chore: add Gitea Actions release workflow + macOS upload script

- Linux + Windows auto-build on v* tags via self-hosted runners
  (linux: sec-s1-runner/ubuntu-22.04, windows: win-ig3i/windows)
- Each job ensures the Gitea release exists (by tag) then uploads its
  own platform assets; parallel-safe and fail-fast:false so an offline
  runner doesn't block the other platform
- macOS is manual: scripts/release-mac.sh builds both arches here and
  uploads DMGs to the same release by tag
- Replaces GitHub-specific tauri-action with direct tauri build + Gitea API

.gitea/workflows/release.yml

@@ -0,0 +1,249 @@
+name: Release
+
+# Builds Gridline installers for Linux and Windows on the self-hosted
+# Gitea Actions runners, then uploads them to a Gitea release.
+#
+#   * Linux  -> sec-s1-runner (label ubuntu-22.04) -> .deb / .rpm / .AppImage
+#   * Windows-> win-ig3i     (label windows)       -> .exe / .msi
+#
+# macOS is NOT built here. The Mac is built manually on Adrian's machine and
+# its DMGs uploaded to the same release by tag (scripts/release-mac.sh).
+#
+# Trigger: push a version tag from the `prod` branch, e.g.
+#   git checkout prod && git pull
+#   git tag v0.7.11 && git push origin v0.7.11
+#
+# Each job independently ensures the Gitea release exists (GET by tag, create
+# on 404) then uploads only its own platform assets — so Linux and Windows run
+# in parallel and both land on the same release page. If one platform's runner
+# is offline, the other job still succeeds (fail-fast: false).
+#
+# SIGNING STATUS: macOS is ad-hoc signed (manual, via tauri.conf.json). Linux
+# and Windows installers are unsigned. No certs are bundled.
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+env:
+  GITEA_SERVER: https://git.ranio.xyz
+  REPO_OWNER: adrianbonpin
+  REPO_NAME: gridline
+
+jobs:
+  linux:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Linux dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust build artifacts
+        uses: swatinem/rust-cache@v2
+        with:
+          workspaces: './desktop/src-tauri -> target'
+
+      - name: Install frontend dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build PostgreSQL client tools (bundled)
+        shell: bash
+        run: |
+          set -euo pipefail
+          PG_VER="16.4"
+          OUT="${GITHUB_WORKSPACE}/desktop/src-tauri/resources/pg_tools"
+          mkdir -p "$OUT"
+          sudo apt-get update -y
+          sudo apt-get install -y build-essential libreadline-dev zlib1g-dev flex bison patchelf
+          curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VER}/postgresql-${PG_VER}.tar.bz2" -o /tmp/pg.tar.bz2
+          tar -xf /tmp/pg.tar.bz2 -C /tmp
+          cd /tmp/postgresql-${PG_VER}
+          ./configure --prefix=/tmp/pgbuild --without-readline --without-icu CFLAGS="-O2"
+          make -C src/backend generated-headers
+          make -C src/interfaces/libpq all
+          make -j"$(nproc)" -C src/bin/pg_dump all
+          make -j"$(nproc)" -C src/bin/psql all
+          cp src/bin/pg_dump/pg_dump src/bin/pg_dump/pg_restore "$OUT"/
+          cp src/bin/psql/psql "$OUT"/
+          cp src/interfaces/libpq/libpq.so.5 "$OUT"/libpq.so.5
+          for b in pg_dump pg_restore psql; do
+            patchelf --set-rpath '$ORIGIN' "$OUT/$b"
+          done
+
+      - name: Build MariaDB client tools (bundled)
+        shell: bash
+        run: |
+          set -euo pipefail
+          MARIADB_VER="11.4.5"
+          OUT="${GITHUB_WORKSPACE}/desktop/src-tauri/resources/mysql_tools"
+          mkdir -p "$OUT"
+          sudo apt-get update -y
+          sudo apt-get install -y cmake build-essential libssl-dev libzstd-dev pkg-config libgnutls28-dev patchelf
+          git clone --depth 1 --branch "mariadb-${MARIADB_VER}" https://github.com/MariaDB/server.git /tmp/mariadb-server
+          cd /tmp/mariadb-server
+          cmake -DCMAKE_BUILD_TYPE=Release \
+            -DWITHOUT_SERVER=ON \
+            -DWITHOUT_TOKUDB=1 \
+            -DWITHOUT_ROCKSDB=1 \
+            -DWITHOUT_MROONGA=1 \
+            -DWITHOUT_SPIDER=1 \
+            -DWITHOUT_SEQUENCE=1 \
+            -DWITH_UNIT_TESTS=OFF \
+            -DWITH_SSL=bundled \
+            -DWITH_ZLIB=bundled .
