Fix publish_release.sh to upload installer + AppImage; document host REQUIRE_SIGNIN_VIEW

- Script uploaded only the three portable binaries; v0.2.1 release was
  missing step-line-setup-0.2.1.exe and the AppImage. Now uploads the full
  set (extras when present), reuses existing releases (adds missing assets),
  and falls back to ~/.git-credentials basic auth when GITEA_TOKEN is unset
- Back-filled both missing assets onto the live v0.2.1 release via API
  (release now carries all 5 artifacts)
- TODO/RELEASING/MEMORY document the findings and the host admin steps for
  anonymous downloads ([service] REQUIRE_SIGNIN_VIEW)

tools/publish_release.sh

@@ -2,8 +2,9 @@
 # Publish a release to the Gitea/Forgejo host, uploading the built artifacts.
 #
 # Requires:
-#   - GITEA_TOKEN (a token with write access to the repo)
-#   - build artifacts from tools/build_releases.sh (or already exported)
+#   - GITEA_TOKEN (token with write access) OR credentials usable for basic auth
+#     (e.g. the same ones stored in ~/.git-credentials by `git push`)
+#   - build artifacts from tools/build_releases.sh (+ optional installer/AppImage)
 #
 # Usage:
 #   GITEA_TOKEN=xxx ./tools/publish_release.sh [version]
@@ -12,45 +13,69 @@ set -euo pipefail
 
 REPO="${REPO:-zwitschi/security-game}"
 HOST="${HOST:-https://git.allucanget.biz}"
-API="$HOST/api/v1/repos/$REPO/releases"
 VERSION="${1:-$(grep -oP 'config/version="\K[^"]+' project.godot)}"
 TAG="v$VERSION"
 
-if [[ -z "${GITEA_TOKEN:-}" ]]; then
-  echo "error: GITEA_TOKEN is not set (see docs/RELEASING.md)" >&2
+if [[ -n "${GITEA_TOKEN:-}" ]]; then
+  AUTH=("Authorization: token $GITEA_TOKEN")
+elif [[ -f "$HOME/.git-credentials" ]]; then
+  CRED="$(python3 -c "
+import os
+for l in open(os.path.expanduser('~/.git-credentials')):
+    if '$HOST'.split('//')[1] in l:
+        print(l.split('://',1)[1].split('@')[0]); break")"
+  if [[ -z "$CRED" ]]; then
+    echo "error: no credentials for $HOST in ~/.git-credentials" >&2
+    exit 1
+  fi
+else
+  echo "error: set GITEA_TOKEN or provide ~/.git-credentials" >&2
   exit 1
 fi
 
-# Artifacts must already exist (run tools/build_releases.sh first).
-printf -v BS 'build/step-line-linux-%s.x86_64' "$VERSION"
-printf -v BS_WIN 'build/step-line-windows-%s.exe' "$VERSION"
-printf -v BS_MAC 'build/step-line-macos-%s.zip' "$VERSION"
-for f in "$BS" "$BS_WIN" "$BS_MAC"; do
-  if [[ ! -f "$f" ]]; then
-    echo "error: missing artifact $f — run ./tools/build_releases.sh first" >&2
-    exit 1
+# Artifacts that must exist (run tools/build_releases.sh first).
+portables=(
+  "build/step-line-linux-$VERSION.x86_64"
+  "build/step-line-windows-$VERSION.exe"
+  "build/step-line-macos-$VERSION.zip"
+)
+extras=(
+  "build/step-line-setup-$VERSION.exe"
+  "build/step-line-$VERSION-x86_64.AppImage"
+)
+all_artifacts=("${portables[@]}")
+for f in "${extras[@]}"; do
+  if [[ -f "$f" ]]; then
+    all_artifacts+=("$f")
+  else
+    echo "note: optional artifact missing (skipping): $f"
   fi
 done
 
+API="$HOST/api/v1/repos/$REPO/releases"
 echo "==> Creating release $TAG on $HOST/$REPO"
-RELEASE_JSON="$(curl -s -X POST "$API" \
-  -H "Authorization: token $GITEA_TOKEN" \
+RELEASE_ID="$(curl -s -X POST "$API" "${AUTH[@]}" \
   -H "Content-Type: application/json" \
-  -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"body\":\"Step Line $VERSION — playable prototype. See README for controls.\",\"draft\":false,\"prerelease\":false}")"
+  -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"body\":\"Step Line $VERSION — playable prototype. See README for controls.\",\"draft\":false,\"prerelease\":false}" \
+  | python3 -c "import sys,json;print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)"
 
-RELEASE_ID="$(echo "$RELEASE_JSON" | python3 -c "import sys,json;print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)"
+# If the release already exists (tag already pushed), reuse it.
 if [[ -z "$RELEASE_ID" ]]; then
-  echo "error: could not create release; response:" >&2
-  echo "$RELEASE_JSON" >&2
+  RELEASE_ID="$(curl -s "${AUTH[@]}" "$API/tags/$TAG" | python3 -c "import sys,json;print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)"
+fi
+if [[ -z "$RELEASE_ID" ]]; then
+  echo "error: could not create or find release $TAG" >&2
   exit 1
 fi
 echo "Release id: $RELEASE_ID"
 
-for f in "$BS" "$BS_WIN" "$BS_MAC"; do
+for f in "${all_artifacts[@]}"; do
+  if [[ ! -f "$f" ]]; then
+    echo "error: missing artifact $f — run ./tools/build_releases.sh first" >&2
+    exit 1
+  fi
   echo "==> Uploading $(basename "$f")"
-  curl -s -X POST "$API/$RELEASE_ID/assets" \
-    -H "Authorization: token $GITEA_TOKEN" \
-    -F "attachment=@$f" >/dev/null
+  curl -s -X POST "$API/$RELEASE_ID/assets" "${AUTH[@]}" -F "attachment=@$f" >/dev/null
 done
 
 echo ""