ci(release): isolate GitCode mirroring workflow

.github/workflows/gitcode-mirror.yml

@@ -0,0 +1,84 @@
+name: Mirror GitHub release to GitCode
+
+run-name: >-
+  GitCode mirror ${{ inputs.release_tag || github.event.workflow_run.display_title }}
+
+on:
+  workflow_run:
+    workflows:
+      - Build portable releases
+    types:
+      - completed
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Existing GitHub release tag to mirror
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: gitcode-mirror-${{ inputs.release_tag || github.event.workflow_run.id }}
+  cancel-in-progress: false
+
+jobs:
+  mirror:
+    name: Mirror release assets
+    if: >-
+      vars.GITCODE_REPOSITORY != ''
+      && (
+        github.event_name == 'workflow_dispatch'
+        || github.event.workflow_run.conclusion == 'success'
+      )
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v7
+      - name: Resolve release tag
+        id: release
+        shell: bash
+        env:
+          INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
+          RUN_TITLE: ${{ github.event.workflow_run.display_title }}
+        run: |
+          set -euo pipefail
+
+          release_tag="$INPUT_RELEASE_TAG"
+          if [ -z "$release_tag" ]; then
+            case "$RUN_TITLE" in
+              "Portable release "*) release_tag="${RUN_TITLE#Portable release }" ;;
+              *) echo "Cannot resolve a release tag from workflow title: $RUN_TITLE" >&2; exit 1 ;;
+            esac
+          fi
+          case "$release_tag" in
+            v*) ;;
+            *) release_tag="v$release_tag" ;;
+          esac
+          if ! node scripts/app-version.mjs "${release_tag#v}" >/dev/null 2>&1; then
+            if [ -n "$INPUT_RELEASE_TAG" ]; then
+              echo "Invalid release tag: $release_tag" >&2
+              exit 1
+            fi
+            echo "Skipping GitCode mirror because the completed run did not publish a release"
+            echo "should_mirror=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "tag=$release_tag" >> "$GITHUB_OUTPUT"
+          echo "should_mirror=true" >> "$GITHUB_OUTPUT"
+      - name: Download GitHub release assets
+        if: steps.release.outputs.should_mirror == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: gh release download "${{ steps.release.outputs.tag }}" --dir artifacts
+      - name: Publish GitCode mirror
+        if: steps.release.outputs.should_mirror == 'true'
+        env:
+          ARTIFACT_DIRECTORY: artifacts
+          GITCODE_ACCESS_TOKEN: ${{ secrets.GITCODE_ACCESS_TOKEN }}
+          GITCODE_REPOSITORY: ${{ vars.GITCODE_REPOSITORY }}
+          GITCODE_TARGET_COMMITISH: ${{ vars.GITCODE_TARGET_COMMITISH || 'main' }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+        run: node scripts/publish-gitcode-release.mjs