ci: add rolling 'release' tag job to keep update.json current

Add a second CI job that runs after the versioned release is published.
It upserts a permanent Gitea release tagged 'release', replacing its
assets with the freshly built update.json and update-beta.json.
This is the URL Zotero polls for auto-update checks per manifest.json.

.gitea/workflows/release.yml

@@ -8,6 +8,9 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      tag: ${{ steps.version.outputs.tag }}
 
     steps:
       - name: Checkout
@@ -27,19 +30,20 @@ jobs:
 
       - name: Get version
         id: version
-        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+        run: |
+          echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+          echo "tag=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
 
-      - name: Create release and upload assets
+      - name: Create versioned release and upload assets
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
           VERSION="${{ steps.version.outputs.version }}"
-          TAG="${GITHUB_REF#refs/tags/}"
+          TAG="${{ steps.version.outputs.tag }}"
           REPO="${GITHUB_REPOSITORY}"
-          SERVER_URL="${GITHUB_SERVER_URL}"
+          API_URL="${GITHUB_SERVER_URL}/api/v1"
-          API_URL="${SERVER_URL}/api/v1"
 
-          # Create the release
+          # Create the versioned release
           RELEASE=$(curl -s -X POST "${API_URL}/repos/${REPO}/releases" \
             -H "Authorization: token ${GITEA_TOKEN}" \
             -H "Content-Type: application/json" \
@@ -60,7 +64,7 @@ jobs:
 
           echo "Created release ID: ${RELEASE_ID}"
 
-          # Upload all XPI files
+          # Upload XPI
           for XPI in .scaffold/build/*.xpi; do
             [ -f "${XPI}" ] || continue
             FILENAME=$(basename "${XPI}")
@@ -71,7 +75,7 @@ jobs:
               --data-binary "@${XPI}"
           done
 
-          # Upload update manifests if present
+          # Upload update manifests
           for JSON in .scaffold/build/update.json .scaffold/build/update-beta.json; do
             [ -f "${JSON}" ] || continue
             FILENAME=$(basename "${JSON}")
@@ -82,4 +86,103 @@ jobs:
               --data-binary "@${JSON}"
           done
 
-          echo "Release ${TAG} published successfully."
+          echo "Versioned release ${TAG} published."
+
+      - name: Upload build artifacts for next job
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-output
+          path: .scaffold/build/
+          retention-days: 1
+
+  update-rolling-release:
+    runs-on: ubuntu-latest
+    needs: build
+
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: build-output
+          path: .scaffold/build/
+
+      - name: Upsert rolling 'release' tag with latest update.json
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          TAG="release"
+          REPO="${GITHUB_REPOSITORY}"
+          API_URL="${GITHUB_SERVER_URL}/api/v1"
+          VERSION="${{ needs.build.outputs.version }}"
+
+          # Check if the rolling release already exists
+          EXISTING=$(curl -s -o /dev/null -w "%{http_code}" \
+            "${API_URL}/repos/${REPO}/releases/tags/${TAG}" \
+            -H "Authorization: token ${GITEA_TOKEN}")
+
+          if [ "${EXISTING}" = "200" ]; then
+            # Fetch the release ID
+            RELEASE_ID=$(curl -s "${API_URL}/repos/${REPO}/releases/tags/${TAG}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
+
+            echo "Found existing 'release' release (ID: ${RELEASE_ID}). Replacing assets..."
+
+            # Delete all existing assets so we can upload fresh ones
+            ASSETS=$(curl -s "${API_URL}/repos/${REPO}/releases/${RELEASE_ID}/assets" \
+              -H "Authorization: token ${GITEA_TOKEN}")
+            echo "${ASSETS}" | grep -o '"id":[0-9]*' | cut -d: -f2 | while read ASSET_ID; do
+              echo "Deleting asset ${ASSET_ID}..."
+              curl -s -X DELETE "${API_URL}/repos/${REPO}/releases/${RELEASE_ID}/assets/${ASSET_ID}" \
+                -H "Authorization: token ${GITEA_TOKEN}"
+            done
+
+            # Update the release body to reflect the current version
+            curl -s -X PATCH "${API_URL}/repos/${REPO}/releases/${RELEASE_ID}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "{\"body\": \"Rolling release — always points to the latest update manifest (currently v${VERSION}). Do not delete.\"}"
+
+          else
+            # Create the rolling release for the first time
+            echo "Creating new 'release' release..."
+
+            # Ensure the tag exists (Gitea requires the tag to exist before creating a release for it)
+            curl -s -X POST "${API_URL}/repos/${REPO}/tags" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "{\"tag_name\": \"${TAG}\", \"message\": \"Rolling release tag for update.json hosting\"}" || true
+
+            RELEASE=$(curl -s -X POST "${API_URL}/repos/${REPO}/releases" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "{
+                \"tag_name\": \"${TAG}\",
+                \"name\": \"Update Manifest (rolling)\",
+                \"body\": \"Rolling release — always points to the latest update manifest (currently v${VERSION}). Do not delete.\",
+                \"draft\": false,
+                \"prerelease\": false
+              }")
+
+            RELEASE_ID=$(echo "${RELEASE}" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
+
+            if [ -z "${RELEASE_ID}" ]; then
+              echo "Failed to create rolling release. Response: ${RELEASE}"
+              exit 1
+            fi
+
+            echo "Created rolling release ID: ${RELEASE_ID}"
+          fi
+
+          # Upload update.json and update-beta.json to the rolling release
+          for JSON in .scaffold/build/update.json .scaffold/build/update-beta.json; do
+            [ -f "${JSON}" ] || continue
+            FILENAME=$(basename "${JSON}")
+            echo "Uploading ${FILENAME} to rolling release..."
+            curl -s -X POST "${API_URL}/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${FILENAME}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              --data-binary "@${JSON}"
+          done
+
+          echo "Rolling 'release' release updated to v${VERSION}."