Merge pull request 'fix(ci): strip CR/LF from registry secrets so the push/release steps work' (#6) from fix/release-secret-newline into main

Reviewed-on: UOM/link#6

.gitea/workflows/release.yml

@@ -155,6 +155,11 @@ jobs:
           # Replace only the [package] version (the first `version = "..."`).
           sed -i -E "0,/^version = \"[^\"]+\"/s//version = \"${VERSION}\"/" "${WORKDIR}/Cargo.toml"
           grep -m1 '^version' "${WORKDIR}/Cargo.toml"
+          # Bumping the manifest version desyncs this crate's own entry in
+          # Cargo.lock, which would make the `--locked` fmt/test/build steps below
+          # fail ("cannot update the lock file ... --locked was passed"). Sync just
+          # the workspace member(s) into the lock — dependency pins are untouched.
+          cargo update --manifest-path "${WORKDIR}/Cargo.toml" --workspace
 
       # ── RUST ADAPTER: gates ──────────────────────────────────────────────
       - name: cargo fmt --check
@@ -195,14 +200,23 @@ jobs:
       # ── RELEASE ENGINE: commit the bump, tag, push ───────────────────────
       - name: Commit version bump and push tag
         if: ${{ steps.plan.outputs.release == 'true' }}
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           set -euo pipefail
           VERSION="${{ steps.plan.outputs.version }}"
           TAG="${{ steps.plan.outputs.tag }}"
+          # Secrets can arrive with a trailing newline (depending on how they were
+          # pasted); a stray CR/LF corrupts the remote URL ("credential url cannot
+          # be parsed"). Strip line breaks before building the URL. Passing them via
+          # env (not inline ${{ }}) also keeps a newline from breaking this script.
+          CI_USER="$(printf '%s' "${REGISTRY_USER}" | tr -d '\r\n')"
+          CI_TOKEN="$(printf '%s' "${REGISTRY_TOKEN}" | tr -d '\r\n')"
           git config user.name  "uo-link-ci"
           git config user.email "ci@whitlocktech.com"
           git remote set-url origin \
-            "https://${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_TOKEN }}@${GITEA_HOST}/${REPO}.git"
+            "https://${CI_USER}:${CI_TOKEN}@${GITEA_HOST}/${REPO}.git"
 
           git add "${WORKDIR}/Cargo.toml" "${WORKDIR}/Cargo.lock"
           if ! git diff --cached --quiet; then
@@ -217,14 +231,19 @@ jobs:
       # ── RELEASE ENGINE: create the Gitea release + upload assets ─────────
       - name: Create Gitea release and upload assets
         if: ${{ steps.plan.outputs.release == 'true' }}
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           set -euo pipefail
           TAG="${{ steps.plan.outputs.tag }}"
           API="https://${GITEA_HOST}/api/v1/repos/${REPO}"
           BODY="$(cat dist/CHANGELOG.md)"
+          # Same newline hygiene as the push step: a stray CR/LF in the token would
+          # corrupt the Authorization header.
+          CI_TOKEN="$(printf '%s' "${REGISTRY_TOKEN}" | tr -d '\r\n')"
 
           REL_ID="$(curl -sSf -X POST "${API}/releases" \
-            -H "Authorization: token ${{ secrets.REGISTRY_TOKEN }}" \
+            -H "Authorization: token ${CI_TOKEN}" \
             -H "Content-Type: application/json" \
             -d "$(jq -n --arg tag "$TAG" --arg body "$BODY" \
                    '{tag_name:$tag, name:$tag, body:$body, draft:false, prerelease:false}')" \
@@ -233,7 +252,7 @@ jobs:
 
           for f in "${BIN}-linux-x86_64" "${BIN}-windows-x86_64.exe" SHA256SUMS; do
             curl -sSf -X POST "${API}/releases/${REL_ID}/assets?name=${f}" \
-              -H "Authorization: token ${{ secrets.REGISTRY_TOKEN }}" \
+              -H "Authorization: token ${CI_TOKEN}" \
               -F "attachment=@dist/${f}" >/dev/null
             echo "  uploaded ${f}"
           done