ci: publish HPI to Gogs Releases on main

After a successful main build, POST the plugin artifact to the host
release helper, which creates a Gogs tag+release with the .hpi attached.

Jenkinsfile

@@ -1,16 +1,8 @@
 // CI/CD for Gogs: push and pull requests targeting main.
-// Builds, tests and packaging run inside Docker (DinD), not on the Jenkins host.
-// Triggers are configured on the Jenkins job (Generic Webhook) + Gogs webhooks.
+// Tests/package run in Docker (DinD). Release publishes the HPI to Gogs.
 
 pipeline {
-  agent {
-    docker {
-      image 'ura-ci-maven:21'
-      label 'built-in'
-      alwaysPull false
-      args '-u root -v jenkins-m2-cache:/root/.m2 -e MAVEN_OPTS=-Xmx1024m'
-    }
-  }
+  agent none
 
   options {
     timestamps()
@@ -20,43 +12,60 @@ pipeline {
   }
 
   stages {
-    stage('Checkout') {
-      steps {
-        script {
-          def sha = env.pr_head_sha ?: env.after ?: 'main'
-          if (!sha?.trim() || sha == 'null' || sha == '0000000000000000000000000000000000000000') {
-            sha = 'main'
-          }
-          echo "Gogs event ref=${env.ref} action=${env.action} pr=#${env.pr_number} sha=${sha}"
-          checkout([
-            $class: 'GitSCM',
-            branches: [[name: sha]],
-            extensions: [[$class: 'CloneOption', shallow: false, noTags: false]],
-            userRemoteConfigs: [[url: 'https://git.barcelos.dev/allan/jenkins-mfa-auth-plugin.git']]
-          ])
+    stage('Build') {
+      agent {
+        docker {
+          image 'ura-ci-maven:21'
+          label 'built-in'
+          alwaysPull false
+          args '-u root -v jenkins-m2-cache:/root/.m2 -e MAVEN_OPTS=-Xmx1024m'
         }
       }
-    }
-
-    stage('Test') {
-      steps {
-        sh 'mvn -B -ntp verify'
+      stages {
+        stage('Checkout') {
+          steps {
+            script {
+              def sha = env.pr_head_sha ?: env.after ?: 'main'
+              if (!sha?.trim() || sha == 'null' || sha == '0000000000000000000000000000000000000000') {
+                sha = 'main'
+              }
+              echo "Gogs event ref=${env.ref} action=${env.action} pr=#${env.pr_number} sha=${sha}"
+              env.RELEASE_SHA = sha
+              checkout([
+                $class: 'GitSCM',
+                branches: [[name: sha]],
+                extensions: [[$class: 'CloneOption', shallow: false, noTags: false]],
+                userRemoteConfigs: [[url: 'https://git.barcelos.dev/allan/jenkins-mfa-auth-plugin.git']]
+              ])
+            }
+          }
+        }
+        stage('Test') {
+          steps {
+            sh 'mvn -B -ntp verify'
+          }
+          post {
+            always {
+              junit allowEmptyResults: true, testResults: 'target/surefire-reports/*.xml'
+            }
+          }
+        }
+        stage('Package') {
+          steps {
+            sh 'mvn -B -ntp -DskipTests -Dset.changelist package'
+            sh 'ls -la target/*.hpi'
+            archiveArtifacts artifacts: 'target/*.hpi', fingerprint: true
+            stash name: 'hpi', includes: 'target/*.hpi'
+          }
+        }
       }
       post {
         always {
-          junit allowEmptyResults: true, testResults: 'target/surefire-reports/*.xml'
+          sh 'chmod -R a+rwX "$WORKSPACE" || true'
         }
       }
     }
 
-    stage('Package') {
-      steps {
-        sh 'mvn -B -ntp -DskipTests -Dset.changelist package'
-        sh 'ls -la target/*.hpi target/*.jar'
-        archiveArtifacts artifacts: 'target/*.hpi,target/*-SNAPSHOT.jar', fingerprint: true
-      }
-    }
-
     stage('Release') {
       when {
         allOf {
@@ -64,20 +73,30 @@ pipeline {
           expression { !env.pr_number?.trim() || env.pr_number == 'null' }
         }
       }
+      agent { label 'built-in' }
       steps {
-        echo 'Release artifact is the archived HPI from this build (lastSuccessfulBuild).'
-        sh '''
-          set -e
-          HPI=$(ls -1 target/*.hpi | head -1)
-          echo "HPI=${HPI} size=$(wc -c < "$HPI") sha256=$(sha256sum "$HPI" | awk '{print $1}')"
-        '''
+        unstash 'hpi'
+        withCredentials([string(credentialsId: 'gogs-release-token', variable: 'GOGS_RELEASE_TOKEN')]) {
+          sh '''
+            set -euo pipefail
+            HPI=$(ls -1 target/*.hpi | head -1)
+            SHA="${RELEASE_SHA:-${after:-}}"
+            if [ -z "$SHA" ] || [ "$SHA" = "null" ]; then
+              SHA=$(git rev-parse HEAD 2>/dev/null || echo "")
+            fi
+            TAG="1.0.${BUILD_NUMBER}"
+            echo "Publishing ${HPI} as Gogs release ${TAG} sha=${SHA}"
+            curl -fsS -X POST \
+              -H "X-Release-Token: ${GOGS_RELEASE_TOKEN}" \
+              -F "file=@${HPI}" \
+              -F "tag=${TAG}" \
+              -F "sha=${SHA}" \
+              -F "title=mfa-totp ${TAG}" \
+              -F "body=Jenkins build #${BUILD_NUMBER} (${SHA}). Artifact: $(basename "$HPI")" \
+              http://host.docker.internal:9377/publish
+          '''
+        }
       }
     }
   }
-
-  post {
-    always {
-      sh 'chmod -R a+rwX "$WORKSPACE" || true'
-    }
-  }
 }

README.md

@@ -111,7 +111,9 @@ On **push** to `main` and on **pull requests targeting `main`**, Jenkins:
 2. Packages the `.hpi`
 3. Archives the plugin as a build artifact
 
-Successful main builds: [last HPI](https://jenkins.barcelos.dev/job/jenkins-mfa-auth-plugin/lastSuccessfulBuild/artifact/).
+Successful **push to main** also publishes the `.hpi` as a [Gogs release](https://git.barcelos.dev/allan/jenkins-mfa-auth-plugin/releases).
+
+Jenkins artifacts: [last HPI](https://jenkins.barcelos.dev/job/jenkins-mfa-auth-plugin/lastSuccessfulBuild/artifact/).
 
 ### Contribution Guidelines
 1. Fork the repository

ci.yaml

@@ -31,4 +31,4 @@ jobs:
           path: target/*.hpi
       - name: Release
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        run: echo "HPI published as Jenkins lastSuccessfulBuild artifact"
+        run: publish HPI to Gogs Releases (tag 1.0.$BUILD_NUMBER)