fix: CI 改用 Forgejo API 上传 release（不依赖 upload-artifact）

Forgejo 不支持 actions/upload-artifact@v4，改为单 job 交叉编译
+ curl 调用 Forgejo release API 上传二进制。
同时维护 latest release 供 install.sh --download 使用。

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/workflows/release.yml

@@ -6,57 +6,82 @@ on:
       - 'v*'
 
 jobs:
-  build:
+  release:
     runs-on: docker
-    strategy:
-      matrix:
-        include:
-          - goos: darwin
-            goarch: arm64
-          - goos: darwin
-            goarch: amd64
-          - goos: linux
-            goarch: amd64
-          - goos: linux
-            goarch: arm64
+    container:
+      image: golang:1.22-bookworm
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.22'
-
-      - name: Build
-        env:
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goarch }}
+      - name: Build all platforms
         run: |
           cd cli
-          go build -ldflags="-s -w" -o ../auth-rt-${{ matrix.goos }}-${{ matrix.goarch }} .
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: auth-rt-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: auth-rt-${{ matrix.goos }}-${{ matrix.goarch }}
-
-  release:
-    needs: build
-    runs-on: docker
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          merge-multiple: true
-
-      - name: Create release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: auth-rt-*
-          generate_release_notes: true
-
-      - name: Update latest tag
-        run: |
-          # Also upload to "latest" release for install.sh --download
-          for f in auth-rt-*; do
-            echo "Uploading $f to latest release..."
+          for pair in darwin/arm64 darwin/amd64 linux/amd64 linux/arm64; do
+            os="${pair%/*}"
+            arch="${pair#*/}"
+            echo "Building auth-rt-${os}-${arch}..."
+            GOOS="$os" GOARCH="$arch" go build -ldflags="-s -w" -o "../auth-rt-${os}-${arch}" .
           done
+          ls -lh ../auth-rt-*
+
+      - name: Create release and upload binaries
+        env:
+          TAG: ${{ github.ref_name }}
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          API_URL: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+        run: |
+          apt-get update -qq && apt-get install -y -qq curl jq > /dev/null 2>&1
+
+          # Create release
+          RELEASE_ID=$(curl -s -X POST "$API_URL/releases" \
+            -H "Authorization: token $FORGEJO_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"body\":\"auth-rt $TAG\"}" \
+            | jq -r '.id')
+
+          echo "Created release ID: $RELEASE_ID"
+
+          # Upload each binary
+          for f in auth-rt-*; do
+            echo "Uploading $f..."
+            curl -s -X POST "$API_URL/releases/$RELEASE_ID/assets?name=$f" \
+              -H "Authorization: token $FORGEJO_TOKEN" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@$f"
+            echo ""
+          done
+
+          # Also maintain a "latest" release
+          LATEST_ID=$(curl -s "$API_URL/releases/tags/latest" \
+            -H "Authorization: token $FORGEJO_TOKEN" | jq -r '.id // empty')
+
+          if [ -n "$LATEST_ID" ]; then
+            # Delete old assets
+            curl -s "$API_URL/releases/$LATEST_ID/assets" \
+              -H "Authorization: token $FORGEJO_TOKEN" | jq -r '.[].id' | while read aid; do
+              curl -s -X DELETE "$API_URL/releases/$LATEST_ID/assets/$aid" \
+                -H "Authorization: token $FORGEJO_TOKEN"
+            done
+            # Update release body
+            curl -s -X PATCH "$API_URL/releases/$LATEST_ID" \
+              -H "Authorization: token $FORGEJO_TOKEN" \
+              -H "Content-Type: application/json" \
+              -d "{\"body\":\"auth-rt latest (from $TAG)\"}"
+          else
+            # Create latest release
+            LATEST_ID=$(curl -s -X POST "$API_URL/releases" \
+              -H "Authorization: token $FORGEJO_TOKEN" \
+              -H "Content-Type: application/json" \
+              -d '{"tag_name":"latest","name":"latest","body":"auth-rt latest","prerelease":true}' \
+              | jq -r '.id')
+          fi
+
+          # Upload to latest
+          for f in auth-rt-*; do
+            curl -s -X POST "$API_URL/releases/$LATEST_ID/assets?name=$f" \
+              -H "Authorization: token $FORGEJO_TOKEN" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@$f"
+          done
+
+          echo "Done. Release $TAG + latest updated."