From acfe534938460417a1f1db279cdec332ee544c8f Mon Sep 17 00:00:00 2001
From: Marc Villain <marc.villain@epita.fr>
Date: Thu, 15 Oct 2026 07:54:52 +0200
Subject: [PATCH] ci: release without third-party actions; manual dispatch for
 an existing tag

The organisation allows only its own actions, so the release job failed at
startup. Checkout uses git with the job token and Node comes from the official
tarball verified against its SHA-256. A manual dispatch builds an existing tag,
so a tag cut before this change is released without moving it.
---
 .github/workflows/release.yml | 39 +++++++++++++++++++++++++++++------
 1 file changed, 33 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 85b7e12..80349bf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,23 +1,50 @@
 # Cuts the signed PGXN distribution and publishes it as a GitHub release on
-# version tags (v<major>.<minor>.<patch>). Secret: PGMORBAC_RELEASE_KEY, the
-# Ed25519 private key PEM (content, not a path).
+# version tags (v<major>.<minor>.<patch>), or for an existing tag on manual
+# dispatch. Secret: PGMORBAC_RELEASE_KEY, the Ed25519 private key PEM (content,
+# not a path). The organisation only allows its own actions, so checkout and
+# Node setup are plain shell: git over the job token, and the official Node
+# tarball checked against its published SHA-256.
 name: release
 
 on:
   push:
     tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing version tag to release (e.g. v1.0.1)
+        required: true
 
 permissions:
   contents: write
 
+env:
+  NODE_VERSION: v24.12.0
+  RELEASE_REF: ${{ inputs.tag || github.ref_name }}
+
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24
+      - name: Check out the tag
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          case "$RELEASE_REF" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "not a version tag: $RELEASE_REF" >&2; exit 1 ;; esac
+          git init -q .
+          git -c http.extraheader="AUTHORIZATION: bearer $GITHUB_TOKEN" fetch -q --depth 1 \
+            "https://github.com/$GITHUB_REPOSITORY" "refs/tags/$RELEASE_REF:refs/tags/$RELEASE_REF"
+          git checkout -q "refs/tags/$RELEASE_REF"
+      - name: Install Node
+        run: |
+          base="https://nodejs.org/dist/$NODE_VERSION"
+          file="node-$NODE_VERSION-linux-x64.tar.xz"
+          curl -fsSLO "$base/$file"
+          curl -fsSL "$base/SHASUMS256.txt" | grep " $file\$" | sha256sum -c -
+          mkdir -p "$RUNNER_TEMP/node"
+          tar -xJf "$file" -C "$RUNNER_TEMP/node" --strip-components=1
+          rm "$file"
+          echo "$RUNNER_TEMP/node/bin" >> "$GITHUB_PATH"
       - run: npm install --no-audit --no-fund
       - name: Build and sign
         env: