Build, test and release on the club Gitea

A Forgejo workflow builds and tests every push and pull request on the
club's docker runner. A v* tag also assembles the plugin zip, checks it
with OpenAC's own plugin checker, and publishes a Gitea release with the
zip, its checksum and plugin.json.

The checker refused the manifest: both permission notes were over the
launcher's 120-character limit. They are shorter now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -0,0 +1,103 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  pull_request:
+    branches: [main]
+
+env:
+  # The OpenAC release whose AcDream.Plugin.Abstractions package this plugin
+  # builds against. PluginApiPackageVersion in Directory.Build.props has to
+  # name the same version.
+  OPENAC_API_RELEASE_TAG: v0.1.19
+  OPENAC_API_VERSION: 0.1.19
+
+jobs:
+  build-and-test:
+    runs-on: docker
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install the pinned .NET SDK
+        uses: https://github.com/actions/setup-dotnet@v4
+        with:
+          global-json-file: global.json
+
+      - name: Fetch the plugin contract package
+        run: |
+          set -euo pipefail
+          mkdir -p packages-local
+          curl -fsSL -o "packages-local/AcDream.Plugin.Abstractions.${OPENAC_API_VERSION}.nupkg" \
+            "https://github.com/eriknihlen/OpenAC/releases/download/${OPENAC_API_RELEASE_TAG}/AcDream.Plugin.Abstractions.${OPENAC_API_VERSION}.nupkg"
+
+      - name: Build
+        run: dotnet build OpenAC.MosswartMassacre.slnx -c Release --nologo
+
+      - name: Test
+        run: dotnet test OpenAC.MosswartMassacre.slnx -c Release --no-build --nologo
+
+  release:
+    # Tag pushes only, once the build and tests are green.
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [build-and-test]
+    runs-on: docker
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install the pinned .NET SDK
+        uses: https://github.com/actions/setup-dotnet@v4
+        with:
+          global-json-file: global.json
+
+      - name: Fetch the plugin contract package
+        run: |
+          set -euo pipefail
+          mkdir -p packages-local
+          curl -fsSL -o "packages-local/AcDream.Plugin.Abstractions.${OPENAC_API_VERSION}.nupkg" \
+            "https://github.com/eriknihlen/OpenAC/releases/download/${OPENAC_API_RELEASE_TAG}/AcDream.Plugin.Abstractions.${OPENAC_API_VERSION}.nupkg"
+
+      - name: Build
+        run: dotnet build OpenAC.MosswartMassacre.slnx -c Release --nologo
+
+      - name: Assemble the release assets
+        run: |
+          set -euo pipefail
+          bash tools/build-release-zip.sh Release artifacts | tee build-zip.out
+          cat build-zip.out >> "$GITHUB_ENV"
+
+      # The tag is the version the release is known by; the manifest's version
+      # is what an install reads. They have to agree.
+      - name: The tag has to name the manifest's version
+        run: |
+          set -euo pipefail
+          if [ "${GITHUB_REF_NAME}" != "v${version}" ]; then
+            echo "Tag '${GITHUB_REF_NAME}' does not name the manifest version (v${version})." >&2
+            exit 1
+          fi
+
+      # acdream-plugincheck is the OpenAC launcher's own install code, built
+      # from the same OpenAC release the contract package comes from.
+      - name: Check the zip with the launcher's own install code
+        run: |
+          set -euo pipefail
+          git clone --quiet --depth 1 --branch "$OPENAC_API_RELEASE_TAG" https://github.com/eriknihlen/OpenAC.git .openac
+          dotnet run --project .openac/src/AcDream.PluginCheck -c Release -- "$zip"
+
+      - name: Publish the release
+        env:
+          TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+        run: |
+          set -euo pipefail
+          api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
+          body=$(python3 -c 'import json,sys; print(json.dumps({"tag_name": sys.argv[1], "name": "Mosswart Massacre " + sys.argv[1]}))' "$GITHUB_REF_NAME")
+          id=$(curl -fsS -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+            -d "$body" "$api/releases" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
+          for file in artifacts/plugin.json artifacts/*.zip artifacts/*.zip.sha256; do
+            curl -fsS -X POST -H "Authorization: token $TOKEN" \
+              -F "attachment=@${file}" "$api/releases/${id}/assets?name=$(basename "$file")" > /dev/null
+            echo "uploaded $(basename "$file")"
+          done