ci(forgejo): add Actions for test, build, and releases

Host-mode workflows run Go inside golang:1.25-bookworm. CI covers
push/PR; tagged v* builds multi-arch artifacts and publishes a Forgejo
release.

.forgejo/workflows/release.yml

@@ -0,0 +1,79 @@
+# Build multi-arch binaries and publish a Forgejo release on tags v*.
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+concurrency:
+  group: magpie-release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Build and publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+
+      - name: Build release artifacts
+        run: |
+          set -euo pipefail
+          case "$GITHUB_WORKSPACE" in
+            /data/*) HOST_WORKSPACE="/opt/forgejo-runner/data${GITHUB_WORKSPACE#/data}" ;;
+            *) HOST_WORKSPACE="$GITHUB_WORKSPACE" ;;
+          esac
+          version="${GITHUB_REF_NAME}"
+          if [[ "$version" == "main" || -z "$version" ]]; then
+            version="dev-$(echo "$GITHUB_SHA" | cut -c1-7)"
+          fi
+          docker run --rm --network host \
+            --volume "$HOST_WORKSPACE:/src" \
+            --workdir /src \
+            -e CGO_ENABLED=0 \
+            -e VERSION="$version" \
+            -e COMMIT="$(echo "$GITHUB_SHA" | cut -c1-7)" \
+            golang:1.25-bookworm \
+            bash -lc '
+              set -euo pipefail
+              go test ./...
+              make release VERSION="$VERSION" COMMIT="$COMMIT"
+              ls -la dist/
+            '
+
+      - name: Publish Forgejo release
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME}"
+          api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases"
+          # Create release (ignore if already exists)
+          body=$(printf '%s' "{\"tag_name\":\"${tag}\",\"name\":\"${tag}\",\"draft\":false,\"prerelease\":false}")
+          resp=$(curl -sS -w "\n%{http_code}" -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$body" "$api" || true)
+          code=$(printf '%s' "$resp" | tail -n1)
+          payload=$(printf '%s' "$resp" | sed '$d')
+          if [[ "$code" != "201" && "$code" != "200" ]]; then
+            # try fetch existing
+            payload=$(curl -sS -H "Authorization: token ${TOKEN}" \
+              "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases/tags/${tag}")
+          fi
+          id=$(printf '%s' "$payload" | python3 -c 'import sys,json; print(json.load(sys.stdin)["id"])')
+          echo "release id=$id"
+          for f in dist/*; do
+            [ -f "$f" ] || continue
+            name=$(basename "$f")
+            echo "uploading $name"
+            curl -sS -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary @"$f" \
+              "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases/${id}/assets?name=${name}" \
+              | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d.get("name"), d.get("browser_download_url") or d.get("message"))'
+          done