ci(release): exact tag checks and a retryable beta publish (#40)

### What this changes

- New `scripts/release_gate.sh`, used by the `detect` jobs of both `release.yaml` and `beta.yaml`, decides whether the committed version still needs publishing. Tags are read by exact name via `git ls-remote` instead of Codeberg's `git/refs/tags/<name>` API.
- A beta counts as done only once its Codeberg pre-release carries the APK, so a publish that failed part-way is redone by the next push of the branch.
- A beta is refused unless it is newer than the latest stable tag (previously only an exact `vX.Y.Z` tag was checked).
- `publish_codeberg_release.sh` fails a pre-release when `CODEBERG_RELEASE_TOKEN` is missing (stable still skips), fails on any asset upload that doesn't return 201, and no longer aborts when the asset listing returns an error.
- `version_info.sh` rejects leading zeros (`1.1.0-beta.01` would have shared `beta.1`'s versionCode under a different tag).
- `beta.yaml` header and `docs/RELEASING.md` updated to match.

### Why

Codeberg's `git/refs/tags/<name>` matches by prefix: asking for `v1.1.0` returns 200 because `v1.1.0-beta.1` exists. Merging 1.1.0 into `main` would have logged "tag already exists" and shipped nothing while the run stayed green, and `1.1.0-beta.2` would have been refused as "already shipped stable".

`release/v1.1.0` needs `main` merged in after this lands, since `beta.yaml` runs from the pushed branch's files.

### Also in here

`gradle/gradle-daemon-jvm.properties` now points at JetBrains' own download URLs for JBR 21.0.11 instead of foojay. foojay dropped JetBrains 21 from its index, so the pinned package ids return 400 and CI couldn't provision the daemon JVM (unrelated to the release change, but it blocks every PR until fixed).

### Checklist

- [x] No `values-*/strings.xml` touched
- [x] No `versionName` / `versionCode` bump
- [x] `CHANGELOG.md` not updated: release infrastructure, not a user-visible change

Co-authored-by: Jean-Luc Makiola <business@jeanlucmakiola.de>
Reviewed-on: https://codeberg.org/jlmakiola/agendula/pulls/40

.gitea/workflows/beta.yaml

@@ -3,7 +3,7 @@ name: Beta — Codeberg pre-release
 # A beta is cut by pushing a release branch whose committed versionName is
 # X.Y.Z-beta.N (see docs/RELEASING.md). Same model as release.yaml: the
 # committed version is the trigger and the vX.Y.Z-beta.N tag is an output. If
-# no tag exists for that version yet, this runs the unit tests, builds and
+# its Codeberg pre-release doesn't carry the APK yet, this runs the unit tests, builds and
 # signs the APK with the app key, records a Gitea pre-release (with the R8
 # mapping) and publishes a Codeberg pre-release with the APK + SHA-256.
 #
@@ -36,53 +36,23 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Resolve version and whether it is a new beta
+      - name: Resolve version and whether it still needs publishing
         id: v
-        env:
-          # Codeberg, not Gitea: see the same lookup in release.yaml.
-          TAG_API: https://codeberg.org/api/v1/repos/jlmakiola/agendula
         run: |
           set -e
           INFO=$(bash scripts/version_info.sh)
           echo "$INFO"
           echo "$INFO" >> "$GITHUB_OUTPUT"
-          VERSION=$(echo "$INFO" | sed -n 's/^version=//p')
-          BASE=$(echo "$INFO" | sed -n 's/^base_version=//p')
-          if [ "$(echo "$INFO" | sed -n 's/^channel=//p')" != "beta" ]; then
-            echo "versionName $VERSION is not a beta — nothing to do."
+          if [ "$(bash scripts/version_info.sh channel)" != beta ]; then
+            echo "Not a beta — nothing to do."
             echo "is_beta=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          # Fatal on anything but a clean 200/404, as in release.yaml: guessing
-          # "no tag" during an outage would re-cut a published beta.
-          tag_status() {
-            curl -s -o /dev/null -w '%{http_code}' "$TAG_API/git/refs/tags/$1" || echo 000
-          }
-          # A beta of a version that already shipped stable would carry a lower
-          # versionCode than the stable one: nobody could install it over it.
-          case "$(tag_status "v$BASE")" in
-            200)
-              echo "v$BASE already shipped as stable; a beta of it is pointless. Bump the version." >&2
-              exit 1 ;;
-            404) ;;
-            *) echo "Codeberg tag lookup for v$BASE failed — refusing to guess." >&2; exit 1 ;;
-          esac
-          STATUS=$(tag_status "v$VERSION")
-          case "$STATUS" in
-            200)
-              echo "Tag v$VERSION already exists on Codeberg — nothing to release."
-              echo "is_beta=false" >> "$GITHUB_OUTPUT"
-              ;;
-            404)
-              echo "No tag for v$VERSION on Codeberg yet — cutting the beta."
-              echo "is_beta=true" >> "$GITHUB_OUTPUT"
-              ;;
-            *)
-              echo "Codeberg tag lookup for v$VERSION returned HTTP $STATUS." >&2
-              echo "Refusing to guess: treating this as 'no tag' could re-cut a published beta." >&2
-              exit 1
-              ;;
-          esac
+          # Done only once its Codeberg pre-release carries the APK, so a failed
+          # publish is redone by the next push; refused unless newer than the
+          # latest stable release.
+          GATE=$(bash scripts/release_gate.sh)
+          echo "is_beta=${GATE#cut=}" >> "$GITHUB_OUTPUT"
 
