CI: switch actions to gitea.com mirror, publish releases on tags

actions/upload-artifact@v4 fails on this Gitea instance with
GHESNotSupportedError - the newer Actions Results API it needs isn't
implemented. Downgrade to v3 and pull checkout/setup-go/upload-artifact
from the gitea.com mirror instead of relying on bare action names.

Add a release step, gated on tag pushes, that creates a Gitea release
via the HTTP API and uploads dist/*.deb and dist/*.rpm as its assets,
so tagged builds land in the repo's Releases tab instead of only as a
run artifact.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -6,13 +6,16 @@ on:
     tags: ["v*"]
   pull_request:
 
+permissions:
+  contents: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@v4
 
-      - uses: actions/setup-go@v5
+      - uses: https://gitea.com/actions/setup-go@v5
         with:
           go-version: "1.22"
 
@@ -29,9 +32,41 @@ jobs:
           export PATH="$PATH:$(go env GOPATH)/bin"
           ./build.sh
 
-      - uses: actions/upload-artifact@v4
+      # upload-artifact@v4 needs the newer Actions Results API, which Gitea
+      # doesn't implement yet ("GHESNotSupportedError") - v3 works.
+      - uses: https://gitea.com/actions/upload-artifact@v3
         with:
           name: nasmon-packages
           path: |
             dist/*.deb
             dist/*.rpm
+
+      - name: publish release
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API: ${{ github.api_url }}/repos/${{ github.repository }}
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF#refs/tags/}"
+
+          release_id=$(curl -sf -X POST "$API/releases" \
+            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"$tag\",\"name\":\"$tag\"}" \
+            | grep -oP '"id":\s*\K[0-9]+' | head -1) || \
+          release_id=$(curl -sf "$API/releases/tags/$tag" \
+            -H "Authorization: token $GITEA_TOKEN" \
+            | grep -oP '"id":\s*\K[0-9]+' | head -1)
+
+          if [ -z "$release_id" ]; then
+            echo "could not create or find a release for tag $tag" >&2
+            exit 1
+          fi
+
+          for f in dist/*.deb dist/*.rpm; do
+            [ -e "$f" ] || continue
+            curl -sf -X POST "$API/releases/$release_id/assets?name=$(basename "$f")" \
+              -H "Authorization: token $GITEA_TOKEN" \
+              -F "attachment=@${f}"
+          done