+          make -j"$(nproc)" mariadb-dump mariadb
+          for b in mariadb-dump mariadb; do
+            src=$(find client -maxdepth 1 -type f -name "$b" -print -quit 2>/dev/null || true)
+            test -n "$src" || src=$(find . -type f -name "$b" -print -quit || true)
+            test -n "$src" || { echo "build produced no $b binary"; exit 1; }
+            cp "$src" "$OUT"/
+          done
+          for b in mariadb-dump mariadb; do
+            ldd "$OUT/$b" | awk '/=> \// {print $3}' | sort -u | while read -r lib; do
+              case "$(basename "$lib")" in
+                ld-linux*|libc.so*|libm.so*|libpthread*|libdl.so*|librt.so*|libgcc_s*|libstdc++*|libcrypt.so*|libresolv*|libutil*)
+                  ;;
+                *)
+                  cp -n "$lib" "$OUT/$(basename "$lib")" 2>/dev/null || true
+                  ;;
+              esac
+            done
+            patchelf --set-rpath '$ORIGIN' "$OUT/$b"
+          done
+
+      - name: Build installers
+        run: bun run --filter gridline-desktop tauri build
+
+      - name: Create release and upload Linux assets
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          API="${GITEA_SERVER}/api/v1/repos/${REPO_OWNER}/${REPO_NAME}"
+          AUTH="Authorization: token ${GITHUB_TOKEN}"
+
+          # Ensure the release exists (idempotent — both jobs may call this).
+          REL_ID=$(curl -fsS -H "$AUTH" "${API}/releases/tags/${TAG}" \
+            | python3 -c "import sys,json;print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+          if [ -z "$REL_ID" ]; then
+            BODY="Gridline ${TAG#v} — Linux and Windows installers."
+            REL_ID=$(curl -fsS -X POST -H "$AUTH" -H "Content-Type: application/json" \
+              -d "{\"tag_name\":\"${TAG}\",\"name\":\"Gridline ${TAG#v}\",\"body\":\"${BODY}\",\"draft\":true}" \
+              "${API}/releases" \
+              | python3 -c "import sys,json;print(json.load(sys.stdin)['id'])")
+          fi
+
+          BUNDLE="${GITHUB_WORKSPACE}/desktop/src-tauri/target/release/bundle"
+          cd "$BUNDLE"
+          for f in deb/*.deb rpm/*.rpm appimage/*.AppImage; do
+            [ -f "$f" ] || { echo "missing $f"; exit 1; }
+            name=$(basename "$f")
+            echo "uploading $name"
+            curl -fsS -X POST -H "$AUTH" -H "Content-Type: application/octet-stream" \
+              --data-binary "@$f" \
+              "${API}/releases/${REL_ID}/assets?name=${name}"
+          done
+          echo "Linux assets uploaded to release ${REL_ID}"
+
+  windows:
+    runs-on: windows
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust build artifacts
+        uses: swatinem/rust-cache@v2
+        with:
+          workspaces: './desktop/src-tauri -> target'
+
+      - name: Install frontend dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build PostgreSQL client tools (bundled)
+        shell: bash
+        run: |
+          set -euo pipefail
+          PG_VER="16.4"
+          OUT="${GITHUB_WORKSPACE}/desktop/src-tauri/resources/pg_tools"
+          mkdir -p "$OUT"
+          URL="https://get.enterprisedb.com/postgresql/postgresql-${PG_VER}-1-windows-x64-binaries.zip"
+          curl -fsSL "$URL" -o /tmp/pg.zip
+          EXPECTED="3508d8f085bc3980f38211a82e3f31e5fcae9952105d3dc2f8be67b64a822baa"
