ci: trigger condition

artifact-upload served two purposes:
 1. download wheel from Actions UI for debugging
 2. (future) hand off to cross-job tests

Neither is currently used: distribution already goes through the
Gitea release via create-release.sh, and there are no downstream
jobs that need the artifact.

Removes the actions/upload-artifact@v4 step + the if: success()
gate. The build is now: uv build -> release (tag only) -> bark
notify. Cleaner, one fewer thing to fail on.

Co-Authored-By: Claude <noreply@anthropic.com>

.github/scripts/create-release.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# create-release.sh — create a Gitea release and attach dist/ assets.
+#
+# Required env vars (set by the workflow):
+#   GITEA_TOKEN    Gitea API token with release write scope
+#   TAG_NAME       tag name (e.g. v0.0.1-beta)
+#   API_URL        Gitea API base URL (e.g. http://gitea.local/api/v1)
+#   REPOSITORY     owner/repo
+#   SHA            commit SHA the tag points at
+
+set -euo pipefail
+
+PAYLOAD=$(cat <<EOF
+{
+  "tag_name": "${TAG_NAME}",
+  "target_commitish": "${SHA}",
+  "name": "Release ${TAG_NAME}",
+  "body": "Auto-generated release assets.",
+  "draft": false,
+  "prerelease": false
+}
+EOF
+)
+
+echo "Creating Gitea release for tag ${TAG_NAME}..."
+
+RELEASE_RESPONSE=$(curl -fsS -X POST "${API_URL}/repos/${REPOSITORY}/releases" \
+  -H "accept: application/json" \
+  -H "authorization: token ${GITEA_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d "${PAYLOAD}")
+
+RELEASE_ID=$(printf '%s' "${RELEASE_RESPONSE}" | grep -oP '"id":\s*\K[0-9]+' | head -n 1)
+if [ -z "${RELEASE_ID}" ]; then
+  echo "ERROR: failed to create release. Response:"
+  echo "${RELEASE_RESPONSE}"
+  exit 1
+fi
+echo "Release created with ID ${RELEASE_ID}"
+
+for asset in dist/snapshot-*.whl dist/snapshot-*.tar.gz; do
+  if [ -f "${asset}" ]; then
+    echo "Uploading ${asset}..."
+    curl -fsS -X POST "${API_URL}/repos/${REPOSITORY}/releases/${RELEASE_ID}/assets" \
+      -H "accept: application/json" \
+      -H "authorization: token ${GITEA_TOKEN}" \
+      -F "attachment=@${asset}"
+    echo
+  else
+    echo "Skipping ${asset} (not found)"
+  fi
+done

.github/workflows/build.yml

@@ -2,8 +2,8 @@ name: CI
 
 on:
   push:
-    branches:
-      - main
+#    branches:
+#      - main
     tags:
       - 'v*'
   pull_request:
@@ -11,74 +11,42 @@ on:
 jobs:
   ci:
     name: CI
-    # `astral-uv` is a self-hosted runner with uv pre-installed, so we can
-    # skip the setup-uv step entirely. pyproject.toml's
-    # [tool.hatch.build.hooks.jupyter-builder] handles jlpm install +
-    # jlpm build:prod before wheel assembly.
-    runs-on: astral-uv
+    # Standard GitHub-hosted ubuntu runner. uv is installed via the
+    # astral-sh/setup-uv action (one extra step vs. using a self-hosted
+    # runner with uv pre-installed, but matches what GitHub-hosted CI
+    # provides out of the box).
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Build package
-        run: uv build
-
-      - name: Upload wheel artifacts
-        if: success()
-        uses: actions/upload-artifact@v4
+      - name: Set up uv
+        uses: https://github.com/astral-sh/setup-uv@v6
         with:
-          name: snapshot-dist
-          path: dist/snapshot-*
-          if-no-files-found: error
+          enable-cache: true
+
+      - name: Build package
+        env:
+          # Use the Tsinghua PyPI mirror for build-environment resolution;
+          # the runner is in China and the default pypi.org is too slow
+          # / unreliable for build dependency install.
+          UV_DEFAULT_INDEX: "https://pypi.tuna.tsinghua.edu.cn/simple/"
+        run: uv build
 
       # Only create a release + attach dist/ assets when pushing a v* tag.
       # On branch pushes / pull requests this step is skipped entirely.
+      # The release logic is in a separate script to avoid embedding a JSON
+      # heredoc inside a YAML block scalar (the previous version of this
+      # step was rejected by Gitea's YAML parser at line 51).
       - name: Upload release assets via Gitea API
         if: startsWith(github.ref, 'refs/tags/v')
         env:
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          TAG_NAME="${{ github.ref_name }}"
-
-          echo "Creating Gitea release for tag ${TAG_NAME}..."
-
-          RELEASE_RESPONSE=$(curl -fsS -X POST "${{ github.api_url }}/repos/${{ github.repository }}/releases" \
-            -H "accept: application/json" \
-            -H "authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$(cat <<EOF
-{
-  "tag_name": "${TAG_NAME}",
-  "target_commitish": "${{ github.sha }}",
-  "name": "Release ${TAG_NAME}",
-  "body": "Auto-generated release assets.",
-  "draft": false,
-  "prerelease": false
-}
-EOF
-)")
-
-          RELEASE_ID=$(printf '%s' "${RELEASE_RESPONSE}" | grep -oP '"id":\s*\K[0-9]+' | head -n 1)
-          if [ -z "${RELEASE_ID}" ]; then
-            echo "ERROR: failed to create release. Response:"
-            echo "${RELEASE_RESPONSE}"
-            exit 1
-          fi
-          echo "Release created with ID ${RELEASE_ID}"
-
-          for asset in dist/snapshot-*.whl dist/snapshot-*.tar.gz; do
-            if [ -f "${asset}" ]; then
-              echo "Uploading ${asset}..."
-              curl -fsS -X POST "${{ github.api_url }}/repos/${{ github.repository }}/releases/${RELEASE_ID}/assets" \
-                -H "accept: application/json" \
-                -H "authorization: token ${GITEA_TOKEN}" \
-                -F "attachment=@${asset}"
-              echo
-            else
-              echo "Skipping ${asset} (not found)"
-            fi
-          done
+          TAG_NAME: ${{ github.ref_name }}
+          API_URL: ${{ github.api_url }}
+          REPOSITORY: ${{ github.repository }}
+          SHA: ${{ github.sha }}
+        run: ./.github/scripts/create-release.sh
 
       # Always run, regardless of job status. The script is a side-effect;
       # if the notification itself fails we swallow the error so CI does