Publish curated ForgeFlow source from 63022ccf9a37242d573297c8ce7f15db61acc34e

.gitea/workflows/release.yml

@@ -1,16 +1,23 @@
 name: ForgeFlow signed release
 
 on:
+  push:
+    branches: [main]
   workflow_dispatch:
 
 permissions:
   code: read
   releases: write
 
+concurrency:
+  group: forgeflow-signed-release
+  cancel-in-progress: false
+
 jobs:
   release:
     if: ${{ gitea.repository == 'Jens/ForgeFlow-Public' }}
     runs-on: windows-native
+    timeout-minutes: 90
     steps:
       - uses: https://gitea.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
@@ -19,7 +26,8 @@ jobs:
         with:
           node-version: 22
           cache: npm
-      - name: Validate version bump and build release artifacts
+      - name: Select versioned release
+        id: preflight
         shell: powershell
         env:
           GITEA_EVENT_NAME: ${{ gitea.event_name }}
@@ -40,12 +48,24 @@ jobs:
           }
 
           if ($env:GITEA_EVENT_NAME -eq "push" -and $previousVersion -eq $version) {
-            Write-Host "package.json changed without a version bump ($version); no release will be published."
+            Write-Host "Source changed without a version bump ($version); no release will be published."
+            "should_release=false" | Out-File -FilePath $env:GITEA_OUTPUT -Encoding ascii -Append
             exit 0
           }
           if ($version -notmatch '^\d+\.\d+\.\d+$') {
             throw "ForgeFlow version '$version' is not a stable semantic version."
           }
+          if (-not (Test-Path -LiteralPath "PUBLIC_SOURCE_MANIFEST.json")) {
+            throw "A signed release must be built from the curated public source."
+          }
+          "should_release=true" | Out-File -FilePath $env:GITEA_OUTPUT -Encoding ascii -Append
+
+      - name: Build and validate release artifacts
+        if: ${{ steps.preflight.outputs.should_release == 'true' }}
+        shell: powershell
+        run: |
+          $ErrorActionPreference = "Stop"
+          Set-StrictMode -Version Latest
 
           & cmd.exe /d /s /c "npm ci --no-audit --no-fund"
           if ($LASTEXITCODE -ne 0) { throw "npm ci failed." }
@@ -65,6 +85,7 @@ jobs:
           if ($LASTEXITCODE -ne 0) { throw "ForgeFlow checksum generation failed." }
 
       - name: Sign and publish validated artifacts
+        if: ${{ steps.preflight.outputs.should_release == 'true' }}
         shell: powershell
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}