From 9712bed6f38fe81d0a7f158446f5105a5f25dc30 Mon Sep 17 00:00:00 2001
From: Raven Scott <admin@ssh.surf>
Date: Fri, 11 Sep 2026 15:05:56 -0400
Subject: [PATCH] R3

---
 docs/ci-gitea.md                   |  8 ++++++--
 packaging/publish-gitea-release.sh | 18 ++++++++++--------
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/docs/ci-gitea.md b/docs/ci-gitea.md
index 6ba1d24..0431b2e 100644
--- a/docs/ci-gitea.md
+++ b/docs/ci-gitea.md
@@ -25,11 +25,15 @@ references it as `${{ secrets.RELEASE_TOKEN }}`; the value is never committed.
 Each push to `main` runs tests and packaging. The publish script:
 
 1. Deletes the existing release associated with `rolling`, if present.
-2. Moves or creates the `rolling` tag at the pushed commit.
+2. Deletes and recreates the `rolling` tag at the pushed commit using Gitea's
+   repository tag API.
 3. Creates a prerelease named with the commit prefix.
 4. Uploads the `.deb`, extension ZIP, and `SHA256SUMS`.
 
-The moving tag is intentionally mutable. Permanent releases should use reviewed
+The moving tag is intentionally mutable. This server's Swagger API exposes tag
+replacement as `DELETE /repos/{owner}/{repo}/tags/{tag}` followed by
+`POST /repos/{owner}/{repo}/tags`; the publisher uses that contract rather than
+the unsupported Git refs patch route. Permanent releases should use reviewed
 immutable tags after validating a rolling artifact.
 
 ## Local rehearsal
diff --git a/packaging/publish-gitea-release.sh b/packaging/publish-gitea-release.sh
index b7cf704..fa2ec80 100755
--- a/packaging/publish-gitea-release.sh
+++ b/packaging/publish-gitea-release.sh
@@ -7,7 +7,8 @@ set -euo pipefail
 : "${RELEASE_TOKEN:?RELEASE_TOKEN is required}"
 
 API="${GITEA_SERVER_URL%/}/api/v1/repos/${GITEA_REPOSITORY}"
-AUTH=(-H "Authorization: token ${RELEASE_TOKEN}" -H 'Accept: application/json' -H 'Content-Type: application/json')
+AUTH=(-H "Authorization: token ${RELEASE_TOKEN}" -H 'Accept: application/json')
+JSON=(-H 'Content-Type: application/json')
 TAG="rolling"
 
 release_json="$(curl -fsS "${AUTH[@]}" "${API}/releases/tags/${TAG}" 2>/dev/null || true)"
@@ -18,15 +19,16 @@ if [[ -n "${release_json}" ]]; then
   fi
 fi
 
-tag_payload="$(jq -nc --arg sha "${GITEA_SHA}" '{new_target:$sha, force:true}')"
-if ! curl -fsS -X PATCH "${AUTH[@]}" "${API}/git/refs/tags/${TAG}" --data "${tag_payload}" >/dev/null 2>&1; then
-  create_tag="$(jq -nc --arg sha "${GITEA_SHA}" --arg ref "refs/tags/${TAG}" '{ref:$ref, sha:$sha}')"
-  curl -fsS -X POST "${AUTH[@]}" "${API}/git/refs" --data "${create_tag}" >/dev/null
-fi
+# This Gitea instance exposes tag replacement through the repository tag API;
+# it does not implement PATCH /git/refs/{ref}.
+curl -fsS -X DELETE "${AUTH[@]}" "${API}/tags/${TAG}" >/dev/null 2>&1 || true
+tag_payload="$(jq -nc --arg sha "${GITEA_SHA}" --arg tag "${TAG}" \
+  '{tag_name:$tag, target:$sha, message:"Automated rolling tag"}')"
+curl -fsS -X POST "${AUTH[@]}" "${JSON[@]}" "${API}/tags" --data "${tag_payload}" >/dev/null
 
 release_payload="$(jq -nc --arg tag "${TAG}" --arg sha "${GITEA_SHA}" \
   '{tag_name:$tag, target_commitish:$sha, name:("Rolling " + ($sha[0:12])), body:"Automated Gitea rolling release from main.", draft:false, prerelease:true}')"
-created="$(curl -fsS -X POST "${AUTH[@]}" "${API}/releases" --data "${release_payload}")"
+created="$(curl -fsS -X POST "${AUTH[@]}" "${JSON[@]}" "${API}/releases" --data "${release_payload}")"
 release_id="$(jq -r '.id // empty' <<<"${created}")"
 test -n "${release_id}"
 
@@ -34,6 +36,6 @@ for asset in dist/jarvis-qvac_*.deb dist/jarvis-qvac-extension.zip dist/SHA256SU
   [[ -f "${asset}" ]] || continue
   curl -fsS -X POST "${AUTH[@]}" \
     "${API}/releases/${release_id}/assets?name=$(basename "${asset}")" \
-    -H 'Content-Type: application/octet-stream' --data-binary "@${asset}" >/dev/null
+    -F "attachment=@${asset}" >/dev/null
 done
 echo "Published Gitea rolling release ${TAG} for ${GITEA_SHA:0:12}"