fix: make the release workflow build and package a real Jellyfin plugin

The release workflow was copied from another project and could not succeed on
any tag: it installed the .NET 8 SDK for a net9.0 project, published a
JellyfinSso.csproj that does not exist, called a missing update_manifest.py,
and zipped the entire publish tree instead of the three DLLs declared in
build.yaml.

Replace it with a tag-driven release:

- Build with the .NET 9 SDK, injecting the tag version via -p:Version,
  -p:AssemblyVersion and -p:FileVersion so the assembly no longer carries a
  hardcoded 1.0.3.0.
- Package via scripts/build_plugin.py, which emits the JPRM layout Jellyfin
  expects: the build.yaml artifacts plus a generated meta.json. The previous
  zips shipped without meta.json, which only worked for repository installs
  because Jellyfin synthesises one from the folder name.
- Update manifest.json via scripts/update_manifest.py, keeping build.yaml as
  the single source of truth for plugin metadata.
- Commit the zip and manifest to main and attach the zip to the Gitea release.
  Pushing uses the injected token, falling back to a RELEASE_TOKEN secret when
  the built-in one lacks write access.

Also fix the published download URLs. manifest.json and the README pointed at
pascallinxweiler/jellyfinplugin, which 404s; the repository is jellyfinsso, so
the plugin repository could not be added to Jellyfin and no version could be
downloaded. The workflow now derives the URL from GITHUB_REPOSITORY.

Add a build workflow so main and pull requests are compiled and packaged.

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -0,0 +1,42 @@
+name: Build Plugin
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '**/*.md'
+  pull_request:
+    paths-ignore:
+      - '**/*.md'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '9.0.x'
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+
+      - name: Install packaging dependencies
+        run: python -m pip install --quiet --upgrade pyyaml
+
+      - name: Build and package plugin
+        id: package
+        run: python scripts/build_plugin.py --output "$RUNNER_TEMP/dist"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: ${{ steps.package.outputs.zip_name }}
+          path: ${{ runner.temp }}/dist/${{ steps.package.outputs.zip_name }}

.gitea/workflows/release.yml

@@ -6,10 +6,10 @@ on:
       - 'v*'
 
 jobs:
-  build-and-release:
+  release:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - name: Checkout tag
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
@@ -17,44 +17,99 @@ jobs:
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: '8.0.x'
+          dotnet-version: '9.0.x'
 
-      - name: Extract version from tag
-        id: version
-        run: |
-          VERSION="${GITHUB_REF_NAME#v}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Publish
-        run: dotnet publish JellyfinSso.csproj --configuration Release --output publish
-
-      - name: Zip build output
-        run: |
-          cd publish
-          zip -r "../jellyfinsso-${{ steps.version.outputs.version }}.zip" .
-
-      - name: Compute checksum
-        id: checksum
-        run: |
-          CHECKSUM=$(md5sum "jellyfinsso-${{ steps.version.outputs.version }}.zip" | cut -d' ' -f1)
-          echo "md5=$CHECKSUM" >> "$GITHUB_OUTPUT"
-
-      - name: Upload zip to Gitea Release
-        uses: akkuman/gitea-release-action@v1
+      - name: Setup Python
+        uses: actions/setup-python@v5
         with:
-          files: "jellyfinsso-${{ steps.version.outputs.version }}.zip"
+          python-version: '3.x'
 
-      - name: Update manifest.json
-        run: |
-          python3 update_manifest.py \
-            "${{ steps.version.outputs.version }}" \
-            "${{ steps.checksum.outputs.md5 }}" \
-            "https://git.linxweiler.xyz/pascallinxweiler/jellyfinsso/releases/download/${GITHUB_REF_NAME}/jellyfinsso-${{ steps.version.outputs.version }}.zip"
+      - name: Install packaging dependencies
+        run: python -m pip install --quiet --upgrade pyyaml
 
-      - name: Commit manifest.json
+      - name: Read version and changelog from tag
+        id: meta
         run: |
+          set -euo pipefail
+          echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+          # Annotated tag message becomes the changelog; build.yaml is the fallback.
+          {
+            echo "changelog<<CHANGELOG_EOF"
+            git tag -l --format='%(contents)' "$GITHUB_REF_NAME"
+            echo "CHANGELOG_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Build and package plugin
+        id: package
+        env:
+          VERSION: ${{ steps.meta.outputs.version }}
+          CHANGELOG: ${{ steps.meta.outputs.changelog }}
+        run: |
+          set -euo pipefail
+          python scripts/build_plugin.py \
+            --version "$VERSION" \
+            --changelog "$CHANGELOG" \
+            --output "$RUNNER_TEMP/dist"
+
+      - name: Switch to main
+        run: |
+          set -euo pipefail
+          git checkout -- .
+          git fetch origin main
+          git checkout -B main origin/main
+
+      - name: Update dist, build.yaml and manifest.json
+        env:
+          VERSION: ${{ steps.package.outputs.version }}
+          ZIP_NAME: ${{ steps.package.outputs.zip_name }}
+          CHECKSUM: ${{ steps.package.outputs.checksum }}
+          CHANGELOG: ${{ steps.meta.outputs.changelog }}
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          cp "$RUNNER_TEMP/dist/$ZIP_NAME" "dist/$ZIP_NAME"
+
+          python scripts/build_plugin.py --version "$VERSION" --sync-only
+
+          python scripts/update_manifest.py \
+            --version "$VERSION" \
+            --checksum "$CHECKSUM" \
+            --changelog "$CHANGELOG" \
+            --source-url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/raw/branch/main/dist/${ZIP_NAME}"
+
+      - name: Commit and push to main
+        env:
+          # Gitea injects GITHUB_TOKEN; set RELEASE_TOKEN if that token does not
+          # have write access to the repository.
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          DEFAULT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          TOKEN="${RELEASE_TOKEN:-$DEFAULT_TOKEN}"
+          if [ -z "$TOKEN" ]; then
+            echo "no token available to push manifest.json" >&2
+            exit 1
+          fi
+
           git config user.name "gitea-actions"
           git config user.email "actions@git.linxweiler.xyz"
-          git add manifest.json
-          git commit -m "Update manifest.json for ${GITHUB_REF_NAME}" || echo "No changes"
-          git push origin HEAD:main
+          git add dist manifest.json build.yaml Jellyfin.Plugin.OidcAuth/Jellyfin.Plugin.OidcAuth.csproj
+
+          if git diff --cached --quiet; then
+            echo "nothing to commit"
+            exit 0
+          fi
+
+          git commit -m "release: ${GITHUB_REF_NAME}"
+
+          git remote set-url origin \
+            "https://x-access-token:${TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git"
+          git push origin main
+
+      - name: Attach zip to Gitea release
+        uses: akkuman/gitea-release-action@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          files: dist/${{ steps.package.outputs.zip_name }}
+          body: ${{ steps.meta.outputs.changelog }}