ci: extract release script to fix YAML parse error (line 51)

The 'Upload release assets via Gitea API' step embedded a JSON
heredoc inside a YAML block scalar (run: |). Gitea's YAML parser
bailed at line 51 with 'could not find expected :'' when it saw
the leading '{' of the JSON body — it tried to interpret the
heredoc content as a flow mapping instead of literal text.

Fix: move the release logic into .github/scripts/create-release.sh
and pass the GitHub Actions context values as env vars. The step
becomes:

  env:
    GITEA_TOKEN: ...
    TAG_NAME: ...
    API_URL: ...
    REPOSITORY: ...
    SHA: ...
  run: ./.github/scripts/create-release.sh

Validates cleanly with PyYAML (yaml.safe_load). Pattern matches
bark-notify.sh from earlier — CI helpers live in .github/scripts/,
workflows stay slim.

Co-Authored-By: Claude <noreply@anthropic.com>

.github/scripts/create-release.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# create-release.sh — create a Gitea release and attach dist/ assets.
+#
+# Required env vars (set by the workflow):
+#   GITEA_TOKEN    Gitea API token with release write scope
+#   TAG_NAME       tag name (e.g. v0.0.1-beta)
+#   API_URL        Gitea API base URL (e.g. http://gitea.local/api/v1)
+#   REPOSITORY     owner/repo
+#   SHA            commit SHA the tag points at
+
+set -euo pipefail
+
+PAYLOAD=$(cat <<EOF
+{
+  "tag_name": "${TAG_NAME}",
+  "target_commitish": "${SHA}",
+  "name": "Release ${TAG_NAME}",
+  "body": "Auto-generated release assets.",
+  "draft": false,
+  "prerelease": false
+}
+EOF
+)
+
+echo "Creating Gitea release for tag ${TAG_NAME}..."
+
+RELEASE_RESPONSE=$(curl -fsS -X POST "${API_URL}/repos/${REPOSITORY}/releases" \
+  -H "accept: application/json" \
+  -H "authorization: token ${GITEA_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d "${PAYLOAD}")
+
+RELEASE_ID=$(printf '%s' "${RELEASE_RESPONSE}" | grep -oP '"id":\s*\K[0-9]+' | head -n 1)
+if [ -z "${RELEASE_ID}" ]; then
+  echo "ERROR: failed to create release. Response:"
+  echo "${RELEASE_RESPONSE}"
+  exit 1
+fi
+echo "Release created with ID ${RELEASE_ID}"
+
+for asset in dist/snapshot-*.whl dist/snapshot-*.tar.gz; do
+  if [ -f "${asset}" ]; then
+    echo "Uploading ${asset}..."
+    curl -fsS -X POST "${API_URL}/repos/${REPOSITORY}/releases/${RELEASE_ID}/assets" \
+      -H "accept: application/json" \
+      -H "authorization: token ${GITEA_TOKEN}" \
+      -F "attachment=@${asset}"
+    echo
+  else
+    echo "Skipping ${asset} (not found)"
+  fi
+done

.github/workflows/build.yml

@@ -33,52 +33,18 @@ jobs:
 
       # Only create a release + attach dist/ assets when pushing a v* tag.
       # On branch pushes / pull requests this step is skipped entirely.
+      # The release logic is in a separate script to avoid embedding a JSON
+      # heredoc inside a YAML block scalar (the previous version of this
+      # step was rejected by Gitea's YAML parser at line 51).
       - name: Upload release assets via Gitea API
         if: startsWith(github.ref, 'refs/tags/v')
         env:
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          TAG_NAME="${{ github.ref_name }}"
-
-          echo "Creating Gitea release for tag ${TAG_NAME}..."
-
-          RELEASE_RESPONSE=$(curl -fsS -X POST "${{ github.api_url }}/repos/${{ github.repository }}/releases" \
-            -H "accept: application/json" \
-            -H "authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$(cat <<EOF
-{
-  "tag_name": "${TAG_NAME}",
-  "target_commitish": "${{ github.sha }}",
-  "name": "Release ${TAG_NAME}",
-  "body": "Auto-generated release assets.",
-  "draft": false,
-  "prerelease": false
-}
-EOF
-)")
-
-          RELEASE_ID=$(printf '%s' "${RELEASE_RESPONSE}" | grep -oP '"id":\s*\K[0-9]+' | head -n 1)
-          if [ -z "${RELEASE_ID}" ]; then
-            echo "ERROR: failed to create release. Response:"
-            echo "${RELEASE_RESPONSE}"
-            exit 1
-          fi
-          echo "Release created with ID ${RELEASE_ID}"
-
-          for asset in dist/snapshot-*.whl dist/snapshot-*.tar.gz; do
-            if [ -f "${asset}" ]; then
-              echo "Uploading ${asset}..."
-              curl -fsS -X POST "${{ github.api_url }}/repos/${{ github.repository }}/releases/${RELEASE_ID}/assets" \
-                -H "accept: application/json" \
-                -H "authorization: token ${GITEA_TOKEN}" \
-                -F "attachment=@${asset}"
-              echo
-            else
-              echo "Skipping ${asset} (not found)"
-            fi
-          done
+          TAG_NAME: ${{ github.ref_name }}
+          API_URL: ${{ github.api_url }}
+          REPOSITORY: ${{ github.repository }}
+          SHA: ${{ github.sha }}
+        run: ./.github/scripts/create-release.sh
 
       # Always run, regardless of job status. The script is a side-effect;
       # if the notification itself fails we swallow the error so CI does