ci: follow the protected shared native build channel

Co-Authored-By: Codex <noreply@openai.com>

.gitea/workflows/release.yaml

@@ -0,0 +1,65 @@
+name: Release
+
+# Original tag-only native assets and Homebrew completion, using isolated shared phases.
+on:
+  create:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    needs: [names]
+    if: ${{ needs.names.outputs.eligible == 'true' }}
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/go.yaml@kof-release-v1
+    with:
+      runner: linux-small
+      coverage: config
+      coverpkg: ./internal/...,./cmd/...
+      packaging: goreleaser-release
+      artifact: license-tool
+  names:
+    if: ${{ github.event_name == 'create' && github.event.ref_type == 'tag' && github.event.ref == github.ref && startsWith(github.ref, 'refs/tags/v') }}
+    runs-on: linux-small
+    timeout-minutes: 5
+    outputs:
+      eligible: ${{ steps.names.outputs.eligible }}
+      assets: ${{ steps.names.outputs.assets }}
+      prerelease: ${{ steps.names.outputs.prerelease }}
+    steps:
+      # GoReleaser's name_template: <project>_<version>_<os>_<arch>, tar.gz except windows zip, plus checksums.txt.
+      # Version is the tag without its v; prerelease is GoReleaser's `prerelease: auto` (a semver prerelease suffix).
+      - id: names
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -eu
+          [ "$GITHUB_REF_TYPE" = tag ] || { echo 'not a tag run' >&2; exit 1; }
+          printf '%s' "$TAG" | grep -Eq '^v[0-9]+[.][0-9]+[.][0-9]+([-+][A-Za-z0-9._+-]*)?$' || { echo 'eligible=false' >> "$GITHUB_OUTPUT"; exit 0; }
+          echo 'eligible=true' >> "$GITHUB_OUTPUT"
+          version=${TAG#v}
+          NL="$(printf '\n_')"; NL=${NL%_}
+          assets="checksums.txt"
+          for platform in darwin_amd64 darwin_arm64 linux_amd64 linux_arm64; do assets="${assets}${NL}license-tool_${version}_${platform}.tar.gz"; done
+          assets="${assets}${NL}license-tool_${version}_windows_amd64.zip"
+          case ${version%%+*} in *-*) pre=true ;; *) pre=false ;; esac
+          { echo "assets<<K22_ASSETS"; echo "$assets"; echo "K22_ASSETS"; echo "prerelease=$pre"; } >> "$GITHUB_OUTPUT"
+  publish:
+    needs: [build, names]
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/native-release-assets.yaml@kof-release-v1
+    permissions:
+      contents: write
+      actions: read
+    with:
+      artifact-pattern: license-tool-release-*
+      asset-names: ${{ needs.names.outputs.assets }}
+      prerelease: ${{ needs.names.outputs.prerelease == 'true' }}
+      body-file: CHANGELOG.md
+  homebrew:
+    needs: [publish]
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/native-homebrew.yaml@kof-release-v1
+    permissions:
+      contents: read
+      actions: read
+    with:
+      artifact: license-tool-release-linux

.goreleaser.yaml

@@ -57,7 +57,7 @@ release:
   prerelease: auto
 
 changelog:
-  use: github
+  use: gitea
 
 homebrew_casks:
   - name: license-tool
@@ -80,3 +80,9 @@ homebrew_casks:
           if OS.mac?
             system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/license-tool"]
           end
+
+# Primary forge changelog/download URLs; the read-only build skips all publishing.
+gitea_urls:
+  api: https://git.kof22.com/api/v1
+  download: https://git.kof22.com
+  skip_tls_verify: false