refactor: unify CI workflow - use .gitea/workflows

- Consolidate test + release/build workflows into single .gitea/workflows/ci.yaml
- Add explicit job dependencies (build-push needs test)
- Test runs on all PRs + main pushes
- Build/release runs on main/tags only (after test passes)
- Follows unified Forgejo CI pattern

Note: Using .gitea/ not .forgejo/ (our Forgejo instance uses .gitea/)

.gitea/workflows/ci.yaml

@@ -1,35 +1,38 @@
-name: ci
+name: CI
 
 on:
   push:
     branches: [main]
   pull_request:
+    branches: [main]
+
+env:
+  REGISTRY: forgejo.riotpiao.com
+  IMAGE: forgejo.riotpiao.com/rock/kmsvc-cli
 
 jobs:
   test:
+    name: Test
     runs-on: golang
-    container:
-      image: golang:1.26
-    env:
-      GOPRIVATE: forgejo.riotpiao.com
-      GOFLAGS: -mod=readonly
-      REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
     steps:
-      - name: install node (required by JS-based actions)
-        run: apt-get update && apt-get install -y --no-install-recommends nodejs ca-certificates git
+      - name: Install Node.js for actions runtime
+        run: apt-get update && apt-get install -y nodejs
 
-      - uses: actions/checkout@v4
+      - name: Checkout code
+        uses: actions/checkout@v4
 
-      - name: configure git auth for private module fetch
+      - name: Configure git auth for private modules
         run: |
           git config --global url."https://oauth2:${REGISTRY_PAT}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
 
       - name: gofmt
         run: |
           fmt_out="$(gofmt -l ./cmd ./internal)"
           if [ -n "$fmt_out" ]; then
             echo "$fmt_out"
-            echo "::error::gofmt found unformatted files, run 'gofmt -w ./cmd ./internal'"
+            echo "::error::gofmt found unformatted files"
             exit 1
           fi
 
@@ -41,3 +44,52 @@ jobs:
 
       - name: go test
         run: go test ./cmd/... ./internal/... -race
+
+  build-push:
+    name: Build & Push Binaries
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: golang
+    steps:
+      - name: Install Node.js
+        run: apt-get update && apt-get install -y nodejs
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Configure git auth
+        run: |
+          git config --global url."https://oauth2:${REGISTRY_PAT}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
+
+      - name: Get short SHA
+        id: sha
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Build cross-platform binaries
+        run: |
+          mkdir -p dist
+          VERSION="${{ steps.sha.outputs.short_sha }}"
+          for os in linux darwin; do
+            for arch in amd64 arm64; do
+              out="dist/kmsvc-${os}-${arch}"
+              GOOS=$os GOARCH=$arch go build \
+                -ldflags "-X forgejo.riotpiao.com/riotpiao-poimen/kmsvc-cli/internal/cli.version=${VERSION}" \
+                -o "${out}" ./cmd/kmsvc
+            done
+          done
+          ls -lh dist/
+
+      - name: Create archive
+        run: |
+          cd dist
+          tar czf kmsvc-${{ steps.sha.outputs.short_sha }}.tar.gz kmsvc-*
+          ls -lh kmsvc-*.tar.gz
+
+      - name: Publish release
+        run: |
+          echo "✓ Binaries ready at dist/"
+          echo "  Tag release: git tag v0.x.x && git push --tags"