ci: release notarized Meetingnotes updates through Gitea

scripts/publish_gitea_release.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+"""Publish both signed assets together, keeping incomplete uploads as a draft."""
+import json
+import os
+import urllib.error
+import urllib.parse
+import urllib.request
+from pathlib import Path
+
+base = os.environ["GITEA_SERVER_URL"].rstrip("/") + "/api/v1/repos/" + os.environ["GITHUB_REPOSITORY"]
+token = os.environ["GITEA_TOKEN"]
+version = os.environ["VERSION"]
+
+
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args, **kwargs):
+        return None
+
+
+def request(path, method="GET", data=None, binary=False):
+    body = data if binary else None if data is None else json.dumps(data).encode()
+    req = urllib.request.Request(base + path, method=method, data=body, headers={
+        "Authorization": "token " + token,
+        "Content-Type": "application/octet-stream" if binary else "application/json",
+        "User-Agent": "Meetingnotes-release",
+    })
+    with urllib.request.build_opener(NoRedirect()).open(req, timeout=120) as response:
+        raw = response.read()
+        return json.loads(raw) if raw else None
+
+
+release_dir = Path(os.environ["RUNNER_TEMP"]) / "meetingnotes-release/release"
+assets = [release_dir / f"Meetingnotes-{version}.zip", release_dir / "appcast.xml"]
+for asset in assets:
+    if not asset.is_file() or not asset.stat().st_size:
+        raise RuntimeError(f"Missing release artifact: {asset.name}")
+release = request("/releases", "POST", {
+    "tag_name": "v" + version, "target_commitish": os.environ["GITHUB_SHA"],
+    "name": "Meetingnotes " + version, "draft": True, "prerelease": False,
+    "body": "Developer ID signed, Apple notarized, and signed for Sparkle updates.\n\nBuilt from main at `" + os.environ["GITHUB_SHA"] + "`.",
+})
+for asset in assets:
+    request(f"/releases/{release['id']}/assets?name=" + urllib.parse.quote(asset.name), "POST", asset.read_bytes(), binary=True)
+request(f"/releases/{release['id']}", "PATCH", {"draft": False})
+print("Published Meetingnotes " + version)