ci: every push to master is a release, the metainfo's newest

A push to master published the build as the rolling `beta` branch and
refreshed a `latest` prerelease; a tag cut the stable release. Now every
push to master is the release: CI takes the version from the
metainfo's newest <release>, publishes `stable`, tags the pushed commit
and creates the release with that entry's notes. A version that is
released already fails the job before anything is built or published,
and so does a lookup that cannot tell, so a push to master adds a new
<release>. Publishing is master's alone: a manual run on another branch
builds and tests and cuts nothing. Tags are no longer a trigger, and the
rolling `beta` and `latest` steps are gone. The README and AGENTS say
so, and the first release's entry, 1.0.0, takes the date of its push
and names what it ships.

.forgejo/workflows/ci.yaml

@@ -2,11 +2,14 @@
 # SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
 name: Flatpak
 
-# Crafter.Build's workflow, for this app. One job, three outcomes:
+# Crafter.Build's workflow, for this app, with one change: every push to
+# master is a release (2026-11-02: no rolling `beta` or `latest` builds).
+# One job, two outcomes:
 #   pull request  -> build the Flatpak, run the suite inside it, smoke-test it
-#   push master   -> also publish it as the `beta` branch of the Catcrafts
-#                    repo and refresh the rolling `latest` release
-#   tag X.Y.Z     -> publish it as `stable` and create release X.Y.Z
+#   push master   -> also publish it as `stable` and cut release X.Y.Z, the
+#                    metainfo's newest <release>: its tag at the pushed commit
+#                    and its notes. A version that is released already fails
+#                    the job before anything is built or published.
 #
 # It builds on the Crafter.Build Flatpak (`base:` in the manifest), whose
 # crafter-build and LLVM compile this project, so the runner installs that
@@ -27,7 +30,6 @@ on:
     branches: [master]
   push:
     branches: [master]
-    tags: ['[0-9]*.[0-9]*.[0-9]*']
   workflow_dispatch:
 
 env:
@@ -79,29 +81,22 @@ jobs:
         id: meta
         run: |
           set -eu
-          if [ "${GITHUB_REF_TYPE}" = tag ]; then
-            version="$GITHUB_REF_NAME"
-            branch=stable
-            # The metainfo's newest release is the release notes and must be
-            # the version being tagged.
-            top=$(grep -m1 -oP '<release version="\K[^"]+' "$METAINFO")
-            if [ "$top" != "$version" ]; then
-              echo "metainfo lists $top as the newest release, but the tag is $version" >&2
-              exit 1
-            fi
-          else
-            # Named after the release it follows, as a checkout describes
-            # itself: 1.0.0-3-g21746b1 is three commits past 1.0.0.
-            described=$(git describe --tags --always --exclude=latest)
-            case "$described" in
-              [0-9]*.[0-9]*.[0-9]*) version="$described" ;;
-              *) version="0.0.0-dev+$described" ;;
+          # The metainfo's newest release is the version and its notes. On
+          # master it must be new: its tag must not exist yet, and a lookup
+          # that cannot tell stops the job as well.
+          version=$(grep -m1 -oP '<release version="\K[^"]+' "$METAINFO")
+          if [ "${GITHUB_REF}" = refs/heads/master ]; then
+            code=0
+            git ls-remote --exit-code --tags origin "refs/tags/$version" > /dev/null || code=$?
+            case "$code" in
+              0) echo "the metainfo's newest release, $version, is released already: a push to master names a new <release> in $METAINFO" >&2; exit 1 ;;
+              2) ;;
+              *) echo "git ls-remote exited $code: cannot tell whether $version is released" >&2; exit 1 ;;
             esac
-            branch=beta
           fi
           echo "version=$version" >> "$GITHUB_OUTPUT"
-          echo "branch=$branch" >> "$GITHUB_OUTPUT"
-          echo "version $version, flatpak branch $branch"
+          echo "branch=stable" >> "$GITHUB_OUTPUT"
+          echo "version $version, flatpak branch stable"
 