   beta:
     needs: detect

.gitea/workflows/release.yaml

@@ -62,17 +62,6 @@ jobs:
 
       - name: Resolve version and whether it is a new release
         id: v
-        env:
-          # Tags are read from Codeberg, which is canonical — deliberately NOT
-          # from the Gitea API this workflow runs on. The Codeberg -> Gitea sync
-          # is a push mirror, i.e. `git push --mirror`, which deletes refs the
-          # source does not have. A tag minted here on Gitea is therefore wiped
-          # by the next sync (Codeberg does not have it yet) and only reappears
-          # once the tag push at the end of this workflow propagates back.
-          # Asking Gitea inside that window would report "no tag" for a release
-          # that already shipped, and cut it a second time.
-          # Public repo, so this read needs no token.
-          TAG_API: https://codeberg.org/api/v1/repos/jlmakiola/agendula
         run: |
           set -e
           # versionName -> versionCode, channel and the pre-release flag (set
@@ -94,30 +83,11 @@ jobs:
             echo "versionName $VERSION on main is a beta. Set the stable version before merging to main." >&2
             exit 1
           fi
-          # A tag for this version already existing means the release shipped on
-          # an earlier push; do nothing. Absent => this merge cuts the release.
-          #
-          # Anything other than a clean 200/404 is treated as fatal rather than
-          # as "no tag". A Codeberg outage or a network blip would otherwise
-          # read as absent and re-cut a release that has already shipped —
-          # republishing to F-Droid. Failing here is recoverable; a duplicate
-          # release is not.
-          STATUS=$(curl -s -o /dev/null -w '%{http_code}' "$TAG_API/git/refs/tags/v$VERSION" || echo 000)
-          case "$STATUS" in
-            200)
-              echo "Tag v$VERSION already exists on Codeberg — nothing to release."
-              echo "is_release=false" >> "$GITHUB_OUTPUT"
-              ;;
-            404)
-              echo "No tag for v$VERSION on Codeberg yet — cutting the release."
-              echo "is_release=true" >> "$GITHUB_OUTPUT"
-              ;;
-            *)
-              echo "Codeberg tag lookup for v$VERSION returned HTTP $STATUS." >&2
-              echo "Refusing to guess: treating this as 'no tag' could re-cut a shipped release." >&2
-              exit 1
-              ;;
-          esac
+          # Tags are read from Codeberg, the canonical forge, by exact name: its
+          # git/refs/tags API matches by prefix, so v1.1.0-beta.1 would read as
+          # v1.1.0. A lookup error is fatal rather than read as "no tag".
+          GATE=$(bash scripts/release_gate.sh)
+          echo "is_release=${GATE#cut=}" >> "$GITHUB_OUTPUT"
 
       # Before a single Gradle task runs: F-Droid truncates the in-client
       # changelog, so an over-long one would reach users cut off mid-sentence.