ci: release workflow without GitHub actions (network blocked) - pure run steps

- GitHub unreachable on prod network; actions/checkout@v4 etc fail to download
- Rewrite release.yaml using only run: steps (git clone from Gitea, docker build/push)
- Clone uses REGISTRY_TOKEN (oauth2) from Gitea secrets
- Registry push is best-effort; always saves image tarball artifact

.gitea/workflows/release.yaml

@@ -7,46 +7,54 @@ on:
 
 jobs:
   build-arm64:
-    # Нативный ARM64 runner на Orange Pi Zero 2 (aarch64)
-    # Сборка без QEMU-эмуляции — быстрее и стабильнее для npm install / node-gyp
+    # Нативный ARM64 runner на Orange Pi Zero 2 (aarch64).
+    # GitHub недоступен в этой сети — НЕ используем actions/*, только чистые run: шаги.
     runs-on: arm64
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        run: |
+          set -e
+          cd /tmp
+          rm -rf release-src
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "https://oauth2:${REGISTRY_TOKEN}@git.softuniq.eu/Telegram-Market/telegram-shop.git" release-src
+          cd release-src
+          git rev-parse --short HEAD
 
-      - name: Extract tag
+      - name: Extract version
         id: meta
         run: |
-          TAG=${GITHUB_REF_NAME#v}
-          echo "version=$TAG" >> "$GITHUB_OUTPUT"
-          echo "image=git.softuniq.eu/telegram-market/telegram-shop" >> "$GITHUB_OUTPUT"
+          VERSION=${GITHUB_REF_NAME#v}
+          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
+          echo "Build version: ${VERSION}"
 
       - name: Build ARM64 image
+        working-directory: /tmp/release-src
         run: |
+          set -e
           docker build \
             --file ./Dockerfile \
-            --tag ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }} \
-            --tag ${{ steps.meta.outputs.image }}:latest \
+            --tag git.softuniq.eu/telegram-market/telegram-shop:${VERSION} \
+            --tag git.softuniq.eu/telegram-market/telegram-shop:latest \
             .
 
-      - name: Log in to Gitea Container Registry (best effort)
-        id: login
-        continue-on-error: true
-        uses: docker/login-action@v3
-        with:
-          registry: git.softuniq.eu
-          username: ${{ github.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Push image to Gitea Container Registry
-        if: steps.login.outcome == 'success'
+      - name: Push to Gitea Container Registry (best effort)
+        working-directory: /tmp/release-src
         run: |
-          docker push ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}
-          docker push ${{ steps.meta.outputs.image }}:latest
+          set -e
+          echo "${REGISTRY_TOKEN}" | docker login git.softuniq.eu -u oauth2 --password-stdin \
+            || { echo "registry login failed, skipping push"; exit 0; }
+          docker push git.softuniq.eu/telegram-market/telegram-shop:${VERSION} \
+            || echo "push tag failed (may need package scope)"
+          docker push git.softuniq.eu/telegram-market/telegram-shop:latest \
+            || echo "push latest failed (may need package scope)"
+          docker logout git.softuniq.eu || true
 
-      - name: Save image tarball
+      - name: Save image tarball artifact
+        working-directory: /tmp/release-src
         run: |
+          set -e
           mkdir -p /tmp/release-artifacts
-          docker save ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }} \
-            -o /tmp/release-artifacts/telegram-shop-arm64-${{ steps.meta.outputs.version }}.tar
-          ls -la /tmp/release-artifacts/
+          docker save git.softuniq.eu/telegram-market/telegram-shop:${VERSION} \
+            -o /tmp/release-artifacts/telegram-shop-arm64-${VERSION}.tar
+          ls -lah /tmp/release-artifacts/