Gitea Actions workflows

`release-artifact.yml`

Triggers on every push to master. Builds the linux-arm64 sled binary and publishes it to the "dev" release channel via script/ci-publish-artifact.

Runner registration

The job targets the arm64-mac runner label. Register an act_runner on an Apple Silicon macOS host that has cargo/rustc and curl on PATH:

act_runner register \
  --instance https://code.crashlabs.io \
  --token <runner-registration-token> \
  --labels arm64-mac
act_runner daemon

The registration token comes from the repo's Settings → Actions → Runners → Create new Runner page in Gitea. Without a runner carrying the arm64-mac label, jobs from this workflow queue indefinitely.

Secrets

Configure these under the repo's Settings → Actions → Secrets. Never commit credentials — the workflow only ever references them via ${{ secrets.* }}.

Secret	Purpose
`HUSKIES_CHANNEL_URL`	Base URL of the dev release channel host.
`HUSKIES_CHANNEL_TOKEN`	Bearer token authorised to publish artifacts to that channel.

Channel host contract

script/ci-publish-artifact expects the channel host at HUSKIES_CHANNEL_URL to implement:

POST {HUSKIES_CHANNEL_URL}/<artifact-name> — accepts the raw artifact bytes as the request body. Requires Authorization: Bearer <token> and X-Git-Hash: <short-git-hash> headers. Non-2xx responses in the 4xx range (including 401/403) are treated as permanent failures; 5xx responses and network errors are retried with backoff.
GET {HUSKIES_CHANNEL_URL}/manifest.json — returns a JSON object with a git_hash field reflecting the most recently published artifact. Requires Authorization: Bearer <token>.

This is a separate, unsigned channel distinct from the Ed25519-signed release channels the pull <channel> gateway command consumes (see server/src/service/gateway/release_manifest.rs) — CI has no safe place to hold a channel signing key, so the dev channel trusts the bearer token alone.