Add signed extension release workflow

.gitea/workflows/release.yml

@@ -0,0 +1,58 @@
+name: Build and publish extension
+
+on:
+  push:
+    tags:
+      - "v*"
+
+concurrency:
+  group: publish-release
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+
+      - name: Install pinned CRX builder
+        run: python -m pip install --disable-pip-version-check "crx3==0.0.4"
+
+      - name: Build and verify signed extension
+        env:
+          CRX_PRIVATE_KEY: ${{ secrets.CRX_PRIVATE_KEY }}
+        run: |
+          set -eu
+          key_file="$(mktemp)"
+          trap 'rm -f "$key_file"' EXIT
+          if [ -z "$CRX_PRIVATE_KEY" ]; then
+            printf '%s\n' 'CRX_PRIVATE_KEY repository secret is required' >&2
+            exit 1
+          fi
+          umask 077
+          printf '%s' "$CRX_PRIVATE_KEY" > "$key_file"
+          chmod 600 "$key_file"
+          python scripts/build_extension.py \
+            --tag "${{ gitea.ref_name }}" \
+            --private-key "$key_file" \
+            --output-dir "$RUNNER_TEMP/history-collector-build"
+
+      - name: Publish Gitea release assets
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_API_URL: ${{ gitea.server_url }}/api/v1
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+        run: |
+          set -eu
+          python scripts/publish_release.py \
+            --tag "${{ gitea.ref_name }}" \
+            --directory "$RUNNER_TEMP/history-collector-build"