feat: add TallyNote local reimbursement ledger

2026-08-29 01:02:29 +08:00
commit 9719429f4a
62 changed files with 29200 additions and 0 deletions
@@ -0,0 +1,44 @@
+name: TallyNote release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+# A tag is the immutable input to a release. Publishing is kept in one job so
+# SHA256SUMS covers every archive exactly once and the Gitea Release API never
+# receives duplicate checksum assets from parallel architecture jobs.
+permissions:
+  contents: write
+
+jobs:
+  linux-x64:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout tag
+        uses: actions/checkout@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - name: Enable pnpm
+        run: corepack enable && corepack prepare pnpm@9.0.6 --activate
+      - name: Verify tag and test gate
+        run: |
+          set -euo pipefail
+          test "$(node -p 'require("./package.json").version')" = "${GITHUB_REF_NAME#v}"
+          pnpm install --frozen-lockfile
+          pnpm check
+          pnpm test
+      - name: Build Linux release
+        run: pnpm release:build "${GITHUB_REF_NAME#v}" ./release
+      - name: Create and publish signed Gitea Release
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          TALLYNOTE_RELEASE_SIGNING_KEY: ${{ secrets.TALLYNOTE_RELEASE_SIGNING_KEY }}
+        run: ./scripts/publish-gitea-release.sh "$GITHUB_REF_NAME" ./release
+
+  # Linux x86 (i386/i686) is intentionally not published: Node.js 24 and the
+  # better-sqlite3/argon2/sharp native modules have no maintained 32-bit build.
+  # Add an ARM64 job only on a runner with native ARM64 support, then let the
+  # publisher aggregate all archives before signing one SHA256SUMS file.