ci: add CI workflow for main, fix release pipeline ordering and node version

- Add ci.yml to build on every push to main (Node 22)
- Add job-level guard on release build job (startsWith refs/tags/v)
- Bump Node to 22 in release.yml to satisfy zotero-plugin-scaffold >=22.8.0
- Extract publish-release as a third job (needs: [build, update-rolling-release])
  so the versioned release and XPI are only published after the full pipeline succeeds

.gitea/workflows/ci.yml

@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build

.gitea/workflows/release.yml

@@ -8,6 +8,7 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
     outputs:
       version: ${{ steps.version.outputs.version }}
       tag: ${{ steps.version.outputs.tag }}
@@ -19,7 +20,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "npm"
 
       - name: Install dependencies
@@ -34,61 +35,7 @@ jobs:
           echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
           echo "tag=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
 
-      - name: Create versioned release and upload assets
+      - name: Upload build artifacts
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          TAG="${{ steps.version.outputs.tag }}"
-          REPO="${GITHUB_REPOSITORY}"
-          API_URL="${GITEA_SERVER_URL}/api/v1"
-
-          # Create the versioned release
-          RELEASE=$(curl -s -X POST "${API_URL}/repos/${REPO}/releases" \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "{
-              \"tag_name\": \"${TAG}\",
-              \"name\": \"${TAG}\",
-              \"body\": \"Release ${TAG}\",
-              \"draft\": false,
-              \"prerelease\": false
-            }")
-
-          RELEASE_ID=$(echo "${RELEASE}" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
-
-          if [ -z "${RELEASE_ID}" ]; then
-            echo "Failed to create release. Response: ${RELEASE}"
-            exit 1
-          fi
-
-          echo "Created release ID: ${RELEASE_ID}"
-
-          # Upload XPI
-          for XPI in .scaffold/build/*.xpi; do
-            [ -f "${XPI}" ] || continue
-            FILENAME=$(basename "${XPI}")
-            echo "Uploading ${FILENAME}..."
-            curl -s -X POST "${API_URL}/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${FILENAME}" \
-              -H "Authorization: token ${GITEA_TOKEN}" \
-              -H "Content-Type: application/octet-stream" \
-              --data-binary "@${XPI}"
-          done
-
-          # Upload update manifests
-          for JSON in .scaffold/build/update.json .scaffold/build/update-beta.json; do
-            [ -f "${JSON}" ] || continue
-            FILENAME=$(basename "${JSON}")
-            echo "Uploading ${FILENAME}..."
-            curl -s -X POST "${API_URL}/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${FILENAME}" \
-              -H "Authorization: token ${GITEA_TOKEN}" \
-              -H "Content-Type: application/json" \
-              --data-binary "@${JSON}"
-          done
-
-          echo "Versioned release ${TAG} published."
-
-      - name: Upload build artifacts for next job
         uses: actions/upload-artifact@v4
         with:
           name: build-output
@@ -186,3 +133,68 @@ jobs:
           done
 
           echo "Rolling 'release' release updated to v${VERSION}."
+
+  publish-release:
+    runs-on: ubuntu-latest
+    needs: [build, update-rolling-release]
+
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: build-output
+          path: .scaffold/build/
+
+      - name: Create versioned release and upload assets
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          VERSION="${{ needs.build.outputs.version }}"
+          TAG="${{ needs.build.outputs.tag }}"
+          REPO="${GITHUB_REPOSITORY}"
+          API_URL="${GITEA_SERVER_URL}/api/v1"
+
+          # Create the versioned release
+          RELEASE=$(curl -s -X POST "${API_URL}/repos/${REPO}/releases" \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "{
+              \"tag_name\": \"${TAG}\",
+              \"name\": \"${TAG}\",
+              \"body\": \"Release ${TAG}\",
+              \"draft\": false,
+              \"prerelease\": false
+            }")
+
+          RELEASE_ID=$(echo "${RELEASE}" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
+
+          if [ -z "${RELEASE_ID}" ]; then
+            echo "Failed to create release. Response: ${RELEASE}"
+            exit 1
+          fi
+
+          echo "Created release ID: ${RELEASE_ID}"
+
+          # Upload XPI
+          for XPI in .scaffold/build/*.xpi; do
+            [ -f "${XPI}" ] || continue
+            FILENAME=$(basename "${XPI}")
+            echo "Uploading ${FILENAME}..."
+            curl -s -X POST "${API_URL}/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${FILENAME}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@${XPI}"
+          done
+
+          # Upload update manifests
+          for JSON in .scaffold/build/update.json .scaffold/build/update-beta.json; do
+            [ -f "${JSON}" ] || continue
+            FILENAME=$(basename "${JSON}")
+            echo "Uploading ${FILENAME}..."
+            curl -s -X POST "${API_URL}/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${FILENAME}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              --data-binary "@${JSON}"
+          done
+
+          echo "Versioned release ${TAG} published."