From c34522a63c050729a771a126852ce513d517bf75 Mon Sep 17 00:00:00 2001
From: digiflo <office@digiflo.at>
Date: Sun, 21 Jun 2026 15:43:18 +0200
Subject: [PATCH] CI: NetBird-Release-Mirror Workflow

---
 .gitea/workflows/release.yml | 99 ++++++++++++++++++++++++++++++++++++
 1 file changed, 99 insertions(+)
 create mode 100644 .gitea/workflows/release.yml

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..4f1abe5
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,99 @@
+name: netbird-slate7-release
+
+# Prüft auf neue NetBird-Versionen und spiegelt das arm64-Binary als Gitea-Release,
+# von dem der GL.iNet Slate 7 per Ein-Zeiler installiert/upgradet.
+on:
+  schedule:
+    - cron: '17 4 * * *'        # täglich 04:17 UTC: auf neue NetBird-Version prüfen
+  workflow_dispatch:
+    inputs:
+      force:
+        description: 'Release neu bauen, auch wenn die Version schon existiert'
+        required: false
+        default: 'false'
+  push:
+    branches: [main]
+    paths:
+      - '.gitea/workflows/release.yml'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: NetBird-Version ermitteln
+        id: ver
+        run: |
+          set -eu
+          VER=$(curl -fsSL https://api.github.com/repos/netbirdio/netbird/releases/latest \
+                | grep -o '"tag_name":[^,]*' | head -1 | grep -o '[0-9][0-9.]*' | head -1)
+          test -n "$VER"
+          echo "ver=$VER" >> "$GITHUB_OUTPUT"
+          echo "tag=v$VER" >> "$GITHUB_OUTPUT"
+          echo "NetBird latest: $VER"
+
+      - name: Vorhandenes Release prüfen
+        id: check
+        run: |
+          set -eu
+          API="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' \
+                 -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+                 "$API/releases/tags/${{ steps.ver.outputs.tag }}")
+          echo "Tag ${{ steps.ver.outputs.tag }} -> HTTP $CODE"
+          if [ "$CODE" = "200" ] && [ "${{ github.event.inputs.force }}" != "true" ]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Release existiert bereits -> nichts zu tun."
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: NetBird arm64 holen + Checksumme
+        if: steps.check.outputs.skip != 'true'
+        run: |
+          set -eu
+          V="${{ steps.ver.outputs.ver }}"
+          F="netbird_${V}_linux_arm64.tar.gz"
+          curl -fsSL -o "$F" "https://github.com/netbirdio/netbird/releases/download/v${V}/${F}"
+          # Plausibilität: enthält das Tarball das netbird-Binary?
+          tar -tzf "$F" | grep -qx netbird
+          sha256sum "$F" | tee "${F}.sha256"
+          ls -l "$F"
+
+      - name: Gitea-Release anlegen + Assets hochladen
+        if: steps.check.outputs.skip != 'true'
+        env:
+          GT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API_BASE: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+          REPO: ${{ github.repository }}
+          SERVER: ${{ github.server_url }}
+          VER: ${{ steps.ver.outputs.ver }}
+          TAG: ${{ steps.ver.outputs.tag }}
+          FORCE: ${{ github.event.inputs.force }}
+        run: |
+          set -eu
+          F="netbird_${VER}_linux_arm64.tar.gz"
+          # bei force: altes Release + Tag entfernen, damit Assets nicht kollidieren
+          if [ "${FORCE:-false}" = "true" ]; then
+            RID=$(curl -s -H "Authorization: token $GT_TOKEN" "$API_BASE/releases/tags/$TAG" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*' || true)
+            if [ -n "${RID:-}" ]; then
+              curl -s -X DELETE -H "Authorization: token $GT_TOKEN" "$API_BASE/releases/$RID" >/dev/null || true
+              curl -s -X DELETE -H "Authorization: token $GT_TOKEN" "$API_BASE/tags/$TAG"     >/dev/null || true
+            fi
+          fi
+          # Release-Body als JSON via printf (NOTES: nur ASCII, keine " und kein % -> kein Escaping-Problem)
+          NOTES="Automatischer NetBird-Deploy fuer GL.iNet Slate 7 (aarch64).\n\n- NetBird-Version: ${VER}\n- Server: https://nb.digiflo.at:443\n\nInstallieren / Upgraden auf dem Router (als root):\n\n    wget -qO- ${SERVER}/${REPO}/raw/branch/main/install-netbird-slate7.sh | sh\n\nErstinstallation inkl. Enrollment:\n\n    wget -qO /tmp/nb.sh ${SERVER}/${REPO}/raw/branch/main/install-netbird-slate7.sh \&\& sh /tmp/nb.sh DEIN-SETUP-KEY\n"
+          printf '{"tag_name":"%s","target_commitish":"main","name":"NetBird %s (Slate 7)","body":"%s","draft":false,"prerelease":false}' "$TAG" "$VER" "$NOTES" > /tmp/body.json
+          RID=$(curl -fsSL -X POST -H "Authorization: token $GT_TOKEN" -H "Content-Type: application/json" \
+                -d @/tmp/body.json "$API_BASE/releases" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
+          test -n "$RID"
+          echo "Release-ID: $RID"
+          for A in "$F" "${F}.sha256"; do
+            curl -fsSL -X POST -H "Authorization: token $GT_TOKEN" \
+                 -F "attachment=@${A};type=application/octet-stream" \
+                 "$API_BASE/releases/$RID/assets?name=${A}" >/dev/null
+            echo "Asset hochgeladen: $A"
+          done
+          echo "FERTIG: $TAG veroeffentlicht."