Surface API errors in the publish step

The publish job has never run successfully. When it failed on the v1.0.0
tag it reported "SyntaxError: Unexpected end of JSON input" from piping an
empty curl body into JSON.parse, which said nothing about the actual cause
(an unset token). An opaque failure there costs a full three-platform build.

Routes every call through a helper that captures the HTTP status and prints
the response body on 4xx/5xx. Also switches artifact iteration to while-read
so filenames with spaces cannot split, and dumps the artifact tree when
nothing matches.

Helper verified against the live API: existing tag resolves to its release
id, a missing tag reports HTTP 404 with the body and yields an empty id so
the create path runs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -6,11 +6,13 @@ name: Build release artifacts
 # queues silently rather than failing, so register all three before tagging:
 #   ubuntu-latest   Linux AppImage
 #   windows-latest  Windows NSIS installer + portable zip
-#   macos-arm64     macOS dmg + zip, both architectures (M-series builds both)
+#   macos-latest    macOS dmg + zip, both architectures (M-series builds both)
 #
 # Nothing cross-builds any more: dmg requires macOS, and the Windows exe needs
 # rcedit on Windows to get its icon and version resources.
 #
+# A RELEASE_TOKEN secret is optional; GITEA_TOKEN is used by default.
+#
 # All output is unsigned. Once certificates exist: for macOS drop mac.identity
 # from package.json and remove CSC_IDENTITY_AUTO_DISCOVERY; for Windows add the
 # cert secrets. Until then users hit Gatekeeper and SmartScreen warnings.
@@ -89,7 +91,7 @@ jobs:
           if-no-files-found: error
 
   macos:
-    runs-on: macos-arm64
+    runs-on: macos-latest
     defaults:
       run:
         working-directory: desktop-client
@@ -133,39 +135,66 @@ jobs:
 
       - name: Create release and attach artifacts
         env:
-          TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          # Gitea injects GITEA_TOKEN automatically, repo-scoped and short-lived.
+          # RELEASE_TOKEN is an optional override if wider rights are ever needed.
+          TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITEA_TOKEN }}
           API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
         run: |
           set -euo pipefail
           if [ -z "${TOKEN:-}" ]; then
-            echo "RELEASE_TOKEN secret is not set." >&2
+            echo "No token available (GITEA_TOKEN missing and RELEASE_TOKEN unset)." >&2
             exit 1
           fi
 
-          release_id=$(curl -sf -H "Authorization: token $TOKEN" \
+          # Report the HTTP status and body on failure. A bare `curl -sf | JSON.parse`
-            "$API/releases/tags/$GITHUB_REF_NAME" \
+          # dies with "Unexpected end of JSON input" and hides the real cause, which is
-            | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).id" 2>/dev/null || true)
+          # how the v1.0.0 run failed on a missing token.
+          api() {
+            local method="$1" path="$2"; shift 2
+            local out code
+            out=$(curl -s -w '\n%{http_code}' -X "$method" \
+              -H "Authorization: token $TOKEN" "$API$path" "$@")
+            code=$(printf '%s' "$out" | tail -n1)
+            body=$(printf '%s' "$out" | sed '$d')
+            if [ "$code" -ge 400 ]; then
+              echo "$method $path -> HTTP $code" >&2
+              echo "$body" >&2
+              return 1
+            fi
+            printf '%s' "$body"
+          }
+
+          # Reuse the release if the tag already has one, otherwise create it.
+          release_id=$(api GET "/releases/tags/$GITHUB_REF_NAME" 2>/dev/null \
+            | node -pe "JSON.parse(require('fs').readFileSync(0,'utf8')).id" 2>/dev/null || true)
 
           if [ -z "${release_id:-}" ]; then
-            release_id=$(curl -sf -X POST -H "Authorization: token $TOKEN" \
+            echo "No release for $GITHUB_REF_NAME yet; creating it."
+            release_id=$(api POST "/releases" \
               -H "Content-Type: application/json" \
               -d "{\"tag_name\":\"$GITHUB_REF_NAME\",\"name\":\"$GITHUB_REF_NAME\"}" \
-              "$API/releases" \
+              | node -pe "JSON.parse(require('fs').readFileSync(0,'utf8')).id")
-              | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).id")
           fi
 
+          if [ -z "${release_id:-}" ]; then
+            echo "Could not determine a release id." >&2
+            exit 1
+          fi
+          echo "Publishing to release $release_id"
+
+          # while-read rather than word-splitting a find, so spaces in names are safe.
           found=0
-          for f in $(find artifacts -type f \( -name '*.AppImage' -o -name '*.zip' -o -name '*.dmg' -o -name '*.exe' \)); do
+          while IFS= read -r f; do
             name=$(basename "$f")
-            echo "Attaching $name"
+            echo "Attaching $name ($(du -h "$f" | cut -f1))"
-            curl -sf -X POST -H "Authorization: token $TOKEN" \
+            api POST "/releases/$release_id/assets?name=$name" -F "attachment=@$f" >/dev/null
-              -F "attachment=@$f" \
-              "$API/releases/$release_id/assets?name=$name" -o /dev/null
             found=$((found + 1))
-          done
+          done < <(find artifacts -type f \( -name '*.AppImage' -o -name '*.zip' \
+                     -o -name '*.dmg' -o -name '*.exe' \) | sort)
 
           if [ "$found" -eq 0 ]; then
-            echo "No artifacts found to attach." >&2
+            echo "No artifacts found to attach; build jobs produced nothing." >&2
+            find artifacts -type f | head -20 >&2
             exit 1
           fi
           echo "Attached $found artifacts to release $release_id"