       - name: Build
         # The manifest is rewritten beside the original so its relative
@@ -163,9 +158,9 @@ jobs:
             if [ "$code" != 2 ]; then echo "the dry run exited $code, not 2" >&2; exit 1; fi
             ls scratch/*-dry/prompts | head -3'
 
-      # Everything below publishes and only runs on master and on tags.
+      # Everything below publishes and only runs on master.
       - name: Bundle
-        if: github.event_name != 'pull_request'
+        if: github.ref == 'refs/heads/master'
         run: |
           mkdir -p dist
           flatpak build-bundle repo "dist/crafter-review-${{ steps.meta.outputs.version }}.flatpak" "$APP_ID" "${{ steps.meta.outputs.branch }}"
@@ -174,7 +169,7 @@ jobs:
           ls -la dist
 
       - name: Upload bundle
-        if: github.event_name != 'pull_request'
+        if: github.ref == 'refs/heads/master'
         uses: actions/upload-artifact@v3
         with:
           name: crafter-review-${{ steps.meta.outputs.version }}
@@ -182,7 +177,7 @@ jobs:
           if-no-files-found: error
 
       - name: Publish to the Catcrafts repo
-        if: github.event_name != 'pull_request'
+        if: github.ref == 'refs/heads/master'
         run: |
           set -eu
           if [ ! -s /run/crafter-flatpak/signing-key.asc ] || [ ! -s /run/crafter-flatpak/key-id ]; then
@@ -208,29 +203,16 @@ jobs:
           sed "s|GPGKey=.*|GPGKey=$key|" packaging/flatpak/net.catcrafts.CrafterReview.flatpakref > "$WEB_DIR/net.catcrafts.CrafterReview.flatpakref"
           flock -u 9
 
-      - name: Rolling 'latest' release
-        if: github.event_name != 'pull_request' && github.ref_type != 'tag'
+      - name: Tag the release
+        if: github.ref == 'refs/heads/master'
         run: |
-          git config user.email "ci@catcrafts.net"
-          git config user.name "Crafter Review CI"
-          git tag -f latest
-          git push origin latest --force
-      - name: Publish rolling 'latest' release
-        if: github.event_name != 'pull_request' && github.ref_type != 'tag'
-        uses: https://code.forgejo.org/actions/forgejo-release@v2
-        with:
-          direction: upload
-          url: ${{ github.server_url }}
-          repo: ${{ github.repository }}
-          tag: latest
-          title: Latest master build
-          prerelease: true
-          override: true
-          release-dir: dist
-          token: ${{ secrets.GITHUB_TOKEN }}
+          # The release's tag at the pushed commit. Never forced: a tag that
+          # appeared since the version check fails the push.
+          git tag "${{ steps.meta.outputs.version }}" "$GITHUB_SHA"
+          git push origin "refs/tags/${{ steps.meta.outputs.version }}"
 
       - name: Release notes
-        if: github.ref_type == 'tag'
+        if: github.ref == 'refs/heads/master'
         run: |
           # The newest <release> block's description as Markdown, the way
           # Crafter.Build's workflow writes its notes.
@@ -261,14 +243,14 @@ jobs:
           print("\nInstall:\n\n    flatpak remote-add --if-not-exists catcrafts https://flatpak.catcrafts.net/catcrafts.flatpakrepo\n    flatpak install catcrafts net.catcrafts.CrafterReview\n")
           EOF
       - name: Publish release
-        if: github.ref_type == 'tag'
+        if: github.ref == 'refs/heads/master'
         uses: https://code.forgejo.org/actions/forgejo-release@v2
         with:
           direction: upload
           url: ${{ github.server_url }}
           repo: ${{ github.repository }}
-          tag: ${{ github.ref_name }}
-          title: crafter-review ${{ github.ref_name }}
+          tag: ${{ steps.meta.outputs.version }}
+          title: crafter-review ${{ steps.meta.outputs.version }}
           release-notes-file: release-notes.md
           release-dir: dist
           token: ${{ secrets.GITHUB_TOKEN }}