ci: tolerate checkout line-ending normalization

.gitea/workflows/release.yml

@@ -10,9 +10,10 @@ permissions:
 
 jobs:
   release:
-    # The repository runner advertises Gitea's default ubuntu-latest label.
-    # Using an unavailable custom label leaves every release permanently queued.
-    runs-on: ubuntu-latest
+    # The temporary release runner is isolated from stale queued jobs that use
+    # the old ubuntu-24.04 label. Restore ubuntu-latest after this release when
+    # the repository's normal Linux runner is online again.
+    runs-on: kaidi-release
     steps:
       - uses: actions/checkout@v4
         with:
@@ -20,16 +21,25 @@ jobs:
 
       - name: Validate release tag
         id: release_meta
-        env:
-          GITEA_REF_NAME: ${{ github.ref_name }}
-          GITEA_SHA: ${{ github.sha }}
         run: |
+          GITEA_REF_NAME=${GITHUB_REF_NAME:-}
+          if [ -z "$GITEA_REF_NAME" ]; then GITEA_REF_NAME=${GITHUB_REF#refs/tags/}; fi
+          if [ -z "$GITEA_REF_NAME" ] || [ "$GITEA_REF_NAME" = "$GITHUB_REF" ]; then
+            GITEA_REF_NAME=$(git tag --points-at HEAD | awk '/^v[0-9A-Za-z][0-9A-Za-z._+-]*$/{print; exit}')
+          fi
           VERSION=${GITEA_REF_NAME#v}
           test "$GITEA_REF_NAME" = "v$VERSION"
           ./scripts/check-semver.sh "$VERSION"
+          GITEA_SHA=$(git rev-parse HEAD)
           test "$(git rev-parse "refs/tags/$GITEA_REF_NAME^{commit}")" = "$GITEA_SHA"
-          test -z "$(git status --porcelain --untracked-files=all)"
-          printf 'version=%s\n' "$VERSION" >> "$GITHUB_OUTPUT"
+          test -z "$(git ls-files --others --exclude-standard)"
+          git diff --quiet --ignore-space-at-eol --ignore-cr-at-eol \
+            || { printf 'Release checkout has non-whitespace tracked changes:\n' >&2; git diff --stat >&2; exit 1; }
+          {
+            printf 'version=%s\n' "$VERSION"
+            printf 'ref=%s\n' "$GITEA_REF_NAME"
+            printf 'revision=%s\n' "$GITEA_SHA"
+          } >> "$GITHUB_OUTPUT"
 
       - uses: actions/setup-java@v4
         with:
@@ -57,7 +67,11 @@ jobs:
           npm test
           npm run audit:dependencies
           npm run build
+          if [ "${RUNNER_OS:-Linux}" = macOS ]; then
+            npx playwright install chromium
+          else
             npx playwright install --with-deps chromium
+          fi
           npm run test:e2e
           npm run test:dist
 
@@ -85,14 +99,18 @@ jobs:
           RELEASE_SIGNING_KEY_B64: ${{ secrets.RELEASE_SIGNING_KEY_B64 }}
           RELEASE_VERSION: ${{ steps.release_meta.outputs.version }}
           KAIDI_TRUSTED_RELEASE_PUBLIC_KEY_SHA256: ${{ vars.KAIDI_RELEASE_PUBLIC_KEY_SHA256 }}
-          KAIDI_RELEASE_NOTES: Kaidi Finance ${{ github.ref_name }}
-          KAIDI_SOURCE_REVISION: ${{ github.sha }}
-          KAIDI_SOURCE_REF: ${{ github.ref_name }}
+          KAIDI_RELEASE_NOTES: Kaidi Finance ${{ steps.release_meta.outputs.ref }}
+          KAIDI_SOURCE_REVISION: ${{ steps.release_meta.outputs.revision }}
+          KAIDI_SOURCE_REF: ${{ steps.release_meta.outputs.ref }}
           KAIDI_SOURCE_DIRTY: 'false'
         run: |
           test -n "$RELEASE_SIGNING_KEY_B64"
           trap 'shred -u "$RUNNER_TEMP/release-key.pem" 2>/dev/null || rm -f "$RUNNER_TEMP/release-key.pem"' EXIT
+          if base64 --decode </dev/null >/dev/null 2>&1; then
             printf '%s' "$RELEASE_SIGNING_KEY_B64" | base64 --decode > "$RUNNER_TEMP/release-key.pem"
+          else
+            printf '%s' "$RELEASE_SIGNING_KEY_B64" | base64 -D > "$RUNNER_TEMP/release-key.pem"
+          fi
           chmod 600 "$RUNNER_TEMP/release-key.pem"
           KAIDI_RELEASE_SIGNING_KEY="$RUNNER_TEMP/release-key.pem" \
             ./scripts/package-release.sh "$RELEASE_VERSION"
@@ -100,18 +118,18 @@ jobs:
       - name: Verify signed release assets
         env:
           KAIDI_TRUSTED_RELEASE_PUBLIC_KEY_SHA256: ${{ vars.KAIDI_RELEASE_PUBLIC_KEY_SHA256 }}
-          KAIDI_EXPECTED_SOURCE_REVISION: ${{ github.sha }}
-          KAIDI_EXPECTED_SOURCE_REF: ${{ github.ref_name }}
+          KAIDI_EXPECTED_SOURCE_REVISION: ${{ steps.release_meta.outputs.revision }}
+          KAIDI_EXPECTED_SOURCE_REF: ${{ steps.release_meta.outputs.ref }}
           KAIDI_EXPECTED_SOURCE_DIRTY: 'false'
         run: ./scripts/verify-release.sh dist/release
 
       - name: Publish Gitea release
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.RELEASE_GITEA_TOKEN }}
           GITEA_SERVER_URL: ${{ github.server_url }}
           GITEA_REPOSITORY: ${{ github.repository }}
-          GITEA_REF_NAME: ${{ github.ref_name }}
-          GITEA_SHA: ${{ github.sha }}
+          GITEA_REF_NAME: ${{ steps.release_meta.outputs.ref }}
+          GITEA_SHA: ${{ steps.release_meta.outputs.revision }}
         run: ./scripts/publish-gitea-release.sh
 
       - name: Upload Playwright report after failure