Resolve the plugin and SDKs from Gitea

PluginDownloadURL moves off github:// to a templated Gitea release URL.
Pulumi interpolates ${VERSION}, then appends
pulumi-resource-dokploy-v<version>-<os>-<arch>.tar.gz -- which is what
the GoReleaser archive template already produces. Schema, bridge
metadata and all four SDKs regenerated to carry it.

Releases publish to this instance's npm, PyPI, NuGet and Go registries
using the GITEA_TOKEN that Gitea injects, so no secrets need
configuring.

The Go SDK keeps its github.com module path, which is exactly why it
goes to Gitea's Go registry: pointing GOPROXY there is what makes that
path resolve at all. Verified locally by serving the module zip from a
file proxy and building a consumer against it -- note zip -D, without
which go get rejects the archive's directory entries.

.gitea/workflows/build.yml

@@ -0,0 +1,82 @@
+name: build
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch: {}
+
+env:
+  GO_VERSION: "1.25.x"
+  NODE_VERSION: "20.x"
+  PYTHON_VERSION: "3.11"
+  DOTNET_VERSION: "8.0.x"
+  # provider/go.mod carries a local `replace` for the upstream Terraform
+  # provider, so it has to sit next to this checkout under this exact name.
+  UPSTREAM_REPO: usr_unknown/terraform-provider-dokploy
+  UPSTREAM_DIR: dokploy-teraform
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout pulumi-dokploy
+        uses: actions/checkout@v4
+        with:
+          path: pulumi-dokploy
+
+      - name: Checkout upstream Terraform provider
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ env.UPSTREAM_REPO }}
+          path: ${{ env.UPSTREAM_DIR }}
+          token: ${{ secrets.GITEA_TOKEN }}
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: |
+            pulumi-dokploy/provider/go.sum
+            pulumi-dokploy/sdk/go.sum
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - uses: pulumi/actions@v6
+
+      - name: Lint provider
+        working-directory: pulumi-dokploy
+        run: make lint
+
+      - name: Build provider plugin
+        working-directory: pulumi-dokploy
+        run: make provider
+
+      # schema.json and bridge-metadata.json are checked in and carry no
+      # version, so they only change when the mapping does. A diff here means
+      # someone edited resources.go without re-running `make tfgen`.
+      - name: Fail if the checked-in schema is stale
+        working-directory: pulumi-dokploy
+        run: git diff --exit-code -- provider/cmd/pulumi-resource-dokploy/schema.json
+          provider/cmd/pulumi-resource-dokploy/bridge-metadata.json
+
+      - name: Build SDKs
+        working-directory: pulumi-dokploy
+        run: make build_sdks
+
+      - name: Build Go SDK
+        working-directory: pulumi-dokploy/sdk
+        run: go build ./...
+
+      - name: Build .NET SDK
+        working-directory: pulumi-dokploy/sdk/dotnet
+        run: dotnet build --nologo

.gitea/workflows/release.yml

@@ -0,0 +1,143 @@
+name: release
+
+on:
+  push:
+    tags: ["v*.*.*"]
+
+env:
+  GO_VERSION: "1.25.x"
+  NODE_VERSION: "20.x"
+  PYTHON_VERSION: "3.11"
+  DOTNET_VERSION: "8.0.x"
+  UPSTREAM_REPO: usr_unknown/terraform-provider-dokploy
+  UPSTREAM_DIR: dokploy-teraform
+  # Everything below authenticates with the token Gitea injects into every
+  # run, so releasing needs no configured secrets at all.
+  GITEA_HOST: gitea.coolify.vojtkov.dev
+  GITEA_OWNER: usr_unknown
+
+jobs:
+  # The plugin binaries. Pulumi resolves them from this release via the
+  # PluginDownloadURL baked into the schema, so this has to land before anyone
+  # installs an SDK.
+  plugin:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: pulumi-dokploy
+          fetch-depth: 0
+
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ env.UPSTREAM_REPO }}
+          path: ${{ env.UPSTREAM_DIR }}
+          token: ${{ secrets.GITEA_TOKEN }}
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - uses: goreleaser/goreleaser-action@v6
+        with:
+          version: latest
+          args: release --clean
+          workdir: pulumi-dokploy
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+
+  sdks:
+    needs: plugin
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: pulumi-dokploy
+
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ env.UPSTREAM_REPO }}
+          path: ${{ env.UPSTREAM_DIR }}
+          token: ${{ secrets.GITEA_TOKEN }}
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Derive version from tag
+        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
+
+      - name: Build SDKs
+        working-directory: pulumi-dokploy
+        run: make build_sdks VERSION=${{ env.VERSION }}
+
+      - name: Publish to the Gitea npm registry
+        working-directory: pulumi-dokploy/sdk/nodejs/bin
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          cat > .npmrc <<EOF
+          @maxvojtkov:registry=https://${GITEA_HOST}/api/packages/${GITEA_OWNER}/npm/
+          //${GITEA_HOST}/api/packages/${GITEA_OWNER}/npm/:_authToken=${TOKEN}
+          EOF
+          npm publish
+
+      - name: Publish to the Gitea PyPI registry
+        working-directory: pulumi-dokploy/sdk/python
+        env:
+          TWINE_USERNAME: ${{ env.GITEA_OWNER }}
+          TWINE_PASSWORD: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+          python -m twine upload \
+            --repository-url "https://${GITEA_HOST}/api/packages/${GITEA_OWNER}/pypi" \
+            dist/*
+
+      - name: Publish to the Gitea NuGet registry
+        working-directory: pulumi-dokploy/sdk/dotnet
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          dotnet pack --configuration Release --output ./nupkg
+          dotnet nuget push ./nupkg/*.nupkg \
+            --source "https://${GITEA_HOST}/api/packages/${GITEA_OWNER}/nuget/index.json" \
+            --api-key "$TOKEN" --skip-duplicate
+
+      # The Go SDK's module path stays github.com/maxvojtkov/..., which no
+      # amount of Gitea hosting changes. Uploading it to Gitea's Go registry is
+      # what makes that path resolvable anyway: consumers point GOPROXY here.
+      #
+      # A module zip must have every entry prefixed `<module>@<version>/` and
+      # must contain no directory entries at all -- hence `zip -D`, without
+      # which `go get` fails with "has unexpected file".
+      - name: Publish the Go SDK to the Gitea Go registry
+        working-directory: pulumi-dokploy
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          MODULE=github.com/maxvojtkov/pulumi-dokploy/sdk
+          STAGE="$(mktemp -d)"
+          DEST="$STAGE/$MODULE@v${VERSION}"
+          mkdir -p "$DEST"
+          cp sdk/go.mod sdk/go.sum "$DEST/"
+          cp -R sdk/go "$DEST/"
+          (cd "$STAGE" && zip -qrD "$STAGE/sdk.zip" . -x 'sdk.zip')
+          curl -fsSL -X PUT \
+            --user "${GITEA_OWNER}:${TOKEN}" \
+            --upload-file "$STAGE/sdk.zip" \
+            "https://${GITEA_HOST}/api/packages/${GITEA_OWNER}/go/upload"
+          echo "Published $MODULE@v${VERSION}"