Adding support for Obtainium with fixed Signing Keys and apk Release publishing

.gitea/workflows/BuildLinux.yml

@@ -41,7 +41,7 @@ jobs:
           apt-get install -y --no-install-recommends \
             clang cmake ninja-build pkg-config \
             libgtk-3-dev liblzma-dev libstdc++-12-dev \
-            curl unzip xz-utils
+            curl unzip xz-utils jq
 
       # `subosito/flutter-action` cannot be used: it caches the sdk through
       # `actions/cache@v5`, and the act-runner of this gitea instance only
@@ -72,6 +72,36 @@ jobs:
       - name: Pack the bundle
         run: tar -czf ac_web-linux-x64-${{ github.ref_name }}.tar.gz -C build/linux/x64/release bundle
 
+      # The tarball hangs off the release itself, next to the apk of the
+      # android job, so it can be downloaded without a login and stays after
+      # the artifacts of the run have been pruned.
+      - name: Attach the bundle to the release
+        env:
+          # The token gitea creates for the run. If the instance hands out a
+          # read only token, put a personal access token with repository write
+          # access in a secret and use that instead.
+          TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
+          asset="ac_web-linux-x64-${{ github.ref_name }}.tar.gz"
+
+          # The release event carries the id; the lookup by tag is only there
+          # for a manual re-run of the job.
+          releaseId="${{ github.event.release.id }}"
+          if [ -z "$releaseId" ] || [ "$releaseId" = "null" ]; then
+            releaseId=$(curl -fsSL -H "Authorization: token $TOKEN" \
+              "$api/releases/tags/${{ github.ref_name }}" | jq -r '.id')
+          fi
+
+          curl -fsSL -X POST \
+            -H "Authorization: token $TOKEN" \
+            -F "attachment=@$asset" \
+            "$api/releases/$releaseId/assets?name=$asset" > /dev/null
+
+          echo "Attached $asset to release $releaseId."
+
       # @v3 on purpose: `upload-artifact@v4` bundles `@actions/artifact` v2,
       # which refuses to run as soon as `GITHUB_SERVER_URL` is not github.com
       # ("GHESNotSupportedError") -- and on this instance it is the gitea host.