ci: repair the path from matrix to release object

The upload glob took only redflag-* files, so checksums, installer and snippet never left the matrix job, and the merge indexed a bare array and discarded the manifest.

AGPL binaries now travel with their licence.

.gitea/workflows/release.yml

@@ -414,12 +414,15 @@ jobs:
         run: |
           VERSION=${GITHUB_REF#refs/tags/v}
           cd dist
+          # AGPL binaries travel with their licence or they are conveyed
+          # without one.
+          cp ../LICENSE ../THIRD_PARTY_LICENSES.md .
           ls -la
           if [ "${{ matrix.goos }}" = "windows" ]; then
             # Windows: zip (no helper — it's Unix-only). Desktop binary and
             # the RedFlagSetup installer are both optional (only exist for
             # windows-amd64 today, not e.g. windows-arm64).
-            ZIP_FILES="redflag-server-${{ matrix.suffix }}.exe redflag-agent-${{ matrix.suffix }}.exe"
+            ZIP_FILES="LICENSE THIRD_PARTY_LICENSES.md redflag-server-${{ matrix.suffix }}.exe redflag-agent-${{ matrix.suffix }}.exe"
             if [ -f "redflag-desktop-${{ matrix.suffix }}.exe" ]; then
               ZIP_FILES="$ZIP_FILES redflag-desktop-${{ matrix.suffix }}.exe"
             fi
@@ -429,7 +432,7 @@ jobs:
             zip redflag-$VERSION-${{ matrix.suffix }}.zip $ZIP_FILES
             sha256sum redflag-$VERSION-${{ matrix.suffix }}.zip > checksums-$VERSION-${{ matrix.suffix }}.txt
           else
-            tar czf redflag-$VERSION-${{ matrix.suffix }}.tar.gz redflag-*-${{ matrix.suffix }}
+            tar czf redflag-$VERSION-${{ matrix.suffix }}.tar.gz LICENSE THIRD_PARTY_LICENSES.md redflag-*-${{ matrix.suffix }}
             sha256sum redflag-$VERSION-${{ matrix.suffix }}.tar.gz > checksums-$VERSION-${{ matrix.suffix }}.txt
           fi
 
@@ -483,7 +486,14 @@ jobs:
       - uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
         with:
           name: release-${{ matrix.suffix }}
-          path: dist/redflag-*-${{ matrix.suffix }}*
+          # The checksum file and the manifest snippet do not start with
+          # redflag-, so a single redflag-* glob leaves both behind in the
+          # matrix job and publish finds nothing to merge or attach.
+          path: |
+            dist/redflag-*-${{ matrix.suffix }}*
+            dist/RedFlagSetup-${{ matrix.suffix }}.msi
+            dist/checksums-*-${{ matrix.suffix }}.txt
+            dist/release-${{ matrix.suffix }}.artifacts.json
           retention-days: 1
 
   # Publish: gather all platform artifacts, generate the component manifest,
@@ -535,7 +545,10 @@ jobs:
           for f in artifacts/release-*/release-*.artifacts.json; do
             if [ -f "$f" ]; then
               echo "Merging artifact entries from $(basename "$(dirname "$f")")/$(basename "$f")"
-              jq -s '.[0].artifacts + .[1].artifacts' manifest.json "$f" > manifest.tmp \
+              # The snippet file is a bare array, and the result has to stay
+              # the manifest object — indexing .[1].artifacts here threw the
+              # whole manifest away along with its version and components.
+              jq -s '.[0] + {artifacts: (.[0].artifacts + .[1])}' manifest.json "$f" > manifest.tmp \
                 && mv manifest.tmp manifest.json
             fi
           done