ci: versioned releases publish to codeberg; drop orphaned gitea image push

Codeberg is the public distribution endpoint, so the release job now creates
the release there too — same artifacts as gitea, server image excluded (server
ships as docker-compose build from source). The docker job that built and pushed
redflag-server to the private gitea registry is gone: nothing pulled it once the
install checkoff started reading the running container, and as a publish gate it
could block a public release on a private-registry hiccup.

README clone URL -> codeberg; Dockerfile builds ./cmd/server/ as a package.

.gitea/workflows/release.yml

@@ -379,56 +379,11 @@ jobs:
           path: dist/redflag-*-${{ matrix.suffix }}*
           retention-days: 1
 
-  # Docker image (linux-amd64 only) — built after the linux release job
-  # produces the server binary.
-  docker:
-    runs-on: ubuntu-latest
-    needs: [gate, web]
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
-        with:
-          go-version-file: agent/go.mod
-          cache: true
-
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-
-      - name: Download web UI
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          name: webui-dist
-          path: server/internal/webui/dist
-
-      - name: Build Docker image
-        run: |
-          VERSION=${GITHUB_REF#refs/tags/v}
-          docker build \
-            --build-arg BUILD_VERSION=$VERSION \
-            -t 10.10.20.120:4455/fimeg/redflag:$VERSION \
-            -t 10.10.20.120:4455/fimeg/redflag:latest \
-            -f server/Dockerfile .
-
-      - name: Verify Docker image version
-        run: |
-          set -euo pipefail
-          VERSION=${GITHUB_REF#refs/tags/v}
-          IMG_OUT=$(docker run --rm 10.10.20.120:4455/fimeg/redflag:$VERSION ./redflag-server --version)
-          echo "$IMG_OUT"
-          echo "$IMG_OUT" | grep -q "v$VERSION" || { echo "::error::docker image server reports wrong version"; exit 1; }
-
-      - name: Push Docker to Gitea
-        run: |
-          VERSION=${GITHUB_REF#refs/tags/v}
-          echo "${{ secrets.GITHUB_TOKEN }}" | docker login 10.10.20.120:4455 -u fimeg --password-stdin
-          docker push 10.10.20.120:4455/fimeg/redflag:$VERSION
-          docker push 10.10.20.120:4455/fimeg/redflag:latest
-
   # Publish: gather all platform artifacts, generate the component manifest,
   # and create the Gitea release.
   publish:
     runs-on: ubuntu-latest
-    needs: [release, docker]
+    needs: [release]
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
@@ -474,9 +429,9 @@ jobs:
           done
 
           # Verify every required component has at least one artifact.
-          # server = docker image (verified by docker job). web = embedded (verified
-          # by web job producing a non-empty dist/). agent/helper/desktop = binary
-          # artifacts in the manifest.
+          # server = docker, built from source on the server host (docker-compose
+          # build) — not a release artifact. web = embedded (verified by web job
+          # producing a non-empty dist/). agent/helper/desktop = binary artifacts.
           for comp in agent helper; do
             if ! jq -e --arg c "$comp" '.artifacts[] | select(.platform | test($c))' manifest.json > /dev/null; then
               echo "::error::required component '$comp' has no artifacts in manifest"
@@ -513,3 +468,39 @@ jobs:
               -F "attachment=@$f" > /dev/null
           done
           echo "Release v$VERSION published"
+
+      # Codeberg is the public distribution endpoint. Same artifacts as the Gitea
+      # release, minus the server image — the server ships as docker-compose build
+      # from source, not a pullable image. Skips cleanly if the token is unset.
+      - name: Publish release (Codeberg)
+        run: |
+          set -euo pipefail
+          TOKEN="${{ secrets.CODEBERG_TOKEN }}"
+          if [ -z "$TOKEN" ]; then
+            echo "[INFO] [release] CODEBERG_TOKEN not set — skipping codeberg publish"
+            exit 0
+          fi
+          VERSION=${GITHUB_REF#refs/tags/v}
+          API="https://codeberg.org/api/v1/repos/Fimeg/RedFlag"
+
+          # Codeberg must have the tag before a release can target it.
+          git push "https://Fimeg:${TOKEN}@codeberg.org/Fimeg/RedFlag.git" "refs/tags/v${VERSION}"
+
+          RESPONSE=$(curl -sf -X POST "$API/releases" \
+            -H "Authorization: token $TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"v$VERSION\",\"name\":\"v$VERSION\",\"draft\":false,\"prerelease\":false}")
+          RELEASE_ID=$(echo "$RESPONSE" | grep -oP '"id":\s*\K[0-9]+' | head -1)
+          if [ -z "$RELEASE_ID" ]; then
+            echo "::error::failed to parse codeberg release id from API response: $RESPONSE"
+            exit 1
+          fi
+          echo "Created codeberg release id=$RELEASE_ID"
+
+          find artifacts -type f \( -name '*.tar.gz' -o -name '*.zip' -o -name '*.txt' -o -name 'manifest.json' \) | while read f; do
+            echo "Uploading $(basename "$f") to codeberg"
+            curl -sf -X POST "$API/releases/$RELEASE_ID/assets?name=$(basename "$f")" \
+              -H "Authorization: token $TOKEN" \
+              -F "attachment=@$f" > /dev/null
+          done
+          echo "Codeberg release v$VERSION published"

README.md

@@ -46,7 +46,7 @@ ConnectWise charges $50/agent/month. RedFlag doesn't.
 ### Server
 
 ```bash
-git clone https://github.com/Fimeg/RedFlag.git
+git clone https://codeberg.org/Fimeg/RedFlag.git
 cd RedFlag
 cp config/.env.bootstrap.example config/.env
 docker-compose build && docker-compose up -d

server/Dockerfile

@@ -34,7 +34,7 @@ COPY --from=web-builder /web/dist ./internal/webui/dist
 RUN echo "Building server version: $BUILD_VERSION" && \
     CGO_ENABLED=0 go build \
         -ldflags "-X github.com/Fimeg/RedFlag/server/internal/version.AgentVersion=$BUILD_VERSION" \
-        -o redflag-server cmd/server/main.go
+        -o redflag-server ./cmd/server/
 
 # Stage 2: Build agent binaries for all platforms
 FROM golang:1.25-alpine AS agent-builder