Resolve the plugin and SDKs from Gitea

PluginDownloadURL moves off github:// to a templated Gitea release URL.
Pulumi interpolates ${VERSION}, then appends
pulumi-resource-dokploy-v<version>-<os>-<arch>.tar.gz -- which is what
the GoReleaser archive template already produces. Schema, bridge
metadata and all four SDKs regenerated to carry it.

Releases publish to this instance's npm, PyPI, NuGet and Go registries
using the GITEA_TOKEN that Gitea injects, so no secrets need
configuring.

The Go SDK keeps its github.com module path, which is exactly why it
goes to Gitea's Go registry: pointing GOPROXY there is what makes that
path resolve at all. Verified locally by serving the module zip from a
file proxy and building a consumer against it -- note zip -D, without
which go get rejects the archive's directory entries.

.gitea/workflows/build.yml

@@ -0,0 +1,82 @@
+name: build
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch: {}
+
+env:
+  GO_VERSION: "1.25.x"
+  NODE_VERSION: "20.x"
+  PYTHON_VERSION: "3.11"
+  DOTNET_VERSION: "8.0.x"
+  # provider/go.mod carries a local `replace` for the upstream Terraform
+  # provider, so it has to sit next to this checkout under this exact name.
+  UPSTREAM_REPO: usr_unknown/terraform-provider-dokploy
+  UPSTREAM_DIR: dokploy-teraform
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout pulumi-dokploy
+        uses: actions/checkout@v4
+        with:
+          path: pulumi-dokploy
+
+      - name: Checkout upstream Terraform provider
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ env.UPSTREAM_REPO }}
+          path: ${{ env.UPSTREAM_DIR }}
+          token: ${{ secrets.GITEA_TOKEN }}
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: |
+            pulumi-dokploy/provider/go.sum
+            pulumi-dokploy/sdk/go.sum
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - uses: pulumi/actions@v6
+
+      - name: Lint provider
+        working-directory: pulumi-dokploy
+        run: make lint
+
+      - name: Build provider plugin
+        working-directory: pulumi-dokploy
+        run: make provider
+
+      # schema.json and bridge-metadata.json are checked in and carry no
+      # version, so they only change when the mapping does. A diff here means
+      # someone edited resources.go without re-running `make tfgen`.
+      - name: Fail if the checked-in schema is stale
+        working-directory: pulumi-dokploy
+        run: git diff --exit-code -- provider/cmd/pulumi-resource-dokploy/schema.json
+          provider/cmd/pulumi-resource-dokploy/bridge-metadata.json
+
+      - name: Build SDKs
+        working-directory: pulumi-dokploy
+        run: make build_sdks
+
+      - name: Build Go SDK
+        working-directory: pulumi-dokploy/sdk
+        run: go build ./...
+
+      - name: Build .NET SDK
+        working-directory: pulumi-dokploy/sdk/dotnet
+        run: dotnet build --nologo