From 4181925047d2ba0ed4360e1817da1894006f2e4d Mon Sep 17 00:00:00 2001
From: Christoph Brandau <c.brandau91@gmail.com>
Date: Sat, 15 Aug 2026 21:15:09 +0200
Subject: [PATCH] ci(app-builder): fetch AppImage from Gitea release using
 token

Replace unauthenticated artifact lookup with an authenticated Gitea
release API call that fetches release JSON and asset metadata.
Require a Gitea token (with optional fallback), use it to locate the
AppImage asset in the release JSON, extract its name and download URL,
and download the file with an Authorization header.
Fail early when no token is present and verify the downloaded asset
checksum to ensure integrity; this enables access to protected releases
and improves asset selection robustness.

- Enforce token presence and use Authorization header for API calls.
- Parse release JSON to select .appimage asset and determine filename.
- Remove dependency on unauthenticated artifact base URL lookup.
---
 .gitea/workflows/app_builder.yaml | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/app_builder.yaml b/.gitea/workflows/app_builder.yaml
index 2d9a3b8..edbe016 100644
--- a/.gitea/workflows/app_builder.yaml
+++ b/.gitea/workflows/app_builder.yaml
@@ -129,7 +129,6 @@ jobs:
     environment: production
     env:
       AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-      ARTIFACT_BASE_URL: ${{ vars.ARTIFACT_BASE_URL }}
       GITEA_API: https://git.cbsk-tech.de/api/v1
       OWNER: Christoph
       REPO: GitLite
@@ -249,16 +248,24 @@ jobs:
         run: |
           set -euo pipefail
 
-          LATEST_JSON="$(curl --fail --location --silent --show-error \
-            "$ARTIFACT_BASE_URL/gitty/latest.json")"
-          export LATEST_JSON
-          APPIMAGE_URL="$(node -e "const p=JSON.parse(process.env.LATEST_JSON); const a=p.platforms?.['linux-x86_64']?.url; if (!a) process.exit(1); process.stdout.write(a)")"
-          APPIMAGE_NAME="${APPIMAGE_URL##*/}"
+          TOKEN="${GITEA_TOKEN:-${GITEA_FALLBACK_TOKEN:-}}"
+          if [ -z "$TOKEN" ]; then
+            echo "A Gitea token is required to download the AppImage" >&2
+            exit 1
+          fi
+
+          RELEASE_JSON="$(curl --fail --location --silent --show-error \
+            --header "Authorization: token $TOKEN" \
+            "$GITEA_API/repos/$OWNER/$REPO/releases/tags/$RELEASE_TAG")"
+          export RELEASE_JSON
+          APPIMAGE_URL="$(node -e "const r=JSON.parse(process.env.RELEASE_JSON); const a=(r.assets || []).find(a => String(a.name || '').toLowerCase().endsWith('.appimage')); if (!a?.browser_download_url) process.exit(1); process.stdout.write(a.browser_download_url)")"
+          APPIMAGE_NAME="$(node -e "const r=JSON.parse(process.env.RELEASE_JSON); const a=(r.assets || []).find(a => String(a.name || '').toLowerCase().endsWith('.appimage')); if (!a?.name) process.exit(1); process.stdout.write(a.name)")"
 
           AUR_BIN_DIR="$(mktemp -d)"
           cp PKGBUILD-bin "$AUR_BIN_DIR/PKGBUILD"
           APPIMAGE_PATH="$AUR_BIN_DIR/$APPIMAGE_NAME"
           curl --fail --location --silent --show-error \
+            --header "Authorization: token $TOKEN" \
             --output "$APPIMAGE_PATH" "$APPIMAGE_URL"
           APPIMAGE_CHECKSUM="$(sha256sum "$APPIMAGE_PATH" | cut -d ' ' -f 1)"
           ICON_PATH="$AUR_BIN_DIR/gitty-desktop.png"