feat(workflows): attach Arch package to Gitea release

Add a CI step that finds the built Arch binary and attaches it
to the matching Gitea release using the repository API. The step
validates that the package was created, requires a Gitea token,
and skips upload if the asset already exists to avoid duplicates.

- Export artifact path to the environment and validate its presence
- Query the release to obtain its ID and upload the asset if missing

.gitea/workflows/app_builder.yaml

@@ -123,11 +123,18 @@ jobs:
   publish-arch:
     name: Build and publish AUR packages
     needs: publish-ubuntu
+    permissions:
+      contents: write
     runs-on: archlinux
     environment: production
     env:
       AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
       ARTIFACT_BASE_URL: ${{ vars.ARTIFACT_BASE_URL }}
+      GITEA_API: https://git.cbsk-tech.de/api/v1
+      OWNER: Christoph
+      REPO: GitLite
+      GITEA_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
+      GITEA_FALLBACK_TOKEN: ${{ github.token }}
 
     defaults:
       run:
@@ -273,7 +280,44 @@ jobs:
           runuser -u builder -- \
             bash -lc "cd '$AUR_BIN_DIR' && makepkg --cleanbuild --noconfirm && makepkg --printsrcinfo > .SRCINFO"
 
+          ARCH_BIN_PACKAGE_PATH="$(find "$AUR_BIN_DIR" -maxdepth 1 -type f -name 'gitty-desktop-bin-*.pkg.tar.zst' -print -quit)"
+          if [ -z "$ARCH_BIN_PACKAGE_PATH" ]; then
+            echo "The binary Arch package was not created" >&2
+            exit 1
+          fi
+
           echo "AUR_BIN_DIR=$AUR_BIN_DIR" >> "$GITHUB_ENV"
+          echo "ARCH_BIN_PACKAGE_PATH=$ARCH_BIN_PACKAGE_PATH" >> "$GITHUB_ENV"
+
+      - name: Attach binary Arch package to Gitea release
+        run: |
+          set -euo pipefail
+
+          TOKEN="${GITEA_TOKEN:-${GITEA_FALLBACK_TOKEN:-}}"
+          if [ -z "$TOKEN" ]; then
+            echo "A Gitea token is required to upload the Arch package" >&2
+            exit 1
+          fi
+
+          RELEASE_JSON="$(curl --fail --location --silent --show-error \
+            --header "Authorization: token $TOKEN" \
+            "$GITEA_API/repos/$OWNER/$REPO/releases/tags/$RELEASE_TAG")"
+          export RELEASE_JSON
+          RELEASE_ID="$(node -e "const r=JSON.parse(process.env.RELEASE_JSON); if (!r.id) process.exit(1); process.stdout.write(String(r.id))")"
+          PACKAGE_NAME="${ARCH_BIN_PACKAGE_PATH##*/}"
+          export PACKAGE_NAME
+
+          if node -e "const r=JSON.parse(process.env.RELEASE_JSON); process.exit((r.assets || []).some(a => a.name === process.env.PACKAGE_NAME) ? 0 : 1)"; then
+            echo "Release asset $PACKAGE_NAME already exists; skipping upload."
+          else
+            curl --fail --location --silent --show-error \
+              --request POST \
+              --header "Authorization: token $TOKEN" \
+              --form "attachment=@$ARCH_BIN_PACKAGE_PATH;type=application/octet-stream" \
+              "$GITEA_API/repos/$OWNER/$REPO/releases/$RELEASE_ID/assets?name=$PACKAGE_NAME"
+            echo
+            echo "Attached $PACKAGE_NAME to Gitea release $RELEASE_TAG."
+          fi
 
       - name: Publish PKGBUILD to AUR
         env: