CI: build and publish every package from Woodpecker

Pushes to main run the tests. The Deploy button publishes the Windows, RPM,
deb and F-Droid packages to the same NAS directories a dev machine uses, with
the same keys, then runs update-repo.sh, so public URLs don't change.

Builds run on Debian 12, in an image defined in ci/builder, so the Linux
packages now need glibc 2.36 instead of Fedora 44's 2.43.

.woodpecker/release.yaml

@@ -0,0 +1,103 @@
+# Build the release packages and publish them.
+#
+# Trigger: open a pipeline for this repo in Woodpecker, click "Deploy", and set
+# the deploy target to `all`, `windows`, `rpm`, `deb` or `fdroid`.
+#
+# These are steps in one workflow, not a workflow per target: Woodpecker drops a
+# workflow whose dependency was filtered out, and the cache volume is
+# ReadWriteOnce. Each target also runs after a failure, so one bad target doesn't
+# hold back the rest, and the pipeline still ends up red.
+#
+# The volumes are defined in the platform repo (src/apps/woodpecker), and this
+# repo must be marked Trusted → Volumes in Woodpecker to mount them.
+
+when:
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET != "builder"'
+
+# The version is the commit count, and the default clone fetches a single commit.
+clone:
+  git:
+    image: woodpeckerci/plugin-git
+    settings:
+      partial: false
+      depth: 0
+
+variables:
+  - &builder
+    image: registry.apps.millslan.net/garrettmills/mtgc-builder:latest
+    pull: true
+    backend_options:
+      kubernetes:
+        # The owner of the release directories on the NAS.
+        securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
+        resources:
+          requests:
+            cpu: "4"
+            memory: 6Gi
+          limits:
+            memory: 12Gi
+  - &publish
+    volumes:
+      - mtgc-release:/nfs/hal9000/mtgc
+      - mtgc-ci-cache:/cache
+    environment:
+      HOME: /cache/home
+      CARGO_HOME: /cache/cargo
+      CARGO_BUILD_JOBS: "4"
+      GRADLE_OPTS: -Dorg.gradle.daemon=false
+
+steps:
+  - name: prepare
+    image: alpine:3.22
+    volumes:
+      - mtgc-ci-cache:/cache
+    commands:
+      - chown -R 1000:1000 /woodpecker
+      - chown 1000:1000 /cache
+
+  - name: windows
+    <<: [*builder, *publish]
+    commands:
+      - scripts/ci-publish.sh windows
+    when:
+      - status: [success, failure]
+        evaluate: 'CI_PIPELINE_DEPLOY_TARGET in ["all", "windows"]'
+
+  - name: rpm
+    <<: [*builder, *publish]
+    commands:
+      - scripts/ci-publish.sh rpm
+    when:
+      - status: [success, failure]
+        evaluate: 'CI_PIPELINE_DEPLOY_TARGET in ["all", "rpm"]'
+
+  - name: deb
+    <<: [*builder, *publish]
+    commands:
+      - scripts/ci-publish.sh deb
+    when:
+      - status: [success, failure]
+        evaluate: 'CI_PIPELINE_DEPLOY_TARGET in ["all", "deb"]'
+
+  - name: fdroid
+    <<: [*builder, *publish]
+    commands:
+      - scripts/ci-publish.sh fdroid
+    when:
+      - status: [success, failure]
+        evaluate: 'CI_PIPELINE_DEPLOY_TARGET in ["all", "fdroid"]'
+
+  # update-repo.sh finds ../static/mtgc, so this mounts it there.
+  - name: update-repo
+    <<: *builder
+    volumes:
+      - mtgc-release:/nfs/hal9000/mtgc
+      - mtgc-public:/nfs/hal9000/static/mtgc
+    commands:
+      - cd /nfs/hal9000/mtgc
+      - ./update-repo.sh
+    when:
+      - status: [success, failure]