ci: upload artifact to subdirectory to avoid file conflict

- scp target restored to /tmp/: /tmp/dist.tar.gz was treated as a
  directory by scp-action, breaking the deploy tar extract
- drop forgejo-release@v1 (unreachable from runner); upload asset
  via the Gitea release assets API using curl
- replace ssh-action "cp" with scp CLI: the cp ran on the remote
  server, leaving the runner without a local file
- chain deploy on upload-release-asset: its cleanup rm must not
  race with the artifact download
- clean up stale /tmp/dist.tar.gz on the server before each build

.gitea/workflows/build.yml

@@ -2,7 +2,7 @@ name: Build and Deploy
 
 on:
   release:
-    types: [created]
+    types: [published]
 
 jobs:
   build:
@@ -16,7 +16,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
 
       - name: Setup pnpm
@@ -30,44 +30,7 @@ jobs:
       - name: Build release archive
         run: pnpm build:tar
 
-      - name: Upload build artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist-archive
-          path: dist.tar.gz
-          retention-days: 1
-
-  upload-release-asset:
-    name: Upload to Gitea Release
-    needs: build
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Download build artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: dist-archive
-
-      - name: Upload release asset
-        uses: https://gitea.com/actions/forgejo-release@v1
-        with:
-          direction: upload
-          files: dist.tar.gz
-        env:
-          FORGEJO_TOKEN: ${{ secrets.GITEA_TOKEN }}
-
-  deploy-to-server:
-    name: Deploy to onixbyte.cn
-    needs: build
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Download build artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: dist-archive
-
-      - name: Upload archive to server
+      - name: Upload artifact to server
         uses: appleboy/scp-action@v0.1.7
         with:
           host: ${{ vars.DEPLOY_HOST }}
@@ -75,9 +38,63 @@ jobs:
           port: ${{ vars.DEPLOY_PORT }}
           key: ${{ secrets.DEPLOY_SSH_KEY }}
           source: "dist.tar.gz"
-          target: "/tmp/"
+          target: "/tmp/build-artifact/"
 
-      - name: Extract archive and set ownership
+      - name: Move artifact to /tmp
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ vars.DEPLOY_HOST }}
+          username: ${{ vars.DEPLOY_USER }}
+          port: ${{ vars.DEPLOY_PORT }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          command: mv /tmp/build-artifact/dist.tar.gz /tmp/dist.tar.gz && rm -rf /tmp/build-artifact
+
+  upload-release-asset:
+    name: Upload to Gitea Release
+    needs: build
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download artifact from server
+        env:
+          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ vars.DEPLOY_USER }}
+          DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          set -e
+          SSH_DIR="${RUNNER_TEMP}/ssh"
+          mkdir -p "$SSH_DIR"
+          chmod 700 "$SSH_DIR"
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$SSH_DIR/key"
+          chmod 600 "$SSH_DIR/key"
+          scp -i "$SSH_DIR/key" \
+              -P "$DEPLOY_PORT" \
+              -o StrictHostKeyChecking=accept-new \
+              -o UserKnownHostsFile="$SSH_DIR/known_hosts" \
+              "${DEPLOY_USER}@${DEPLOY_HOST}:/tmp/dist.tar.gz" \
+              ./dist.tar.gz
+          rm -rf "$SSH_DIR"
+
+      - name: Upload release asset via Gitea API
+        run: |
+          set -e
+          RELEASE_ID=$(jq -r '.release.id' "$GITEA_EVENT_PATH")
+          URL="${GITEA_SERVER_URL}/api/v1/repos/${GITEA_REPOSITORY}/releases/${RELEASE_ID}/assets?name=dist.tar.gz"
+          curl -fsSL \
+            -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/gzip" \
+            --data-binary "@dist.tar.gz" \
+            "${URL}"
+
+  deploy-to-server:
+    name: Deploy to onixbyte.cn
+    needs: [build, upload-release-asset]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Extract archive and deploy
         uses: appleboy/ssh-action@v1.0.3
         with:
           host: ${{ vars.DEPLOY_HOST }}