ci: publish packages to download directory

.gitea/workflows/package.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 jobs:
   package:
@@ -11,22 +12,66 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        shell: bash
+        run: |
+          set -euo pipefail
+          server_url="${{ gitea.server_url }}"
+          repository_url="${server_url%/}/${{ gitea.repository }}.git"
+          git init .
+          git remote add origin "$repository_url"
+          git fetch --depth 1 origin "${{ gitea.sha }}"
+          git checkout --detach FETCH_HEAD
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10.32.1
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@10.32.1 --activate
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Set package version
+        shell: bash
+        run: |
+          set -euo pipefail
+          source_version="$(node -p "require('./package.json').version")"
+          latest_version="$(
+            find /downloads -maxdepth 1 -type f -name 'waveform-analysis-*-*.tgz' -printf '%f\n' \
+              | sed -nE 's/^waveform-analysis-([0-9]+\.[0-9]+\.[0-9]+)-[0-9a-f]+\.tgz$/\1/p' \
+              | sort -V \
+              | tail -n 1
+          )"
+          next_version="$(node - "$source_version" "$latest_version" <<'NODE'
+          const source = process.argv[2]
+          const latest = process.argv[3]
+          const parse = (version) => {
+            const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version)
+            if (!match) throw new Error(`Unsupported package version: ${version}`)
+            return match.slice(1).map(Number)
+          }
+          const compare = (left, right) => {
+            for (let index = 0; index < 3; index += 1) {
+              if (left[index] !== right[index]) return left[index] - right[index]
+            }
+            return 0
+          }
+          const sourceParts = parse(source)
+          if (!latest) {
+            process.stdout.write(source)
+          } else {
+            const latestParts = parse(latest)
+            if (compare(sourceParts, latestParts) > 0) {
+              process.stdout.write(source)
+            } else {
+              latestParts[2] += 1
+              process.stdout.write(latestParts.join('.'))
+            }
+          }
+          NODE
+          )"
+          pnpm pkg set version="$next_version"
+          printf 'Packaging waveform-analysis@%s\n' "$next_version"
+
       - name: Type check
         run: pnpm typecheck
 
@@ -59,10 +104,16 @@ jobs:
             grep -Fxq "$required_file" <<< "$package_contents"
           done
 
-      - name: Upload component package
-        uses: actions/upload-artifact@v3
-        with:
-          name: waveform-analysis-${{ gitea.sha }}
-          path: artifacts/*.tgz
-          if-no-files-found: error
-          retention-days: 7
+      - name: Publish component package
+        shell: bash
+        run: |
+          set -euo pipefail
+          package_file="$(find artifacts -maxdepth 1 -type f -name '*.tgz' -print -quit)"
+          package_version="$(node -p "require('./package.json').version")"
+          short_sha="$(printf '%.12s' '${{ gitea.sha }}')"
+          published_name="waveform-analysis-${package_version}-${short_sha}.tgz"
+          install -m 644 "$package_file" "/downloads/$published_name"
+          cd /downloads
+          sha256sum "$published_name" > "$published_name.sha256"
+          ln -sfn "$published_name" waveform-analysis-latest.tgz
+          ln -sfn "$published_name.sha256" waveform-analysis-latest.tgz.sha256