ci: auto-publish Windows zip to Gitea Releases

After a successful windows-cross build on main or v* tags, upload the zip
and .sha256 via scripts/release_windows.sh (creates/updates v$VERSION).
Prefer secrets.RELEASE_TOKEN; fall back to GITHUB_TOKEN. Skip on PRs.

scripts/release_windows.sh

@@ -5,13 +5,17 @@
 # --build runs scripts/bootstrap_windows.sh first. The token is only read from
 # the environment and handed to curl on stdin: it never appears in argv, on
 # disk or in the output. Assets of the same name are replaced.
+#
+# CI: set GITEA_TOKEN (or GITHUB_TOKEN), CST_GITEA, CST_REPO. The remote-branch
+# check is skipped under GITEA_ACTIONS / GITHUB_ACTIONS / CI.
 set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-SERVER="${CST_GITEA:-https://git.whcself.xyz}"
-REPO="${CST_REPO:-WHC/CST-agent}"
+SERVER="${CST_GITEA:-${GITHUB_SERVER_URL:-https://git.whcself.xyz}}"
+REPO="${CST_REPO:-${GITHUB_REPOSITORY:-WHC/CST-agent}}"
 API="$SERVER/api/v1/repos/$REPO"
 
-[[ -n "${GITEA_TOKEN:-}" ]] || {
+TOKEN="${GITEA_TOKEN:-${GITHUB_TOKEN:-}}"
+[[ -n "$TOKEN" ]] || {
   echo "set GITEA_TOKEN (a Gitea token with write:repository)" >&2
   exit 1
 }
@@ -26,10 +30,19 @@ for f in "$zip" "$zip.sha256"; do
   [[ -f "$f" ]] || { echo "missing $f (scripts/package_windows.sh, or --build)" >&2; exit 1; }
 done
 
+# If this job was triggered by a version tag, it must match cst_version.h.
+if [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
+  ref_tag="${GITHUB_REF#refs/tags/}"
+  if [[ "$ref_tag" != "$tag" ]]; then
+    echo "pushed tag $ref_tag != cst_version.h $tag; bump include/cst_version.h" >&2
+    exit 1
+  fi
+fi
+
 api() { # METHOD PATH [curl args...]
   local m="$1" p="$2"
   shift 2
-  printf 'Authorization: token %s\n' "$GITEA_TOKEN" |
+  printf 'Authorization: token %s\n' "$TOKEN" |
     curl -fsS -X "$m" -H @- "$API$p" "$@"
 }
 json() { # CODE [ARGS...]: d = the JSON on stdin, ARGS in sys.argv[1:]
@@ -42,12 +55,14 @@ if rel="$(api GET "/releases/tags/$tag" 2>/dev/null)"; then
   echo "==> release $tag exists"
 else
   head="$(git rev-parse HEAD)"
-  if ! git branch -r --contains "$head" 2>/dev/null | grep -q .; then
-    echo "HEAD $head is not on any remote branch; push it first" >&2
-    exit 1
+  if [[ -z "${CI:-}${GITEA_ACTIONS:-}${GITHUB_ACTIONS:-}" ]]; then
+    if ! git branch -r --contains "$head" 2>/dev/null | grep -q .; then
+      echo "HEAD $head is not on any remote branch; push it first" >&2
+      exit 1
+    fi
   fi
   echo "==> creating release $tag at $head"
-  body="$(python3 -c 'import json,sys; print(json.dumps({"tag_name": sys.argv[1], "target_commitish": sys.argv[2], "name": "CST-Agent " + sys.argv[1], "body": "Windows x86_64: unzip, or install with scripts/install_windows.ps1"}))' "$tag" "$head")"
+  body="$(python3 -c 'import json,sys; print(json.dumps({"tag_name": sys.argv[1], "target_commitish": sys.argv[2], "name": "CST-Agent " + sys.argv[1], "body": "Windows x86_64: unzip, or install with install_windows.ps1 from the zip.\\n\\nArtifacts: `cst-agent-VERSION-windows-x86_64.zip` + `.sha256`."}))' "$tag" "$head")"
   rel="$(api POST /releases -H 'Content-Type: application/json' -d "$body")"
 fi
 id="$(json 'print(d["id"])' <<<"$rel")"