ci: all-platform node binaries in the signed release manifest; signed SHA256SUMS for the archives; web build once before the parallel backend builds; release 0.3.3 [CI SKIP]

.woodpecker/gitea-release.yml

@@ -40,6 +40,8 @@ steps:
       GITEA_BASE: http://127.0.0.1:3100
       GITEA_TOKEN:
         from_secret: gitea_token
+      RELEASE_SIGNING_KEY:
+        from_secret: release_signing_key
     commands:
       - bash ci/publish-gitea-release.sh
     depends_on:

.woodpecker/linux-release.yml

@@ -15,6 +15,17 @@ when:
 concurrency: 1
 
 steps:
+  # 前端先打包好（几十秒），两个架构的 Backend 构建再并行：它们把 web/*/dist 内嵌进程序，只读这份产物，不再各自 npm ci
+  # （并行的两个 npm ci 会同时删 node_modules，互相搞坏）。步骤加了超时：卡住就几分钟内失败，不是耗着。
+  - name: web-build
+    image: bash
+    environment:
+      NPM_CONFIG_CACHE: /home/justme/.npm
+    commands:
+      - npm ci --prefix web --prefer-offline
+      - timeout 600 npm run build --prefix web
+    depends_on: []
+
   - name: linux-amd64-backend
     image: bash
     environment:
@@ -25,7 +36,8 @@ steps:
         from_secret: zot_secret
     commands:
       - bash ci/release-linux.sh amd64 backend
-    depends_on: []
+    depends_on:
+      - web-build
 
   - name: linux-arm64-backend
     image: bash
@@ -36,10 +48,9 @@ steps:
       ZOT_SECRET:
         from_secret: zot_secret
     commands:
-      # 两个架构共用一个工作目录：amd64 先构建并生成前端产物，arm64 在它之后（并行会同时 npm ci，互相删 node_modules）
       - bash ci/release-linux.sh arm64 backend
     depends_on:
-      - linux-amd64-backend
+      - web-build
 
   - name: backend-multiarch-index
     image: bash