Merge build and publish into one job, eliminating redundant CI builds

The separate "publish" job had needs: build but never reused any of
build's output - it re-ran the entire checkout/cache/setup/build-deps/
build/wrapper pipeline from scratch, so every tagged release did two
full independent builds for no benefit. Gitea Actions doesn't support
upload-artifact@v4+/download-artifact@v4+ (GHESNotSupportedError),
which rules out the usual "build uploads, publish downloads" pattern
anyway, so the simplest fix is to run the build pipeline exactly once
and gate the three publish-only steps (version bump from tag, registry
auth, npm publish) behind `if: startsWith(github.ref, 'refs/tags/')`
at the step level instead of duplicating everything in a second job.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -72,78 +72,27 @@ jobs:
           npm install --no-save typescript
           npx tsc -p package/tsconfig.json
 
-  publish:
+      # Everything below only runs on a tag push (a release) - reuses the
-    name: Publish to npm registry
+      # exact build just done above instead of the previous separate
-    if: startsWith(github.ref, 'refs/tags/')
+      # "publish" job, which had `needs: build` but still redundantly
-    needs: build
+      # re-ran the *entire* checkout/cache/setup/build-deps/build/wrapper
-    runs-on: ubuntu-latest
+      # pipeline from scratch, doubling CI time on every release for no
-    steps:
+      # benefit (Gitea Actions' artifact-passing story is also awkward
-      - uses: https://github.com/actions/checkout@v4
+      # here - upload-artifact@v4+/download-artifact@v4+ aren't supported
-
+      # on Gitea at all, see the upload-artifact removal above).
-      - name: Install build dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y bison cmake curl python3
-
-      # Gitea Actions doesn't support the built-in hashFiles() expression
-      # function (unlike GitHub Actions) - it silently evaluates to an empty
-      # string, which turned every cache key below into the same constant
-      # string regardless of what actually changed, so a cache entry from
-      # before a dependency-version or patch change would still be reused
-      # forever. Hash the same inputs by hand instead.
-      - name: Compute cache keys
-        id: cache-keys
-        run: |
-          echo "emsdk=$(sha256sum scripts/versions.sh | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
-          echo "deps-wasm32=$(cat scripts/versions.sh $(find patches -type f | sort) | sha256sum | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
-          echo "libwinevbs=$(cat scripts/versions.sh $(find patches/libwinevbs -type f | sort) | sha256sum | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
-
-      - name: Cache emsdk
-        uses: https://github.com/actions/cache@v4
-        with:
-          path: emsdk
-          key: emsdk-${{ steps.cache-keys.outputs.emsdk }}
-
-      - name: Cache wasm32 dependency builds
-        uses: https://github.com/actions/cache@v4
-        with:
-          path: build/deps-wasm32
-          key: deps-wasm32-${{ steps.cache-keys.outputs.deps-wasm32 }}
-
-      - name: Cache libwinevbs build
-        uses: https://github.com/actions/cache@v4
-        with:
-          path: vendor/libwinevbs/build
-          key: libwinevbs-wasm32-${{ steps.cache-keys.outputs.libwinevbs }}
-
-      - name: Setup (fetch + patch vendor sources)
-        run: ./scripts/setup.sh
-
-      - name: Build wasm32 dependencies
-        run: |
-          source emsdk/emsdk_env.sh
-          ./scripts/build-deps.sh
-
-      - name: Build vpinball
-        run: |
-          source emsdk/emsdk_env.sh
-          ./scripts/build.sh
-
-      - name: Build npm wrapper
-        run: |
-          npm install --no-save typescript
-          npx tsc -p package/tsconfig.json
-
       - name: Set package version from the tag
+        if: startsWith(github.ref, 'refs/tags/')
         run: npm pkg set version="${GITHUB_REF_NAME#v}"
 
       # Scoped to this one registry host+path (via publishConfig.registry in
       # package.json) rather than actions/setup-node's registry-url, which
       # would set it as the *default* registry for every install.
       - name: Configure registry auth for publish
+        if: startsWith(github.ref, 'refs/tags/')
         run: npm config set "//dev.pivoine.art/api/packages/valknar/npm/:_authToken" "$PACKAGE_TOKEN"
         env:
           PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
 
       - name: Publish to Gitea npm registry
+        if: startsWith(github.ref, 'refs/tags/')
         run: npm publish