♻️ Port CI workflow from GitHub Actions to Gitea Actions

The runner now lives on Gitea; move the workflow to .gitea/workflows/ and
delete the stale .github copy (Gitea ignores .github/, so it's drift bait).
Use the native gitea.ref context for the tag gate; keep actions pinned to
their GitHub sources (the runner has internet + caches them). Drop the
upload-artifact coverage step in favour of the self-hosted webserver plan
tracked in the backlog. Add an empty-secret gate as publish's first step so
a tag push without NPM_TOKEN fails loudly instead of silently no-oppping.

.gitea/workflows/ci.yml

@@ -20,15 +20,10 @@ jobs:
             - run: npm run build
             - run: npm run check
             - run: npm run test:ci
-            - name: Upload coverage
-              uses: actions/upload-artifact@v4
-              with:
-                  name: coverage
-                  path: coverage
 
-    # Advisory scans (dead code, dependency freshness). Non-blocking: surfaced on
+    # Advisory scans (dead code, dependency freshness). Non-blocking: surfaced in
-    # the PR for visibility, but must never gate a merge — so continue-on-error and
+    # the Actions tab for visibility, but must never gate a merge — so
-    # intentionally NOT in `publish`'s `needs`.
+    # continue-on-error and intentionally NOT in `publish`'s `needs`.
     maintain:
         runs-on: ubuntu-latest
         continue-on-error: true
@@ -42,10 +37,19 @@ jobs:
             - run: npm run maintain
 
     publish:
-        if: startsWith(github.ref, 'refs/tags/')
+        if: startsWith(gitea.ref, 'refs/tags/')
         needs: build
         runs-on: ubuntu-latest
         steps:
+            # Double-gate: publish only runs on a tag *and* aborts here if NPM_TOKEN
+            # is unset, so a tag push never silently no-ops (or half-publishes). Set
+            # NPM_TOKEN in the Gitea repo: Settings → Actions → Secrets.
+            - name: Assert NPM_TOKEN is configured
+              run: |
+                  if [ -z "${{ secrets.NPM_TOKEN }}" ]; then
+                      echo "::error::NPM_TOKEN secret is not set — refusing to publish."
+                      exit 1
+                  fi
             - uses: actions/checkout@v4
             - uses: actions/setup-node@v4
               with:

backlog.tasks

@@ -48,6 +48,11 @@ Documentation:
 ☐ Create backlog tasks for implementation
 
 Maintenance:
+☐ Serve CI coverage over a tiny self-hosted webserver (replace the zip artifact) @low
+    ☐ Add a minimal dir-listing webserver to the gitea docker setup (e.g. caddy `file_server browse` reusing the existing reverse proxy, or any single-binary static server, lipanski/docker-static-website)
+    ☐ CI writes each run's `coverage/` into a shared volume keyed by project + tag (e.g. `/coverage/tiny-pattern-ts/<tag>/`)
+    ☐ Browse to `…/coverage/<repo>/<tag>/index.html` in the browser; drop the `actions/upload-artifact` coverage step in favour of the shared-dir layout
+    → design: no deploy step in CI; the webserver just exposes the shared directory (decided over Gitea Pages / Codecov — neither confirmed available/ wanted)
 ✔ Set up lefthook pre-commit hook @done (9/8/2026, 10:52:56 AM)
 ✔ Configure tsconfig strictest + node26 profiles @done (9/8/2026, 10:08:37 AM)
 ✔ Add check:tsc as first tier in `npm run check` @done (9/8/2026, 10:08:37 AM)

cspell.json

@@ -22,6 +22,7 @@
         "tsgo",
         "tsserver",
         "gitea",
+        "lipanski",
         "pubv",
         "knope",
         "runwisp",