+          echo "$EXPECTED  /tmp/pg.zip" | sha256sum -c -
+          sha256sum /tmp/pg.zip
+          unzip -o /tmp/pg.zip -d /tmp/pg
+          cp /tmp/pg/pgsql/bin/pg_dump.exe /tmp/pg/pgsql/bin/pg_restore.exe /tmp/pg/pgsql/bin/psql.exe "$OUT"/
+          cp /tmp/pg/pgsql/bin/*.dll "$OUT"/
+
+      - name: Build MariaDB client tools (bundled)
+        shell: bash
+        run: |
+          set -euo pipefail
+          MARIADB_VER="11.4.5"
+          OUT="${GITHUB_WORKSPACE}/desktop/src-tauri/resources/mysql_tools"
+          mkdir -p "$OUT"
+          URL="https://archive.mariadb.org/mariadb-${MARIADB_VER}/winx64-packages/mariadb-${MARIADB_VER}-winx64.zip"
+          curl -fsSL "$URL" -o /tmp/mariadb.zip
+          sha256sum /tmp/mariadb.zip
+          unzip -o /tmp/mariadb.zip -d /tmp/mariadb
+          WINROOT="/tmp/mariadb/mariadb-${MARIADB_VER}-winx64"
+          cp "$WINROOT"/bin/mariadb-dump.exe "$WINROOT"/bin/mariadb.exe "$OUT"/
+          cp "$WINROOT"/lib/libmariadb.dll "$OUT"/
+
+      - name: Build installers
+        shell: bash
+        run: bun run --filter gridline-desktop tauri build
+
+      - name: Create release and upload Windows assets
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          API="${GITEA_SERVER}/api/v1/repos/${REPO_OWNER}/${REPO_NAME}"
+          AUTH="Authorization: token ${GITHUB_TOKEN}"
+
+          REL_ID=$(curl -fsS -H "$AUTH" "${API}/releases/tags/${TAG}" \
+            | python3 -c "import sys,json;print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+          if [ -z "$REL_ID" ]; then
+            BODY="Gridline ${TAG#v} — Linux and Windows installers."
+            REL_ID=$(curl -fsS -X POST -H "$AUTH" -H "Content-Type: application/json" \
+              -d "{\"tag_name\":\"${TAG}\",\"name\":\"Gridline ${TAG#v}\",\"body\":\"${BODY}\",\"draft\":true}" \
+              "${API}/releases" \
+              | python3 -c "import sys,json;print(json.load(sys.stdin)['id'])")
+          fi
+
+          BUNDLE="${GITHUB_WORKSPACE}/desktop/src-tauri/target/release/bundle"
+          cd "$BUNDLE"
+          for f in nsis/*-setup.exe msi/*.msi; do
+            [ -f "$f" ] || { echo "missing $f"; exit 1; }
+            name=$(basename "$f")
+            echo "uploading $name"
+            curl -fsS -X POST -H "$AUTH" -H "Content-Type: application/octet-stream" \
+              --data-binary "@$f" \
+              "${API}/releases/${REL_ID}/assets?name=${name}"
+          done
+          echo "Windows assets uploaded to release ${REL_ID}"

scripts/release-mac.sh

@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+#
+# Build Gridline for macOS on this machine and upload the DMGs to the Gitea
+# release for a given tag. macOS is built manually (NOT auto-built on tag);
+# the Linux and Windows installers are built by the Gitea Actions workflow
+# (.gitea/workflows/release.yml) and already uploaded to the same release.
+#
+# Usage:
+#   TAG=v0.7.11 ./scripts/release-mac.sh
+#   (optionally set GITEA_TOKEN env var to override token lookup)
+#
+# The release is keyed by tag. The Linux/Windows job creates it on the first
+# tag push; this script finds it (creating it only if it somehow doesn't exist)
+# and attaches the two DMGs: Gridline_<ver>_aarch64.dmg and Gridline_<ver>_x64.dmg
+#
+# Token: reads $GITEA_TOKEN, else tries the tea CLI config, else prompts.
+
+set -euo pipefail
+
+# ---- config ---------------------------------------------------------------
+GITEA_SERVER="${GITEA_SERVER:-https://git.ranio.xyz}"
+REPO_OWNER="${REPO_OWNER:-adrianbonpin}"
+REPO_NAME="${REPO_NAME:-gridline}"
+TAG="${TAG:-${1:-}}"
+
+if [ -z "$TAG" ]; then
+  echo "usage: TAG=vX.Y.Z ./scripts/release-mac.sh" >&2
+  exit 1
+fi
+
+# ---- resolve auth token ----------------------------------------------------
+get_token() {
+  if [ -n "${GITEA_TOKEN:-}" ]; then
+    echo "$GITEA_TOKEN"; return
+  fi
+  # Try tea's stored credentials if available.
+  if command -v tea >/dev/null 2>&1; then
+    # tea stores its token in a config under the platform app-support dir.
+    local cfg
+    cfg="$(find "$HOME/Library/Application Support" "$HOME/.config" \
+      -maxdepth 2 -name 'config.yml' -path '*tea*' 2>/dev/null | head -1 || true)"
+    if [ -n "$cfg" ]; then
+      local tok
+      tok="$(sed -n 's/.*token:[" ]*\([^" ]*\).*/\1/p' "$cfg" 2>/dev/null | head -1 || true)"
+      if [ -n "$tok" ]; then echo "$tok"; return; fi
+    fi
+  fi
+  read -rsp "Gitea personal access token (repo write): " GITEA_TOKEN
+  echo "$GITEA_TOKEN"
+}
+
+GITEA_TOKEN="$(get_token)"
+
+# ---- build bundled DB tools (macOS) ----------------------------------------
+WORKSPACE="$(cd "$(dirname "$0")/.." && pwd)"
+OUT_PG="${WORKSPACE}/desktop/src-tauri/resources/pg_tools"
+OUT_MY="${WORKSPACE}/desktop/src-tauri/resources/mysql_tools"
+
+echo ">> Building PostgreSQL client tools..."
+mkdir -p "$OUT_PG"
+PG_VER="16.4"
+curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VER}/postgresql-${PG_VER}.tar.bz2" -o /tmp/pg.tar.bz2
+tar -xf /tmp/pg.tar.bz2 -C /tmp
+cd /tmp/postgresql-${PG_VER}
+ac_cv_func_strchrnul=no ./configure --prefix=/tmp/pgbuild --without-readline --without-icu CFLAGS="-O2"
+sed -i '' 's/strchrnul/pg_strchrnul/g' src/port/snprintf.c
+make -C src/backend generated-headers
+make -C src/interfaces/libpq all
+make -j"$(sysctl -n hw.ncpu)" -C src/bin/pg_dump all
+make -j"$(sysctl -n hw.ncpu)" -C src/bin/psql all
+cp src/bin/pg_dump/pg_dump src/bin/pg_dump/pg_restore "$OUT_PG"/
+cp src/bin/psql/psql "$OUT_PG"/
+cp src/interfaces/libpq/libpq.5.dylib "$OUT_PG"/libpq.5.dylib
+for b in pg_dump pg_restore psql; do
+  libpq=$(otool -L "$OUT_PG/$b" | awk '/libpq/ {print $1; exit}')
+  install_name_tool -change "$libpq" "@loader_path/libpq.5.dylib" "$OUT_PG/$b"
+done
+
+echo ">> Building MariaDB client tools..."
+mkdir -p "$OUT_MY"
+MARIADB_VER="11.4.5"
+git clone --depth 1 --branch "mariadb-${MARIADB_VER}" https://github.com/MariaDB/server.git /tmp/mariadb-server
+cd /tmp/mariadb-server
+if [ "$(uname -m)" = arm64 ]; then
+  SSL_DIR="/opt/homebrew/opt/openssl"
+else
+  SSL_DIR="/usr/local/opt/openssl"
+fi
+[ -d "$SSL_DIR" ] || brew install openssl
+cmake -DCMAKE_BUILD_TYPE=Release \
+  -DWITHOUT_SERVER=ON \
+  -DWITHOUT_TOKUDB=1 \
+  -DWITHOUT_ROCKSDB=1 \
+  -DWITHOUT_MROONGA=1 \
+  -DWITHOUT_SPIDER=1 \
+  -DWITHOUT_SEQUENCE=1 \
+  -DWITH_UNIT_TESTS=OFF \
+  -DWITH_SSL="$SSL_DIR" \
+  -DWITH_ZLIB=bundled .
