ci: add release automation and version check workflows

- release.yaml: auto-creates Gitea releases on semver tag push with
  changelog, version/tag consistency check, and endpoint drift check
- version-check.yaml: warns on PRs that change src/ without bumping
  the package.json version

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yaml

@@ -0,0 +1,83 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Verify version matches tag
+        run: |
+          TAG="${GITHUB_REF#refs/tags/v}"
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          if [ "$TAG" != "$PKG_VERSION" ]; then
+            echo "::error::Tag v${TAG} does not match package.json version ${PKG_VERSION}"
+            exit 1
+          fi
+          echo "Version match confirmed: v${TAG}"
+
+      - name: Check endpoint drift
+        run: npm run check-endpoint-drift
+
+      - name: Generate changelog
+        id: changelog
+        run: |
+          TAG="${GITHUB_REF#refs/tags/}"
+          PREV_TAG=$(git tag --sort=-v:refname | grep '^v' | sed -n '2p')
+          if [ -n "$PREV_TAG" ]; then
+            LOG=$(git log --pretty=format:"- %s (%h)" "${PREV_TAG}..${TAG}")
+            echo "PREV_TAG=${PREV_TAG}" >> "$GITHUB_OUTPUT"
+          else
+            LOG=$(git log --pretty=format:"- %s (%h)" "${TAG}")
+          fi
+          # Write multiline output
+          {
+            echo "log<<CHANGELOG_EOF"
+            echo "$LOG"
+            echo "CHANGELOG_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Create Gitea release
+        env:
+          GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+        run: |
+          TAG="${GITHUB_REF#refs/tags/}"
+          PREV_TAG="${{ steps.changelog.outputs.PREV_TAG }}"
+          BODY="## Changes
+
+          ${{ steps.changelog.outputs.log }}"
+
+          if [ -n "$PREV_TAG" ]; then
+            BODY="${BODY}
+
+          **Full Changelog**: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/compare/${PREV_TAG}...${TAG}"
+          fi
+
+          curl -s -X POST "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases" \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -n \
+              --arg tag "$TAG" \
+              --arg name "$TAG" \
+              --arg body "$BODY" \
+              '{tag_name: $tag, name: $name, body: $body, draft: false, prerelease: false}'
+            )"

.gitea/workflows/version-check.yaml

@@ -0,0 +1,38 @@
+name: Version Check
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'package.json'
+      - 'src/**'
+
+jobs:
+  check-version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check version was bumped if source changed
+        run: |
+          BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          HEAD_SHA="${{ github.event.pull_request.head.sha }}"
+
+          # Check if any src/ files changed
+          SRC_CHANGED=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" -- 'src/' | wc -l)
+          if [ "$SRC_CHANGED" -eq 0 ]; then
+            echo "No source changes detected, skipping version check."
+            exit 0
+          fi
+
+          # Compare package.json versions
+          BASE_VERSION=$(git show "${BASE_SHA}:package.json" | node -p "JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')).version")
+          HEAD_VERSION=$(node -p "require('./package.json').version")
+
+          if [ "$BASE_VERSION" = "$HEAD_VERSION" ]; then
+            echo "::warning::Source files changed but package.json version was not bumped (${HEAD_VERSION}). Consider updating the version."
+          else
+            echo "Version bumped: ${BASE_VERSION} → ${HEAD_VERSION}"
+          fi