# Publishing Vela apps to the user's Gitea

Self-hosted Gitea: https://gitea.oimcloud.myaddr.tools/ — account `codex-bot` (id 55, admin), email codex-bot@bots.com.
Auth: `git config --global credential.helper store` + `~/.git-credentials` (chmod 600) holding `https://codex-bot:<token>@gitea.oimcloud.myaddr.tools`. git identity = codex-bot / codex-bot@bots.com. Token is a 40-char hex (Gitea access token).

## Create a repo (Gitea API)

```bash
TOKEN=<40-char-hex>  BASE=https://gitea.oimcloud.myaddr.tools
curl -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
  -d '{"name":"vela-snake","description":"...","private":false,"auto_init":false}' \
  "$BASE/api/v1/user/repos"
```

## Push source

```bash
git init -b main; git add -A; git commit -m "..."
git remote add origin "$BASE/codex-bot/<repo>.git"; git push -u origin main
```

## Attach the .rpk as a tagged release asset (two API calls)

```bash
# 1) create release -> returns JSON with an 'id'
curl -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
  -d '{"tag_name":"v0.3","target_commitish":"main","name":"SNAKE 0.3","body":"..."}' \
  "$BASE/api/v1/repos/codex-bot/<repo>/releases"
# 2) upload the binary (multipart)
curl -X POST -H "Authorization: token $TOKEN" -F "attachment=@dist/foo.rpk" \
  "$BASE/api/v1/repos/codex-bot/<repo>/releases/<id>/assets?name=foo.rpk"
```

## Open an issue

```bash
curl -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
  -d '{"title":"...","body":"..."}' "$BASE/api/v1/repos/codex-bot/<repo>/issues"
```

## Pitfalls
- `node_modules` is a symlink → /tmp/hw/node_modules. `.gitignore` must say `node_modules` (NO trailing slash) — a trailing slash matches directories only, so the symlink was committed until fixed with `git rm --cached node_modules`.
- `sign/*.pem` holds the signing key + cert — keep gitignored; NEVER commit private.pem.
- `dist/` and `build/` are gitignored; the installable .rpk is delivered via a release asset, not committed to git.
- Verify nothing secret leaked: `git ls-files | grep -E 'sign|dist|node_modules|\.pem|\.rpk'` should be empty (the node_modules symlink must also be excluded).