build: Complete build/release workflow

.gitea/workflows/actions.yaml

@@ -34,7 +34,7 @@ jobs:
             --verifyRelease @semantic-release/exec \
             --verifyReleaseCmd 'echo "version=${nextRelease.version}" >> $GITHUB_OUTPUT'
         env:
-          GIT_CREDENTIALS: djpbessems:${{ secrets.GIT_APIKEY }}
+          GIT_CREDENTIALS: ${{ secrets.GIT_USERNAME }}:${{ secrets.GIT_APIKEY }}
       - name: Assert semantic release output
         run: |
           [[ -z "${{ steps.sem_rel.outputs.version }}" ]] && {
@@ -64,7 +64,6 @@ jobs:
     name: Helm chart
     runs-on: dind-rootless
     needs: semrel_dryrun
-
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -94,3 +93,29 @@ jobs:
           helm cm-push \
             spamasaurusrex-*.tgz \
             spamasaurus
+
+  semrel:
+    name: Semantic Release
+    runs-on: dind-rootless
+    needs: build_container,build_chart
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: 20
+      - name: Install dependencies
+        run: |
+          npm install \
+            semantic-release \
+            @semantic-release/commit-analyzer \
+            @semantic-release/exec
+      - name: Semantic Release
+        run: |
+          npx semantic-release \
+            --branches ${{ gitea.refname }} \
+            --tag-format "v\$${version}" \
+            --plugins @semantic-release/commit-analyzer,@semantic-release/release-notes-generator,@semantic-release/changelog,@semantic-release/git
+        env:
+          GIT_CREDENTIALS: ${{ secrets.GIT_USERNAME }}:${{ secrets.GIT_APIKEY }}