+make -j"$(sysctl -n hw.ncpu)" mariadb-dump mariadb
+for b in mariadb-dump mariadb; do
+  src=$(find client -maxdepth 1 -type f -name "$b" -print -quit 2>/dev/null || true)
+  test -n "$src" || src=$(find . -type f -name "$b" -print -quit || true)
+  test -n "$src" || { echo "build produced no $b binary"; exit 1; }
+  cp "$src" "$OUT_MY"/
+done
+for pass in 1 2 3 4 5 6; do
+  for dylib in "$OUT_MY"/*.dylib "$OUT_MY"/mariadb-dump "$OUT_MY"/mariadb; do
+    [ -f "$dylib" ] || continue
+    otool -L "$dylib" | awk 'NR>1 {print $1}' | grep -E '^/(usr/local|opt/homebrew)' | while read -r lib; do
+      base=$(basename "$lib")
+      if [ ! -f "$OUT_MY/$base" ]; then cp "$lib" "$OUT_MY/$base" 2>/dev/null || true; fi
+      install_name_tool -change "$lib" "@loader_path/$base" "$dylib" 2>/dev/null || true
+    done || true
+    codesign --force --sign - "$dylib" 2>/dev/null || true
+  done
+done
+
+# ---- build the app (both arches) ------------------------------------------
+cd "${WORKSPACE}/desktop"
+echo ">> Installing frontend dependencies..."
+bun install --frozen-lockfile
+
+echo ">> Building aarch64 (Apple Silicon)..."
+bun run tauri build --target aarch64-apple-darwin
+echo ">> Building x86_64 (Intel)..."
+bun run tauri build --target x86_64-apple-darwin
+
+VERSION="${TAG#v}"
+BUNDLE_ARM="${WORKSPACE}/desktop/src-tauri/target/aarch64-apple-darwin/release/bundle"
+BUNDLE_INTEL="${WORKSPACE}/desktop/src-tauri/target/x86_64-apple-darwin/release/bundle"
+
+# ---- create/ensure release + upload DMGs -----------------------------------
+API="${GITEA_SERVER}/api/v1/repos/${REPO_OWNER}/${REPO_NAME}"
+AUTH="Authorization: token ${GITEA_TOKEN}"
+
+echo ">> Ensuring release ${TAG} exists..."
+REL_ID=$(curl -fsS -H "$AUTH" "${API}/releases/tags/${TAG}" \
+  | python3 -c "import sys,json;print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+if [ -z "$REL_ID" ]; then
+  BODY="Gridline ${VERSION} — macOS (built manually)."
+  REL_ID=$(curl -fsS -X POST -H "$AUTH" -H "Content-Type: application/json" \
+    -d "{\"tag_name\":\"${TAG}\",\"name\":\"Gridline ${VERSION}\",\"body\":\"${BODY}\",\"draft\":true}" \
+    "${API}/releases" \
+    | python3 -c "import sys,json;print(json.load(sys.stdin)['id'])")
+fi
+
+upload() {
+  local file="$1"
+  [ -f "$file" ] || { echo "missing $file" >&2; exit 1; }
+  local name
+  name=$(basename "$file")
+  echo ">> uploading $name"
+  curl -fsS -X POST -H "$AUTH" -H "Content-Type: application/octet-stream" \
+    --data-binary "@$file" \
+    "${API}/releases/${REL_ID}/assets?name=${name}"
+}
+
+upload "${BUNDLE_ARM}/dmg/Gridline_${VERSION}_aarch64.dmg"
+upload "${BUNDLE_INTEL}/dmg/Gridline_${VERSION}_x64.dmg"
+
+echo "Done. Release: ${GITEA_SERVER}/${REPO_OWNER}/${REPO_NAME}/releases/tag/${TAG}"