdCIuxRZdTmgiVeh5S
-    bH3jhXBljzhFK2I9GJ0RVKDRsdu6iOrEW7QmVGVzdCBVc2VyIDx0ZXN0cGFzc3Bo
-    cmFzZUBleGFtcGxlLmNvbT6JAdQEEwEKAD4WIQTG5NstFF+myfSEwuHX3t0O/q5z
-    ogUCZHBxQQIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDX3t0O
-    /q5zolo2C/429RV2EhFG5EYKfLCd72ANLzUX9Kezk8tq3JDOYkRuqGF2y6HzuAcx
-    DYytRoyxTkCpxiuwPnxnU76cSSxn5+UZD+0sa5OGZYMtrCVSd56dXQkK0drf+RUo
-    apFLC6ufWmHox74ZIuTyPLj4YlsbSU3mE8CqVWY4Svk5W920wZDS7lrHSkXtKqh2
-    QtE/7/mTXCxu1HNqfck5ROIbA0MTKX2FG+3gujjJcZBEI8nkIdvI0XouOHXLZLKq
-    kh8//w1XsQeielOXO/+pQyT3lSwcZry4F112S4bMO+R12uWO6Hxwe9LoQb3gDmO5
-    H9LsssdpHC+bhJnTURGixiMuyzjFSmfVzzgU2YeP69R+GHxLMwMAo/a89eWFxiZI
-    6jMOx7TgYC9fg+Z8weTBq8fy8E5tT/LJm2VrBm3vuTgC4MePdBDy+AuEPyt3J2fX
-    1KS2vNlASeh6ONhMk+BMVWG0KWs3GVyF2DcXUCTX1xVI9uT+eJSR7UPJ+kRnIfO0
-    RzxL30Qxvw6dBYYEZHBxQQEMAMDLFiDTpnqsjH9li97yBOdG3SOu9EttdQXXopdh
-    EPJDxDCBHqfZvfjHuA5gfIP8bghQsXYCnn5k6dHZHdkJ9LfJTj8Wyh2cumhxPO2e
-    wbOmhQgLC54hmi0s64tj9GxM95aZk8umkTdXt+F9a4WihHGlgeCdpq+B6EQodDCU
-    ysJgnlCUGgjK/ptl4PhQtsgXk/mw0oOQukoulFFkfdlLEhWYNMz0/5oAMdGLa//W
-    8cjK2E5UN3/1PFF1nvzsHca/fGb1JvUwgrTjeJC4H10Vo4KvmYkpb943auoGJEJU
-    QbM/A7cDQvzB1OD/UpG6vYmarXCjGe2ZrJs+RI+bXMXLfsdCveLo1DPhpF7hLD+t
-    F2NI9oM/cEXuQBwl3mLOjFOn0Q1jXDD0uyzEJN7DKlnITyBV87hv2+hMGftnQwmX
-    iXw8rkBeaDLl4ShG3MLCr8KpcvtgtVf9ceZxO6K0CGTj+VSfKQ34HrWEoNzNoRoM
-    5dSPK6YXNRL2JizVRrAkVoRCzwARAQAB/gcDAqMHMJr6Gorz/9bZTyXQGO/oXkN8
-    D+G3Gn0n0iAmsH1nBo1qo61JosRAhhO+Z286F33tS/TqcblQVCsgPYFN93qX1yoB
-    RON619o3s+mF9PtSLvbUDdUa04eLarhH3RoCkkpoh+3df0xw+Jtpx2+eZibo32vb
-    U0e9lIO9Kv1I11Y2xSymFTzO+hK7IKYAvP9uzYty/r0rcgotJHr4B+k5jCQHXZhW
-    u0/68b7Y/JOUxKSag5r3PyyDWyJibRGi2ILwKogL5D4YdAtZYUNemmK9Is31NIs/
-    6jWHedOuRsBlM46NwwJs8ybtqy0TLDQhfrn2jUY/U+BMWSV4u8Ra33PaOyqv/EeN
-    hbySg2DTVnAlxzdw/z7oDPROtW1FzdFPVvOAUYOGuzlEhVAVzdhX9EfBahMIy7/B
-    sSlKoFOCMOngsnFrmxAMbUW49ZoTRzAunTVFNgqQJZLHmzPiyyierNP5FzjG+wO+
-    lprurp8RXFQ2KQ5hoF8Mw+F4V+mP+RAtO5P05rcp/PJafwdvxS03LZZchB3hRWQi
-    pGBum37nxN4ztbduUwWk+DKgB1pkPthF+i2cKlBgNzL/bfbmJoiIZghUKIgCZoXp
-    3PRwa2DM4CoFoC5FuhFV50CpqbrVeZAAK2Q3InphbdWZb5os9YqFfteLzk316zCj
-    vqftiZ4C5WPqMtesLGSeXNOna8vm5AOzt8qohmrLhdoONxBqf3sbykyzU567AWtm
-    P02u1JWQgGJnsRO+3j441VSK5SSmolCdDP+LspfZPCRZel+pBwlTJ6IpuFxB7zj1
