fix: publish raw OTA files to rolling release with backup artifacts

.gitea/workflows/ota-build.yml

@@ -1,9 +1,5 @@
 name: OTA build
 
-permissions:
-  contents: read
-  packages: write
-
 on:
   push:
     branches:
@@ -21,7 +17,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: "3.11"
 
       - name: Install PlatformIO
         run: |
@@ -34,50 +30,111 @@ jobs:
       - name: Prepare direct OTA files
         run: |
           set -eu
+          rm -rf dist/ota
           project_name="${GITHUB_REPOSITORY#*/}"
           project_name="${project_name#PlatformIO_}"
           timestamp="$(date -u +%Y-%m-%dT%H-%M-%SZ)"
           mkdir -p dist/ota
           found=0
-          for fw in .pio/build/*/firmware.bin; do
+          for fw in .pio/build/*/firmware.bin .pio/build/*/firmware.hex; do
             [ -f "$fw" ] || continue
             env_name="$(basename "$(dirname "$fw")")"
-            cp "$fw" "dist/ota/${project_name}_${env_name}_${timestamp}.bin"
+            ext="${fw##*.}"
+            cp "$fw" "dist/ota/${project_name}_${env_name}_${timestamp}.${ext}"
             found=1
           done
           if [ "$found" -eq 0 ]; then
-            echo 'No firmware.bin artifacts were produced.' >&2
+            echo 'No firmware.bin or firmware.hex artifacts were produced.' >&2
             exit 1
           fi
           find dist/ota -maxdepth 1 -type f | sort
 
-      - name: Upload direct OTA files to Gitea Packages
+      - name: Upload backup OTA artifact ZIP
-        env:
+        uses: actions/upload-artifact@v3
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        with:
-        run: |
+          name: ota-files
-          set -eu
+          path: dist/ota/*
-          package_name="$(printf '%s' "${GITHUB_REPOSITORY#*/}" | tr '[:upper:]' '[:lower:]')-ota"
+          if-no-files-found: error
-          package_version="${GITHUB_SHA}"
-          base_url="${GITHUB_SERVER_URL}/api/packages/${GITHUB_REPOSITORY_OWNER}/generic/${package_name}/${package_version}"
-          for file in dist/ota/*; do
-            [ -f "$file" ] || continue
-            curl --fail --silent --show-error --user "${GITHUB_ACTOR}:${GITEA_TOKEN}" --upload-file "$file" "${base_url}/$(basename "$file")"
-            echo "Uploaded $(basename "$file")"
-          done
 
-      - name: Verify uploaded OTA files
+      - name: Publish raw OTA files to rolling release
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
-          set -eu
+          python - <<'PY'
-          package_name="$(printf '%s' "${GITHUB_REPOSITORY#*/}" | tr '[:upper:]' '[:lower:]')-ota"
+          import json
-          package_version="${GITHUB_SHA}"
+          import mimetypes
-          curl --fail --silent --show-error --user "${GITHUB_ACTOR}:${GITEA_TOKEN}" "${GITHUB_SERVER_URL}/api/v1/packages/${GITHUB_REPOSITORY_OWNER}/generic/${package_name}/${package_version}/files" > /tmp/package-files.json
+          import os
-          python3 - <<'PY'
+          import sys
-import json
+          from pathlib import Path
-from pathlib import Path
+          from urllib.request import Request, urlopen
-files=json.loads(Path('/tmp/package-files.json').read_text())
+          from urllib.error import HTTPError
-assert files, 'no package files returned'
+
-for item in files:
+          server = os.environ['GITHUB_SERVER_URL']
-    print(item.get('name') or item.get('file_name') or item)
+          repo = os.environ['GITHUB_REPOSITORY']
-PY
+          token = os.environ.get('GITEA_TOKEN')
+          if not token:
+              print('GITEA_TOKEN missing', file=sys.stderr)
+              sys.exit(1)
+          api = f"{server}/api/v1/repos/{repo}"
+          headers = {
+              'Authorization': f'token {token}',
+              'Accept': 'application/json',
+              'Content-Type': 'application/json',
+              'User-Agent': 'Hermes-Agent'
+          }
+          tag = 'ota-builds'
+          release_name = 'OTA Builds'
+          body = 'Rolling OTA files from the latest successful push build.'
+
+          def req(url, method='GET', data=None, extra_headers=None):
+              h = dict(headers)
+              if extra_headers:
+                  h.update(extra_headers)
+              payload = None if data is None else json.dumps(data).encode()
+              r = Request(url, data=payload, headers=h, method=method)
+              with urlopen(r, timeout=120) as resp:
+                  body = resp.read()
+              if not body:
+                  return None
+              text = body.decode()
+              try:
+                  return json.loads(text)
+              except json.JSONDecodeError:
+                  return text
+
+          try:
+              release = req(f"{api}/releases/tags/{tag}")
+          except HTTPError as e:
+              if e.code != 404:
+                  raise
+              release = req(f"{api}/releases", method='POST', data={
+                  'tag_name': tag,
+                  'target': os.environ.get('GITHUB_SHA', ''),
+                  'name': release_name,
+                  'body': body,
+                  'draft': False,
+                  'prerelease': True,
+              })
+
+          release_id = release['id']
+          existing = req(f"{api}/releases/{release_id}/assets") or []
+          for asset in existing:
+              rid = asset['id']
+              req(f"{api}/releases/{release_id}/assets/{rid}", method='DELETE')
+
+          for path in sorted(Path('dist/ota').glob('*')):
+              if not path.is_file():
+                  continue
+              mime = mimetypes.guess_type(path.name)[0] or 'application/octet-stream'
+              upload_headers = {
+                  'Authorization': f'token {token}',
+                  'Content-Type': mime,
+                  'Accept': 'application/json',
+                  'User-Agent': 'Hermes-Agent'
+              }
+              url = f"{api}/releases/{release_id}/assets?name={path.name}"
+              data = path.read_bytes()
+              r = Request(url, data=data, headers=upload_headers, method='POST')
+              with urlopen(r, timeout=240) as resp:
+                  print(resp.read().decode())
+          PY

.gitea/workflows/ping.yml

@@ -1,7 +0,0 @@
-name: ping
-on: [push]
-jobs:
-  ping:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "ping from simple workflow"

.hermes-ota-verification.txt

@@ -1 +0,0 @@
-2026-08-30T02:53:27Z trigger push-based OTA verification

PING_TRIGGER_TEST.txt

@@ -1,2 +1,4 @@
-touch 2026-08-30T10:03:33-05:00
+actor namespace repro 2026-08-30T10:35:24-05:00
-post-update trigger 2026-08-30T10:06:16-05:00
+post-registration trigger 2026-08-30T10:51:56-05:00
+artifact test 2026-08-30T10:56:34-05:00
+artifact rollout verify 2026-08-30T12:04:17-05:00