ci: create a Gitea release when a v* tag is pushed

The Release workflow only ever published container images; there was no entry
under Releases. The new job runs after every image is published and writes the
image list and the commit log since the previous tag.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -165,3 +165,43 @@ jobs:
             echo "${{ steps.meta.outputs.tags }}"
             echo '```'
           } >> "$GITHUB_STEP_SUMMARY"
+
+  # Cria a entrada em "Releases" do repositório. Só roda quando uma tag v* é
+  # enviada, depois que todas as imagens foram publicadas. Usa o token do próprio
+  # Actions, então não precisa de segredo extra.
+  gitea-release:
+    name: Cria a release no Gitea
+    needs: [publish, prepare]
+    if: startsWith(gitea.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Release
+        env:
+          TAG: ${{ gitea.ref_name }}
+          TOKEN: ${{ gitea.token }}
+          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
+          NAMESPACE: ${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}
+        run: |
+          prev=$(git describe --tags --abbrev=0 "$TAG^" 2>/dev/null || true)
+          range=${prev:+$prev..}$TAG
+          {
+            echo "## Imagens"
+            echo
+            echo '```'
+            for s in protocols auth storage webmail migrations rspamd; do
+              echo "$NAMESPACE/$s:${TAG#v}"
+            done
+            echo '```'
+            echo
+            echo "## Mudanças${prev:+ desde $prev}"
+            echo
+            git log --no-merges --format='- %s (%h)' "$range"
+          } > notes.md
+          pre=false; case "$TAG" in *-*) pre=true ;; esac
+          jq -n --arg tag "$TAG" --arg name "LambdaMail ${TAG#v}" --rawfile body notes.md --argjson pre "$pre" \
+            '{tag_name:$tag, name:$name, body:$body, prerelease:$pre}' > release.json
+          curl -fsS -X POST "$API/releases" -H "Authorization: token $TOKEN" \
+            -H 'Content-Type: application/json' -d @release.json