-    UpkfT6r//bVfriwe6rFZ0VI3BfefJLrCIrgI0V/IFu1rjcciNV1PXwAdJNNhN3X4
-    4zPktSVR8u/Nz8jNgdSgXBYMkuv+QTjvzBvCMu5tP7ufXVXG6jAEJHeUh+633HGJ
-    o6NTsOZFhYwLmwTh4CBplt7bclsysOQGgo3SWHO3axCWrRX9uNVq0uIKjl3CHkqW
-    3dbQzFlY3raWT9q19g3cuiA8BZqh/NswIQDrOFS4pGrbTQFWY0zQZqFlHEyVCgwb
-    TtbcpjOBy3O2fsbFvepYDbcTYbmcacZSZFtTMiQGt3Ga+TeGsO+VIUzNgmpLkyWS
-    1QQjvqNKZnKWT6f4A7Lbj1OZqG/v4540jmOxShcHrz2Klwdrra6Ie7yERYmyPMZJ
-    98r2BFk04QaYK7r9xy7hJGBDmwT0VOcJXDAVA3HJJHGltnNKke2vP95JLmyahORP
-    efEsi0UPsQqkCS7iWV9ucUtKEnYzoHFSeSXU64+Cme6T+7FxJ9E2f5Ep88nz7ucg
-    EwgSiWsdqzEjntq5MAr6rSSk8ZKPzRbR61exuf7tWRa1iQG8BBgBCgAmFiEExuTb
-    LRRfpsn0hMLh197dDv6uc6IFAmRwcUECGwwFCQPCZwAACgkQ197dDv6uc6K7qQv/
-    brSaC5ICGKIpzsIf6lIp6Wrn7smsGh9BI+dH19prXQ5lT6Iv+IFZmNiDGXtVzOOK
-    Y8VgqwJmf/XwjgH2dod3X61ts3krtnZ2znCgrz08NRxG4G9ok8Fa5fLCrZBWi7UU
-    4ZH63rS9optmqEMzwCwQ94U0glU8C9Hc44MVCSrrrD2+/H/PTFVr37iwBugZsDq4
-    4gUTyGBYumnzTVyi2ZbJn89Amd8fl280QWSkdebmljnk4OjlTZbXkRGiIu65ggr9
-    ikg11TRlPD0L9NTo8w2OtjoYXr50xL1odyNlz6RKcQlX80EjKMXvVxNE32J4JCBj
-    tHrqiTDCs1bdXTh2xCvF0DatJMeUn3/WDn6UYjZzlZvZCOcjQLrPgJplJowLwd96
-    YaUfZ11WNAgNy8vZjUroMNyD2J+GsLr+QZOqFRP362+Juj5MqANXAuKEQ4qzs2Fv
-    /Z6cUYKuENmsNDY8ORG7ON95AFl5i0daP7+EoHDMb7+tyG54JxE4Szxhe4skRXXr
-    =Ze5I
-    -----END PGP PRIVATE KEY BLOCK-----
+     -----BEGIN PGP PRIVATE KEY BLOCK-----
+
+     lIYEaF6UehYJKwYBBAHaRw8BAQdAPKJ2JvwUyE7dy8bjVgBCjdRXSTw2BPl6wayP
+     o0WwhvT+BwMC8CxbenuzELD/Z524BTjgiXXgPS8rnRkSqww5Swa0d4mhtTn2w0pq
+     jRnHmVyLhh9n7e8GZaS9+8CFu3UWtkHgbRrzdyRg9KuFaW0ogcWA5bQmVGVzdCBV
+     c2VyIDx0ZXN0cGFzc3BocmFzZUBleGFtcGxlLmNvbT6IkwQTFgoAOxYhBF3PQjaj
+     rT/hLkdhdu9/tDIYmfSXBQJoXpR6AhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4H
+     AheAAAoJEO9/tDIYmfSX0zsBAJ4Tay/2jNMqye9RfiEn6B5e5IO+QymL52q6bF1z
+     ZNLDAP94yfwvG+7fL6W3XOTUr9unsCU9W0T0lAfFLmZY2WoeApyLBGhelHoSCisG
+     AQQBl1UBBQEBB0BMy3qqyiYPkalTZNUw/VSgHEOJF0Yi6fFi+DnEWtapKAMBCAf+
+     BwMCla2r1+brAiD/zuhRDXfJC1oRoEnDq/JgmsU14t6PNCPK6MPA+dmV3kCIVbjy
+     A97PMx6HBSTJZYdzGY8e2XdwzrVG4vbzH2yJ55LbawgFYIh4BBgWCgAgFiEEXc9C
+     NqOtP+EuR2F273+0MhiZ9JcFAmhelHoCGwwACgkQ73+0MhiZ9JeinQEAip+eryNU
+     T9X80S4YilMZg7djkmGfMJnEZiKYU8TEsFQBAN2D3PDAVNKs2ZOVp1GQMDse7sQ6
+     5C3faX2ZMchuKLwF
+     =RH4D
+     -----END PGP PRIVATE KEY BLOCK-----
 
 jobs:
   upload-gpg:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-upload
         uses: SELF@vTest
         with:
           direction: upload
           tag: v1.1
-          token: FORGEJO_TOKEN
+          token: FORGEJO_TEST_TOKEN
           release-dir: upload-dir
           release-notes: "RELEASE NOTES"
           gpg-private-key: ${{ env.gpg_private_key }}
@@ -112,7 +46,7 @@ jobs:
         with:
           direction: download
           tag: v1.1
-          token: FORGEJO_TOKEN
+          token: FORGEJO_TEST_TOKEN
           release-dir: download-dir
           verbose: true
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}

testdata/upload-download/.forgejo/workflows/test.yml

@@ -4,16 +4,16 @@ name: Upload (and download) a release to (and from) the project that runs the wo
 on: [push]
 jobs:
   upload-download:
-    runs-on: self-hosted
+    runs-on: lxc-bookworm
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-upload
         uses: SELF@vTest
         with:
           direction: upload
           tag: v1.0
-          token: FORGEJO_TOKEN
+          token: FORGEJO_TEST_TOKEN
           release-dir: upload-dir
           release-notes: "RELEASE NOTES"
           verbose: true
@@ -23,9 +23,10 @@ jobs:
         with:
           direction: upload
           tag: v1.0
-          token: FORGEJO_TOKEN
+          token: FORGEJO_TEST_TOKEN
           release-dir: upload-dir
           release-notes-assistant: true
+          hide-archive-link: true
           override: true
           verbose: true
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
@@ -34,7 +35,7 @@ jobs:
         with:
           direction: upload
           tag: v2.0
-          token: FORGEJO_TOKEN
+          token: FORGEJO_TEST_TOKEN
           release-dir: upload-dir-v2
           release-notes: |-
             No shell expansion should on these notes:
@@ -50,7 +51,7 @@ jobs:
         with:
           direction: download
           tag: v1.0
-          token: FORGEJO_TOKEN
+          token: FORGEJO_TEST_TOKEN
           release-dir: download-dir
           verbose: true
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
@@ -61,12 +62,65 @@ jobs:
         uses: SELF@vTest
         with:
           direction: download
-          token: FORGEJO_TOKEN
+          token: FORGEJO_TEST_TOKEN
           release-dir: download-dir-v2
           download-latest: true
           verbose: true
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         run: |
           diff -u upload-dir-v2 download-dir-v2
+
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        id: release-upload-slash-in-tag
+        uses: SELF@vTest
+        with:
+          direction: upload
+          tag: v/3.0
+          token: FORGEJO_TEST_TOKEN
+          release-dir: upload-dir-v3
+          release-notes: "RELEASE NOTES"
+          verbose: true
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        id: release-download-with-slash-in-tag
+        uses: SELF@vTest
+        with:
+          direction: download
+          tag: v/3.0
+          token: FORGEJO_TEST_TOKEN
+          release-dir: download-dir-v3
+          verbose: true
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        run: |
+          diff -u upload-dir-v3 download-dir-v3
+
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        id: release-upload-v4
+        uses: SELF@vTest
+        with:
+          direction: upload
+          tag: v4.0
+          token: FORGEJO_TEST_TOKEN
+          skip-assets: true
+          verbose: true
+
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        id: release-download-v4
+        uses: SELF@vTest
+        with:
+          direction: download
+          tag: v4.0
+          token: FORGEJO_TEST_TOKEN
+          release-dir: download-dir-v4
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        run: |
+          if [ ! -d download-dir-v4 ]; then
+            echo "Missing download dir"
+            exit 1
+          fi
+          if [ ! -z "$( ls -A download-dir-v4 )" ]; then
+            echo "Unexpected download files: $( ls -A download-dir-v4 )"
+            exit 1
+          fi
+
       - if: failure()
         run: docker logs forgejo

testdata/upload-download/upload-dir-v3/file1-v3.txt

@@ -0,0 +1 @@
+FILE1-V3

testdata/upload-download/upload-dir-v3/file2-v3.txt

@@ -0,0 +1 @@
+FILE2-V3

testdata/upload-download/upload-dir/file 3.txt

@@ -0,0 +1 @@
+FILE3